目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1310 元

100%
请我们喝杯咖啡

CWE-319 敏感数据的明文传输 类漏洞列表 365

CWE-319 敏感数据的明文传输 类弱点 365 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-319 指敏感信息在通信过程中以明文形式传输，易被网络嗅探。攻击者通常利用中间人攻击或公共 Wi-Fi 环境截获数据，窃取凭证或隐私。开发者应避免使用 HTTP 等未加密协议，强制实施 TLS/SSL 加密传输，并对关键数据进行端到端加密，确保即使数据被拦截也无法被解读，从而保障通信安全。

MITRE CWE 官方描述
CWE：CWE-319 敏感信息明文传输 英文：产品在通信通道中以明文形式传输敏感或安全关键数据，该通道可被未授权方嗅探。
常见影响 (2)
Integrity, ConfidentialityRead Application Data, Modify Files or Directories
Anyone can read the information by gaining access to the channel being used for communication. Many communication channels can be "sniffed" (monitored) by adversaries during data transmission. For example, in networking, packets can traverse many intermediary nodes from the source to the destination…
Integrity, ConfidentialityRead Application Data, Modify Files or Directories, Other
When full communications are recorded or logged, such as with a packet dump, an adversary could attempt to obtain the dump long after the transmission has occurred and try to "sniff" the cleartext from the recorded communications in the dump itself. Even if the information is encoded in a way that i…
缓解措施 (5)
Architecture and DesignBefore transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic protocols.
ImplementationWhen using web applications with SSL, use SSL for the entire session from login to logout, not just for the initial login page.
ImplementationWhen designing hardware platforms, ensure that approved encryption algorithms (such as those recommended by NIST) protect paths from security critical data to trusted user applications.
TestingUse tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
OperationConfigure servers to use encrypted channels for communication, which may include SSL or other secure protocols.
代码示例 (2)
The following code attempts to establish a connection to a site to communicate sensitive information.
try { URL u = new URL("http://www.secret.example.org/"); HttpURLConnection hu = (HttpURLConnection) u.openConnection(); hu.setRequestMethod("PUT"); hu.connect(); OutputStream os = hu.getOutputStream(); hu.disconnect(); } catch (IOException e) { //... }
Bad · Java
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these…
CVE ID标题CVSS风险等级Published
CVE-2025-32793 Cilium 安全漏洞 — cilium 4.0 Medium2025-04-21
CVE-2025-43013 JetBrains Toolbox App 安全漏洞 — Toolbox App 6.9 Medium2025-04-17
CVE-2025-43704 Veritas Data Insight 安全漏洞 — Data Insight 4.7 Medium2025-04-16
CVE-2025-27722 Inaba Denki Sangyo Wi-Fi AP UNIT 安全漏洞 — AC-WPS-11ac 5.9 Medium2025-04-09
CVE-2025-26654 SAP Commerce Cloud 安全漏洞 — SAP Commerce Cloud (Public Cloud) 6.8 Medium2025-04-08
CVE-2025-3329 Consumer Comanda Mobile 安全漏洞 — Comanda Mobile 3.1 Low2025-04-07
CVE-2025-2861 Arteche saTECH BCU 安全漏洞 — saTECH BCU 9.8 -2025-03-28
CVE-2024-45361 Xiaomi Mi Connect Service APP 安全漏洞 — Xiaomi Mi Connect Service 6.5 Medium2025-03-27
CVE-2025-27594 SICK DL100-2xxxxxxx 安全漏洞 — SICK DL100-2xxxxxxx 7.5 High2025-03-14
CVE-2024-13872 Bitdefender BOX 安全漏洞 — BOX v1 7.5 -2025-03-12
CVE-2025-22493 Eaton Foreseer Reporting Software 安全漏洞 — Foreseer Reporting Software (FRS) 5.6 Medium2025-03-05
CVE-2025-24849 Dario Health 安全漏洞 — USB-C Blood Glucose Monitoring System Starter Kit Android Applications 7.1 High2025-02-28
CVE-2024-5462 Broadcom Fabric OS 安全漏洞 — Brocade Fabric OS 7.5 -2025-02-14
CVE-2025-1060 Schneider Electric ASCO 5310和ASCO 5350 安全漏洞 — ASCO 5310 Single-Channel Remote Annunciator 7.5 High2025-02-13
CVE-2025-0556 Progress Telerik Report Server 安全漏洞 — Telerik Report Server 8.8 High2025-02-12
CVE-2024-43187 IBM Security Verify Access 安全漏洞 — Security Verify Access Appliance 5.9 Medium2025-02-04
CVE-2023-35017 IBM Security Verify Governance 安全漏洞 — Security Verify Governance 5.9 Medium2025-01-29
CVE-2025-0784 Intelbras InControl 安全漏洞 — InControl 3.7 Low2025-01-28
CVE-2025-0631 Rockwell Automation PowerFlex 755 安全漏洞 — PowerFlex 755 7.5 -2025-01-28
CVE-2025-0432 HMS EWON FLEXY 202 安全漏洞 — Ewon Flexy 202 5.7 Medium2025-01-28
CVE-2024-28786 IBM QRadar SIEM 安全漏洞 — QRadar SIEM 6.5 Medium2025-01-27
CVE-2024-41757 IBM Concert 安全漏洞 — Concert Software 5.9 Medium2025-01-24
CVE-2024-26155 ETIC Telecom Remote Access Server 安全漏洞 — Remote Access Server (RAS) 6.8 Medium2025-01-17
CVE-2024-45102 Lenovo XClarity Administrator 安全漏洞 — XClarity Administrator 6.8 Medium2025-01-14
CVE-2024-42181 HCL DRYiCE MyXalytics 安全漏洞 — DRYiCE MyXalytics 1.6 Low2025-01-12
CVE-2024-11946 iXsystems TrueNAS CORE 安全漏洞 — TrueNAS CORE 8.1 -2024-12-30
CVE-2021-39081 IBM Cognos Analytics Mobile 安全漏洞 — Cognos Analytics Mobile for Android 5.9 Medium2024-12-19
CVE-2024-10973 Red Hat Keycloak 安全漏洞 5.7 Medium2024-12-17
CVE-2024-49820 IBM Security Guardium Key Lifecycle Manager 安全漏洞 — Security Guardium Key Lifecycle Manager 3.7 Low2024-12-17
CVE-2024-49819 IBM Security Guardium Key Lifecycle Manager 安全漏洞 — Security Guardium Key Lifecycle Manager 4.1 Medium2024-12-17

CWE-319（敏感数据的明文传输） 是常见的弱点类别，本平台收录该类弱点关联的 365 条 CVE 漏洞。