目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-312 敏感数据的明文存储 类漏洞列表 311

CWE-312 敏感数据的明文存储 类弱点 311 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-312指敏感信息以明文形式存储在可能被其他控制域访问的资源中。攻击者常通过直接读取配置文件、日志或数据库文件窃取凭证等关键数据。开发者应避免此类风险，采用强加密算法对静态数据进行加密存储，严格限制文件访问权限，并定期审查数据存储逻辑，确保敏感信息仅在必要时以密文形式保留，从而防止未授权访问。

MITRE CWE 官方描述
CWE：CWE-312 敏感信息的明文存储 英文：产品将敏感信息以明文形式存储在可能被其他控制域（control sphere）访问的资源中。
常见影响 (1)
Confidentiality Read Application Data
An attacker with access to the system could read sensitive information stored in cleartext (i.e., unencrypted). Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.
缓解措施 (2)
Implementation, System Configuration, Operation When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
Implementation, System Configuration, Operation In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
代码示例 (2)
The following code excerpt stores a plaintext user account ID in a browser cookie.
response.addCookie( new Cookie("userAccountID", acctID);
Bad · Java
This code writes a user's login information to a cookie so the user does not have to login again later.
function persistLogin($username, $password){ $data = array("username" => $username, "password"=> $password); setcookie ("userdata", $data); }
Bad · PHP
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-76381 Splunk MS Graph for Active Directory app for Splunk SOAR 加密问题漏洞 — MS Graph for Active Directory app for Splunk SOAR 4.3 Medium 2026-08-19
CVE-2026-76382 Splunk Phantom app for Splunk SOAR 加密问题漏洞 — Phantom app for Splunk SOAR 4.3 Medium 2026-08-19
CVE-2026-76379 Splunk Cisco Webex app for Splunk SOAR 加密问题漏洞 — Cisco Webex app for Splunk SOAR 4.3 Medium 2026-08-19
CVE-2026-76380 Splunk CrowdStrike OAuth API app for Splunk SOAR 加密问题漏洞 — CrowdStrike OAuth API app for Splunk SOAR 4.3 Medium 2026-08-19
CVE-2026-76378 Splunk Cisco Secure Malware Analytics app for Splunk SOAR 加密问题漏洞 — Cisco Secure Malware Analytics app for Splunk SOAR 4.3 Medium 2026-08-19
CVE-2026-76377 Splunk Azure AD Graph app for Splunk SOAR 加密问题漏洞 — Azure AD Graph app for Splunk SOAR 4.3 Medium 2026-08-19
CVE-2026-76376 Splunk AWS IAM app for Splunk SOAR 加密问题漏洞 — AWS IAM app for Splunk SOAR 4.3 Medium 2026-08-19
CVE-2026-15065 IBM AIX 加密问题漏洞 — AIX 9.1 Critical 2026-08-19
CVE-2026-73834 Red Hat Advanced Cluster Management for Kubernetes 加密问题漏洞 — Red Hat Advanced Cluster Management for Kubernetes 2.11 5.5 Medium 2026-08-18
CVE-2026-5224 Kriptok Cryptosim 加密问题漏洞 — Cryptosim 5.7 Medium 2026-08-18
CVE-2026-59244 Apache Airflow 加密问题漏洞 — Apache Airflow - - 2026-08-12
CVE-2026-68970 Apache Airflow 加密问题漏洞 — Apache Airflow - - 2026-08-12
CVE-2026-66016 JFrog artifactory 加密问题漏洞 — artifactory 6.7 Medium 2026-08-12
CVE-2026-61928 Microsoft Windows Hello 加密问题漏洞 — Windows 10 Version 1607 5.5 Medium 2026-08-11
CVE-2026-47702 Baptiste Arnaud Typebot 加密问题漏洞 — typebot.io 9.1 Critical 2026-08-11
CVE-2026-19391 Red Hat Insights Core 加密问题漏洞 — Pen Drive Powered by Red Hat Lightspeed 6.5 Medium 2026-08-11
CVE-2026-20312 Cisco Catalyst SD-WAN Controller 加密问题漏洞 — Cisco Catalyst SD-WAN Controller 8.8 High 2026-08-05
CVE-2026-55997 Rancher 加密问题漏洞 — rancher 8.8 High 2026-08-05
CVE-2026-15721 Bilin HUMANIST Digital Human Resources 加密问题漏洞 — HUMANIST Digital Human Resources 9.8 Critical 2026-08-04
CVE-2026-18591 Meesho Online Shopping App 加密问题漏洞 — Online Shopping App 2.1 Low 2026-08-03
CVE-2026-34490 Johnson Controls XAAP Application 加密问题漏洞 — XAAP Application 4.8 Medium 2026-07-31
CVE-2026-55985 Tycon Systems TPDIN-Monitor-WEB2 加密问题漏洞 — TPDIN-Monitor-WEB2 4.3 Medium 2026-07-24
CVE-2026-16802 Devolutions PowerShell Universal 加密问题漏洞 — PowerShell Universal - - 2026-07-24
CVE-2024-58023 BOSCH Configuration Manager 加密问题漏洞 — Bosch Configuration Manager 8.4 High 2026-07-23
CVE-2026-65599 n8n 加密问题漏洞 — n8n 5.1 Medium 2026-07-22
CVE-2026-16213 Fantomas42 Django Blog Zinnia 加密问题漏洞 — django-blog-zinnia 3.3 Low 2026-07-19
CVE-2026-55885 getgrav Grav 加密问题漏洞 — grav 6.8 Medium 2026-07-10
CVE-2026-50267 SteeltoeOSS Steeltoe.Configuration.Abstractions 加密问题漏洞 — Steeltoe.Configuration.Abstractions 4.7 Medium 2026-06-17
CVE-2026-46622 SolidInvoice 安全漏洞 — SolidInvoice 8.1 High 2026-06-11
CVE-2026-10786 Devolutions Server 安全漏洞 — Server - - 2026-06-08

CWE-312（敏感数据的明文存储） 是常见的弱点类别，本平台收录该类弱点关联的 311 条 CVE 漏洞。