CWE-269 特权管理不恰当 类弱点 1307 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-269 属于权限管理不当漏洞，指产品未能正确分配、修改、跟踪或检查用户权限，导致攻击者获得非预期的控制范围。攻击者常利用此缺陷提升权限或越权访问敏感资源。开发者应实施最小权限原则，严格验证每次操作的身份与权限，确保权限分配、变更及撤销过程的安全性与完整性，从而防止未授权访问。
def makeNewUserDir(username): if invalidUsername(username): #avoid CWE-22 and CWE-78 print('Usernames cannot contain invalid characters') return False try: raisePrivileges() os.mkdir('/home/' + username) lowerPrivileges() except OSError: print('Unable to create new user directory for user:' + username) return False return Trueseteuid(0); /* do some stuff */ seteuid(getuid());| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2020-8223 | Nextcloud 安全漏洞 — Nextcloud Server | 7.3 | - | 2020-10-05 |
| CVE-2020-3393 | Cisco IOS 输入验证错误漏洞 — Cisco IOS XE Software | 6.0 | Medium | 2020-09-24 |
| CVE-2020-8247 | Citrix Systems 多款产品安全漏洞 — Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP | 9.8 | - | 2020-09-18 |
| CVE-2020-7311 | McAfee Agent 安全漏洞 — MA for Windows | 7.8 | High | 2020-09-10 |
| CVE-2020-7324 | McAfee MVISION Endpoint 访问控制错误漏洞 — MVISION Endpoint | 6.1 | Medium | 2020-09-09 |
| CVE-2020-7523 | Schneider Electric Modbus Serial Driver 安全漏洞 — Schneider Electric Modbus Serial Driver (64 bits) versions prior to V3.20 IE 30, Schneider Electric Modbus Serial Driver (32 bits) versions prior to V2.20 IE 30, and Schneider Electric Modbus Driver Suite versions prior to V14.15.0.0 | 8.8 | - | 2020-08-31 |
| CVE-2020-7310 | McAfee Total Protection 安全漏洞 — McAfee Total Protection (MTP) Trial | 6.9 | Medium | 2020-08-21 |
| CVE-2020-15149 | NodeBB 授权问题漏洞 — NodeBB | 9.9 | Critical | 2020-08-19 |
| CVE-2020-7305 | McAfee Data Loss Prevention ePO extension 安全漏洞 — DLP ePO extension | 6.7 | Medium | 2020-08-13 |
| CVE-2020-13522 | SoftPerfect RAM Disk 输入验证错误漏洞 — SoftPerfect | 7.1 | - | 2020-08-04 |
| CVE-2020-7281 | McAfee Total Protection 安全漏洞 — McAfee Total Protection (MTP) | 7.5 | High | 2020-07-03 |
| CVE-2020-7509 | Schneider Electric Easergy T300 安全漏洞 — Easergy T300 (Firmware version 1.5.2 and older) | 7.2 | - | 2020-06-16 |
| CVE-2020-7280 | McAfee VirusScan Enterprise 安全漏洞 — McAfee VirusScan Enterprise (VSE) | 7.8 | High | 2020-06-10 |
| CVE-2019-3588 | McAfee VirusScan Enterprise 安全漏洞 — McAfee VirusScan Enterprise (VSE) | 6.3 | Medium | 2020-06-10 |
| CVE-2019-3585 | McAfee VirusScan Enterprise 权限许可和访问控制问题漏洞 — McAfee VirusScan Enterprise (VSE) | 7.0 | High | 2020-06-10 |
| CVE-2020-8021 | Open Build Service 访问控制错误漏洞 — Open Build Service | 5.3 | Medium | 2020-05-19 |
| CVE-2020-6992 | GE CIMPLICITY 安全漏洞 — GE Digital CIMPLICITY | 6.7 | - | 2020-04-15 |
| CVE-2020-7273 | McAfee Endpoint Security 安全漏洞 — McAfee Endpoint Security (ENS) | 6.7 | Medium | 2020-04-15 |
| CVE-2020-7274 | McAfee Endpoint Security 安全漏洞 — McAfee Endpoint Security (ENS) | 6.6 | Medium | 2020-04-15 |
| CVE-2019-15789 | Canonical MicroK8s 安全漏洞 — MicroK8s | 8.8 | High | 2020-04-08 |
| CVE-2018-17954 | SUSE OpenStack Cloud 安全漏洞 — SUSE OpenStack Cloud 7 | 9.3 | Critical | 2020-04-03 |
| CVE-2020-6968 | Honeywell INNCOM INNControl 3 安全漏洞 — INNCOM INNControl 3 | 7.8 | - | 2020-02-20 |
| CVE-2019-11288 | Pivotal Software tc Server和Runtime 安全漏洞 — Pivotal tc Server 4.x | 7.1 | - | 2020-01-27 |
| CVE-2019-18899 | openSUSE Leap apt-cacher-ng 安全漏洞 — Leap 15.1 | 6.2 | Medium | 2020-01-23 |
| CVE-2019-11280 | Pivotal Software Application Service Apps Manager 安全漏洞 — Pivotal Application Service (PAS) | 8.8 | - | 2019-09-20 |
| CVE-2019-11270 | Cloud Foundry UAA 安全特征问题漏洞 — UAA Release (OSS) | 7.5 | - | 2019-08-05 |
| CVE-2019-7394 | CA Risk Authentication和CA Strong Authentication 权限许可和访问控制问题漏洞 — CA Strong Authentication | 8.8 | - | 2019-05-28 |
| CVE-2019-3786 | Cloud Foundry BOSH Backup and Restore CLI 授权问题漏洞 — BOSH Backup and Restore | 7.1 | - | 2019-04-24 |
| CVE-2018-19012 | 多款Drager产品安全漏洞 — Dräger Infinity Delta | 9.9 | - | 2019-01-28 |
| CVE-2018-19635 | CA Service Desk Manager 权限许可和访问控制问题漏洞 — CA Service Desk Manager | 9.8 | - | 2019-01-22 |
CWE-269（特权管理不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1307 条 CVE 漏洞。