CWE-269 特权管理不恰当 类弱点 1470 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-269 属于权限管理不当漏洞，指产品未能正确分配、修改、跟踪或检查用户权限，导致攻击者获得非预期的控制范围。攻击者常利用此缺陷提升权限或越权访问敏感资源。开发者应实施最小权限原则，严格验证每次操作的身份与权限，确保权限分配、变更及撤销过程的安全性与完整性，从而防止未授权访问。
def makeNewUserDir(username): if invalidUsername(username): #avoid CWE-22 and CWE-78 print('Usernames cannot contain invalid characters') return False try: raisePrivileges() os.mkdir('/home/' + username) lowerPrivileges() except OSError: print('Unable to create new user directory for user:' + username) return False return Trueseteuid(0); /* do some stuff */ seteuid(getuid());| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2020-7544 | Schneider Electric EcoStruxure Operator Terminal Expert 权限许可和访问控制问题漏洞 — EcoStruxureª Operator Terminal Expert runtime (Vijeo XD) | 7.8 | - | 2020-11-19 |
| CVE-2020-12495 | Endress+Hauser Ecograph T 访问控制错误漏洞 — RSG35 - Ecograph T | 9.1 | Critical | 2020-11-19 |
| CVE-2020-8269 | Citrix Systems Citrix Virtual Apps and Desktops 安全漏洞 — Citrix Virtual Apps and Desktops | 8.8 | - | 2020-11-16 |
| CVE-2020-16126 | Ubuntu AccountsService 安全漏洞 — accountsservice | 3.3 | Low | 2020-11-11 |
| CVE-2020-16122 | PackageKit 安全漏洞 — packagekit | 8.2 | High | 2020-11-07 |
| CVE-2020-3600 | Cisco SD-WAN vEdge 安全漏洞 — Cisco SD-WAN Solution | 7.8 | High | 2020-11-06 |
| CVE-2020-3595 | Cisco SD-WAN vEdge 访问控制错误漏洞 — Cisco SD-WAN Solution | 7.8 | High | 2020-11-06 |
| CVE-2020-3594 | Cisco SD-WAN vEdge 安全漏洞 — Cisco SD-WAN Solution | 7.8 | High | 2020-11-06 |
| CVE-2020-3593 | Cisco SD-WAN vManage Software 安全漏洞 — Cisco SD-WAN Solution | 7.8 | High | 2020-11-06 |
| CVE-2020-27654 | Synology Router Manager 访问控制错误漏洞 — Synology Router Manager (SRM) | 9.8 | Critical | 2020-10-29 |
| CVE-2020-27655 | Synology Router Manager 访问控制错误漏洞 — Synology Router Manager (SRM) | 6.5 | Medium | 2020-10-29 |
| CVE-2020-7330 | McAfee Total Protection 安全漏洞 — McAfee Total Protection (MTP) Trial | 7.5 | High | 2020-10-14 |
| CVE-2020-15797 | Siemens DCA Vantage Analyzer 安全漏洞 — DCA Vantage Analyzer | 6.8 | - | 2020-10-13 |
| CVE-2020-8223 | Nextcloud 安全漏洞 — Nextcloud Server | 7.3 | - | 2020-10-05 |
| CVE-2020-3393 | Cisco IOS 输入验证错误漏洞 — Cisco IOS XE Software | 6.0 | Medium | 2020-09-24 |
| CVE-2020-8247 | Citrix Systems 多款产品安全漏洞 — Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP | 9.8 | - | 2020-09-18 |
| CVE-2020-7311 | McAfee Agent 安全漏洞 — MA for Windows | 7.8 | High | 2020-09-10 |
| CVE-2020-7324 | McAfee MVISION Endpoint 访问控制错误漏洞 — MVISION Endpoint | 6.1 | Medium | 2020-09-09 |
| CVE-2020-7523 | Schneider Electric Modbus Serial Driver 安全漏洞 — Schneider Electric Modbus Serial Driver (64 bits) versions prior to V3.20 IE 30, Schneider Electric Modbus Serial Driver (32 bits) versions prior to V2.20 IE 30, and Schneider Electric Modbus Driver Suite versions prior to V14.15.0.0 | 8.8 | - | 2020-08-31 |
| CVE-2020-7310 | McAfee Total Protection 安全漏洞 — McAfee Total Protection (MTP) Trial | 6.9 | Medium | 2020-08-21 |
| CVE-2020-15149 | NodeBB 授权问题漏洞 — NodeBB | 9.9 | Critical | 2020-08-19 |
| CVE-2020-7305 | McAfee Data Loss Prevention ePO extension 安全漏洞 — DLP ePO extension | 6.7 | Medium | 2020-08-13 |
| CVE-2020-13522 | SoftPerfect RAM Disk 输入验证错误漏洞 — SoftPerfect | 7.1 | - | 2020-08-04 |
| CVE-2020-7281 | McAfee Total Protection 安全漏洞 — McAfee Total Protection (MTP) | 7.5 | High | 2020-07-03 |
| CVE-2020-7509 | Schneider Electric Easergy T300 安全漏洞 — Easergy T300 (Firmware version 1.5.2 and older) | 7.2 | - | 2020-06-16 |
| CVE-2020-7280 | McAfee VirusScan Enterprise 安全漏洞 — McAfee VirusScan Enterprise (VSE) | 7.8 | High | 2020-06-10 |
| CVE-2019-3588 | McAfee VirusScan Enterprise 安全漏洞 — McAfee VirusScan Enterprise (VSE) | 6.3 | Medium | 2020-06-10 |
| CVE-2019-3585 | McAfee VirusScan Enterprise 权限许可和访问控制问题漏洞 — McAfee VirusScan Enterprise (VSE) | 7.0 | High | 2020-06-10 |
| CVE-2020-8021 | Open Build Service 访问控制错误漏洞 — Open Build Service | 5.3 | Medium | 2020-05-19 |
| CVE-2020-6992 | GE CIMPLICITY 安全漏洞 — GE Digital CIMPLICITY | 6.7 | - | 2020-04-15 |
CWE-269（特权管理不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1470 条 CVE 漏洞。