目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-319 敏感数据的明文传输 类漏洞列表 453

CWE-319 敏感数据的明文传输 类弱点 453 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-319 指敏感信息在通信过程中以明文形式传输，易被网络嗅探。攻击者通常利用中间人攻击或公共 Wi-Fi 环境截获数据，窃取凭证或隐私。开发者应避免使用 HTTP 等未加密协议，强制实施 TLS/SSL 加密传输，并对关键数据进行端到端加密，确保即使数据被拦截也无法被解读，从而保障通信安全。

MITRE CWE 官方描述
CWE：CWE-319 敏感信息明文传输 英文：产品在通信通道中以明文形式传输敏感或安全关键数据，该通道可被未授权方嗅探。
常见影响 (2)
Integrity, Confidentiality Read Application Data, Modify Files or Directories
Anyone can read the information by gaining access to the channel being used for communication. Many communication channels can be "sniffed" (monitored) by adversaries during data transmission. For example, in networking, packets can traverse many intermediary nodes from the source to the destination…
Integrity, Confidentiality Read Application Data, Modify Files or Directories, Other
When full communications are recorded or logged, such as with a packet dump, an adversary could attempt to obtain the dump long after the transmission has occurred and try to "sniff" the cleartext from the recorded communications in the dump itself. Even if the information is encoded in a way that i…
缓解措施 (5)
Architecture and Design Before transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic protocols.
Implementation When using web applications with SSL, use SSL for the entire session from login to logout, not just for the initial login page.
Implementation When designing hardware platforms, ensure that approved encryption algorithms (such as those recommended by NIST) protect paths from security critical data to trusted user applications.
Testing Use tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
Operation Configure servers to use encrypted channels for communication, which may include SSL or other secure protocols.
代码示例 (2)
The following code attempts to establish a connection to a site to communicate sensitive information.
try { URL u = new URL("http://www.secret.example.org/"); HttpURLConnection hu = (HttpURLConnection) u.openConnection(); hu.setRequestMethod("PUT"); hu.connect(); OutputStream os = hu.getOutputStream(); hu.disconnect(); } catch (IOException e) { //... }
Bad · Java
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these…
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-24060 Automated Logic WebCtrl 安全漏洞 — WebCTRL Premium Server 9.1 Critical 2026-03-20
CVE-2026-32309 Cryptomator 安全漏洞 — cryptomator 9.1 - 2026-03-20
CVE-2026-32838 Edimax GS-5008PL 安全漏洞 — Edimax GS-5008PL 7.5 High 2026-03-17
CVE-2025-13718 IBM Sterling Partner Engagement Manager 安全漏洞 — Sterling Partner Engagement Manager 3.7 Low 2026-03-13
CVE-2026-23661 Microsoft Azure IoT Explorer 安全漏洞 — Azure IoT Explorer 7.5 High 2026-03-10
CVE-2026-2671 Mendi Neurofeedback Headset 安全漏洞 — Neurofeedback Headset 3.1 Low 2026-03-07
CVE-2026-30795 RustDesk 安全漏洞 — RustDesk Client 7.5 - 2026-03-05
CVE-2026-20801 Gallagher NxWitness VMS 安全漏洞 — NxWitness VMS and Hanwha VMS Integrations 5.6 Medium 2026-03-03
CVE-2026-27752 SODOLA SL902-SWTGW124AS 安全漏洞 — SODOLA SL902-SWTGW124AS 5.9 Medium 2026-02-27
CVE-2026-24455 Jinan USR IOT USR-W610 安全漏洞 — USR-W610 7.5 High 2026-02-20
CVE-2025-27903 IBM DB2 Recovery Expert 安全漏洞 — DB2 Recovery Expert for LUW 5.9 Medium 2026-02-17
CVE-2026-2539 Micca KE700 安全漏洞 — Car Alarm System KE700 6.5AI Medium AI 2026-02-15
CVE-2025-10174 PanCafe Pro 安全漏洞 — PanCafe Pro 8.3 High 2026-02-11
CVE-2025-66604 Yokogawa FAST/TOOLS 安全漏洞 — FAST/TOOLS 5.3AI Medium AI 2026-02-09
CVE-2026-0714 Moxa Industrial Linux 安全漏洞 — UC-1200A Series 4.2AI Medium AI 2026-02-05
CVE-2026-24441 Tenda AC7 安全漏洞 — Tenda AC7 9.1AI Critical AI 2026-02-03
CVE-2026-1777 Amazon SageMaker Python SDK 安全漏洞 — SageMaker Python SDK 7.2 High 2026-02-02
CVE-2026-23564 TeamViewer DEX Client 安全漏洞 — DEX 6.5 Medium 2026-01-29
CVE-2026-22274 Dell ECS 安全漏洞 — ObjectScale 6.5 Medium 2026-01-23
CVE-2026-22271 Dell ECS 安全漏洞 — ObjectScale 7.5 High 2026-01-23
CVE-2025-64769 AVEVA Process Optimization 安全漏洞 — Process Optimization 7.1 High 2026-01-16
CVE-2025-13454 Lenovo多款产品 安全漏洞 — ThinkPlus FU100 5.5 Medium 2026-01-14
CVE-2025-69272 Broadcom DX NetOps Spectrum 安全漏洞 — DX NetOps Spectrum 5.9AI Medium AI 2026-01-12
CVE-2026-22080 Tenda N300和Tenda F3 安全漏洞 — 300Mbps Wireless Router F3 and N300 Easy Setup Router 7.5 - 2026-01-09
CVE-2026-22079 Tenda N300和Tenda F3 安全漏洞 — 300Mbps Wireless Router F3 and N300 Easy Setup Router 8.1 - 2026-01-09
CVE-2019-25278 iWT FaceSentry Access Control System 安全漏洞 — FaceSentry Access Control System 5.9 Medium 2026-01-07
CVE-2026-22544 Efacec QC 安全漏洞 — QC 60/90/120 7.5 - 2026-01-07
CVE-2020-36917 Phoenix Contact iDS6 DSSPro 安全漏洞 — iDS6 DSSPro Digital Signage System 7.5 High 2026-01-06
CVE-2020-36914 QiHang Media Web Digital Signage 安全漏洞 — QiHang Media Web (QH.aspx) Digital Signage 7.5 High 2026-01-06
CVE-2025-62578 Delta Electronics DVP-12SE 安全漏洞 — DVP-12SE 7.5 - 2025-12-26

CWE-319（敏感数据的明文传输） 是常见的弱点类别，本平台收录该类弱点关联的 453 条 CVE 漏洞。