目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-319 敏感数据的明文传输 类漏洞列表 379

CWE-319 敏感数据的明文传输 类弱点 379 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-319 指敏感信息在通信过程中以明文形式传输，易被网络嗅探。攻击者通常利用中间人攻击或公共 Wi-Fi 环境截获数据，窃取凭证或隐私。开发者应避免使用 HTTP 等未加密协议，强制实施 TLS/SSL 加密传输，并对关键数据进行端到端加密，确保即使数据被拦截也无法被解读，从而保障通信安全。

MITRE CWE 官方描述
CWE：CWE-319 敏感信息明文传输 英文：产品在通信通道中以明文形式传输敏感或安全关键数据，该通道可被未授权方嗅探。
常见影响 (2)
Integrity, ConfidentialityRead Application Data, Modify Files or Directories
Anyone can read the information by gaining access to the channel being used for communication. Many communication channels can be "sniffed" (monitored) by adversaries during data transmission. For example, in networking, packets can traverse many intermediary nodes from the source to the destination…
Integrity, ConfidentialityRead Application Data, Modify Files or Directories, Other
When full communications are recorded or logged, such as with a packet dump, an adversary could attempt to obtain the dump long after the transmission has occurred and try to "sniff" the cleartext from the recorded communications in the dump itself. Even if the information is encoded in a way that i…
缓解措施 (5)
Architecture and DesignBefore transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic protocols.
ImplementationWhen using web applications with SSL, use SSL for the entire session from login to logout, not just for the initial login page.
ImplementationWhen designing hardware platforms, ensure that approved encryption algorithms (such as those recommended by NIST) protect paths from security critical data to trusted user applications.
TestingUse tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
OperationConfigure servers to use encrypted channels for communication, which may include SSL or other secure protocols.
代码示例 (2)
The following code attempts to establish a connection to a site to communicate sensitive information.
try { URL u = new URL("http://www.secret.example.org/"); HttpURLConnection hu = (HttpURLConnection) u.openConnection(); hu.setRequestMethod("PUT"); hu.connect(); OutputStream os = hu.getOutputStream(); hu.disconnect(); } catch (IOException e) { //... }
Bad · Java
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these…
CVE ID标题CVSS风险等级Published
CVE-2026-3182 ZOHO Manageengine Endpoint Central 加密问题漏洞 — ManageEngine Endpoint Central 4.3 Medium2026-07-21
CVE-2026-48022 hapijs wreck 加密问题漏洞 — wreck 6.5 Medium2026-07-17
CVE-2026-34346 Microsoft Windows 加密问题漏洞 — Windows 10 Version 1607 5.5 Medium2026-07-14
CVE-2026-53624 Fiber 加密问题漏洞 — fiber 4.8 Medium2026-07-08
CVE-2025-12530 IBM watsonx.data intelligence 加密问题漏洞 — watsonx.data intelligence 5.9 Medium2026-06-30
CVE-2025-36336 IBM watsonx.data intelligence 加密问题漏洞 — watsonx.data intelligence 5.9 Medium2026-06-30
CVE-2026-55844 Home Assistant 加密问题漏洞 — core 7.5 High2026-06-29
CVE-2026-49486 Apache Airflow FTP 加密问题漏洞 — Apache Airflow FTP provider--2026-06-26
CVE-2026-44726 denoland deno 加密问题漏洞 — deno 7.4 High2026-06-23
CVE-2026-11833 Yokogawa Electric Corporation FAST/TOOLS 加密问题漏洞 — FAST/TOOLS--2026-06-23
CVE-2026-50034 Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT 加密问题漏洞 — Blood Glucose Monitoring System (Model No. APG-01 BT) 6.5 Medium2026-06-18
CVE-2026-9741 MongoDB Server 安全漏洞 — MongoDB Server 6.5 Medium2026-06-09
CVE-2026-45432 GX Group Earth 2022 ONT 安全漏洞 — GX Earth 2022--2026-06-04
CVE-2026-7666 Django 安全漏洞 — Django 3.1 Low2026-06-03
CVE-2023-52951 Synology Note Station Client 安全漏洞 — Synology Note Station Client 5.9 Medium2026-06-03
CVE-2026-10584 Graph Explorer 安全漏洞 — Graph Explorer 5.9 Medium2026-06-02
CVE-2026-43625 CodexBar 安全漏洞 — CodexBar 5.9 Medium2026-06-01
CVE-2026-34126 TP-Link多款产品 安全漏洞 — Tapo L535E v1.0, v3.0--2026-05-28
CVE-2024-47269 Synology Surveillance Station 安全漏洞 — Surveillance Station 4.9 Medium2026-05-27
CVE-2026-24212 NVIDIA Isaac Launchable 安全漏洞 — Isaac Launchable 7.5 High2026-05-26
CVE-2026-25608 CIOP-PIB STER 安全漏洞 — STER--2026-05-22
CVE-2025-62311 HCL AION 安全漏洞 — AION 4.3 Medium2026-05-14
CVE-2025-62310 HCL AION 安全漏洞 — AION 5.4 Medium2026-05-14
CVE-2026-41281 KDDI あんしんフィルター 安全漏洞 — あんしんフィルター for au--2026-05-13
CVE-2026-45180 Catalyst::Plugin::Statsd 安全漏洞 — Catalyst::Plugin::Statsd 7.5 -2026-05-10
CVE-2026-45179 Plack::Middleware::Statsd 安全漏洞 — Plack::Middleware::Statsd 5.3 -2026-05-10
CVE-2025-59852 HCL DFXAnalytics 安全漏洞 — DFXAnalytics 3.7 Low2026-05-06
CVE-2026-7610 TRENDnet TEW-821DAP 加密问题漏洞 — TEW-821DAP 3.7 Low2026-05-02
CVE-2026-42514 CDAC e-Sushrut 安全漏洞 — e-Sushrut, Hospital Management Information System (HMIS) 9.8AICriticalAI2026-04-29
CVE-2026-40431 SenseLive X3050 安全漏洞 — X3050 5.3 Medium2026-04-23

CWE-319（敏感数据的明文传输） 是常见的弱点类别，本平台收录该类弱点关联的 379 条 CVE 漏洞。