CWE-288 使用候选路径或通道进行的认证绕过 类弱点 548 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-288 指认证绕过漏洞，即系统虽设有认证机制，却存在无需验证的备用路径或通道。攻击者常利用该缺陷，通过未受保护的接口或隐藏入口直接访问受限资源，从而规避身份校验。开发者应确保所有访问入口均强制实施统一且严格的认证策略，全面审查系统架构，消除任何未授权访问的潜在路径，以保障系统安全性。
module foo_bar(data_out, data_in, incoming_id, address, clk, rst_n); output [31:0] data_out; input [31:0] data_in, incoming_id, address; input clk, rst_n; wire write_auth, addr_auth; reg [31:0] data_out, acl_oh_allowlist, q; assign write_auth = | (incoming_id & acl_oh_allowlist) ? 1 : 0; always @* acl_oh_allowlist <= 32'h8312; assign addr_auth = (address == 32'hF00) ? 1: 0; always @ (posedge clk or negedge rst_n) if (!rst_n) begin q <= 32'h0; data_out <= 32'h0; end else begin q <= (addr_auth & write_auth) ? data_in: q; data_out <= q; end end endmoduleassign addr_auth = (address == 32'hF00) ? 1: 0;| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-35214 | BlackBerry CylanceOPTICS 安全漏洞 — CylanceOPTICS for Windows | 7.1AI | High AI | 2024-08-20 |
| CVE-2024-7628 | WordPress plugin MStore API 安全漏洞 — MStore API – Create Native Android & iOS Apps On The Cloud | 8.1 | High | 2024-08-15 |
| CVE-2024-35124 | IBM OpenBMC 安全漏洞 — OpenBMC | 7.5 | High | 2024-08-13 |
| CVE-2024-6684 | Inohom Nova Panel N7 安全漏洞 — inohom Nova Panel N7 | 9.8AI | Critical AI | 2024-08-12 |
| CVE-2024-7503 | WordPress plugin WooCommerce - Social Login 安全漏洞 — WooCommerce - Social Login | 9.8 | Critical | 2024-08-10 |
| CVE-2024-7350 | WordPress plugin BookingPress 安全漏洞 — Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress | 9.8 | Critical | 2024-08-08 |
| CVE-2024-7314 | AJ-Report 安全漏洞 — AJ-Report | 9.8 | Critical | 2024-08-02 |
| CVE-2024-7007 | Positron Broadcast Signal Processor TRA7005 安全漏洞 — Broadcast Signal Processor TRA7005 | 9.8AI | Critical AI | 2024-07-25 |
| CVE-2024-7027 | WordPress plugin WooCommerce - PDF Vouchers 安全漏洞 — WooCommerce - PDF Vouchers | 7.3 | High | 2024-07-24 |
| CVE-2024-38437 | D-Link DSL-225 安全漏洞 — DSL-225 | 9.8 | Critical | 2024-07-21 |
| CVE-2024-6635 | WordPress plugin WooCommerce - Social Login 安全漏洞 — WooCommerce - Social Login | 7.3 | High | 2024-07-20 |
| CVE-2024-5620 | PruvaSoft Informatics Apinizer Management Console 安全漏洞 — Apinizer Management Console | 6.5 | Medium | 2024-07-18 |
| CVE-2024-6328 | WordPress plugin MStore API 安全漏洞 — MStore API – Create Native Android & iOS Apps On The Cloud | 9.8 | Critical | 2024-07-12 |
| CVE-2024-6397 | WordPress plugin InstaWP Connect 安全漏洞 — InstaWP Connect – 1-click WP Staging & Migration | 9.8 | Critical | 2024-07-11 |
| CVE-2024-39309 | Parse Server 安全漏洞 — parse-server | 9.8 | Critical | 2024-07-01 |
| CVE-2024-28200 | N‑able N-Central 安全漏洞 — N-central | 9.1 | Critical | 2024-07-01 |
| CVE-2024-5322 | N‑able N-Central 安全漏洞 — N-central | 9.1 | Critical | 2024-07-01 |
| CVE-2024-2973 | Session Smart Router 安全漏洞 — Session Smart Router | 10.0 | Critical | 2024-06-27 |
| CVE-2024-31916 | IBM OpenBMC 安全漏洞 — OpenBMC | 7.5 | High | 2024-06-27 |
| CVE-2024-5432 | WordPress plugin Lifeline Donation 安全漏洞 — Lifeline Donation | 9.8 | Critical | 2024-06-20 |
| CVE-2024-3496 | Toshiba e-STUDIO 安全漏洞 — Toshiba Tec e-Studio multi-function peripheral (MFP) | 8.8 | High | 2024-06-14 |
| CVE-2024-38279 | Motorola Solutions Vigilant Fixed LPR Coms Box 安全漏洞 — Vigilant Fixed LPR Coms Box (BCAV1F2-C600) | 4.6AI | Medium AI | 2024-06-13 |
| CVE-2024-2012 | Hitachi FOXMAN-UN 安全漏洞 — FOXMAN-UN | 9.1 | Critical | 2024-06-11 |
| CVE-2024-2013 | Hitachi FOXMAN-UN 安全漏洞 — FOXMAN-UN | 10.0 | Critical | 2024-06-11 |
| CVE-2024-4552 | WordPress plugin Social Login Lite For WooCommerce 安全漏洞 — Social Login Lite For WooCommerce | 9.8 | Critical | 2024-06-04 |
| CVE-2024-36470 | JetBrains TeamCity 安全漏洞 — TeamCity | 8.1 | High | 2024-05-29 |
| CVE-2024-5150 | WordPress plugin Login with phone number 安全漏洞 — OTP Login With Phone Number, OTP Verification | 9.8 | Critical | 2024-05-29 |
| CVE-2024-5204 | WordPress plugin Swiss Toolkit For WP 安全漏洞 — Swiss Toolkit For WP | 8.8 | High | 2024-05-29 |
| CVE-2024-4544 | WordPress plugin Pie Register 安全漏洞 — Pie Register - Social Sites Login (Add on) | 9.8 | Critical | 2024-05-24 |
| CVE-2024-4393 | WordPress plugin Social Connect 安全漏洞 — Social Connect | 9.8 | Critical | 2024-05-08 |
CWE-288（使用候选路径或通道进行的认证绕过） 是常见的弱点类别，本平台收录该类弱点关联的 548 条 CVE 漏洞。