目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-359 侵犯隐私 类漏洞列表 147

CWE-359 侵犯隐私 类弱点 147 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-359 指软件未能有效防止未授权主体访问个人私密信息，属于隐私泄露类漏洞。攻击者常利用身份验证缺陷、权限配置错误或接口逻辑漏洞，非法获取敏感数据。开发者应实施严格的访问控制策略，确保仅授权用户可访问数据，同时遵循最小权限原则，并对敏感信息进行加密存储与传输，从而杜绝非授权访问风险。

MITRE CWE 官方描述
CWE：CWE-359 向未授权主体暴露私人个人信息 英文：产品未能有效防止某人的私人、个人信息被以下主体访问：(1) 未明确获得访问该信息授权的人员；或 (2) 未获得信息所涉人员默示同意的人员。
常见影响 (1)
Confidentiality Read Application Data
缓解措施 (3)
Requirements Identify and consult all relevant regulations for personal privacy. An organization may be required to comply with certain federal and state regulations, depending on its location, the type of business it conducts, and the nature of any private data it handles. Regulations may include Safe Harbor Privacy Framework [REF-340], Gramm-Leach Bliley Act (GLBA) [REF-341], Health Insurance Portability a…
Architecture and Design Carefully evaluate how secure design may interfere with privacy, and vice versa. Security and privacy concerns often seem to compete with each other. From a security perspective, all important operations should be recorded so that any anomalous activity can later be identified. However, when private data is involved, this practice can in fact create risk. Although there are many ways in which pri…
Implementation, Operation Some tools can automatically analyze documents to redact, strip, or "sanitize" private information, although some human review might be necessary. Tools may vary in terms of which document formats can be processed. When calling an external program to automatically generate or convert documents, invoke the program with any available options that avoid generating sensitive metada…
代码示例 (2)
The following code contains a logging statement that tracks the contents of records added to a database by storing them in a log file. Among other values that are stored, the getPassword() function returns the user-supplied plaintext password associated with the account.
pass = GetPassword(); ... dbmsLog.WriteLine(id + ":" + pass + ":" + type + ":" + tstamp);
Bad · C#
This code uses location to determine the user's current US State location.
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
Bad · XML
locationClient = new LocationClient(this, this, this); locationClient.connect(); Location userCurrLocation; userCurrLocation = locationClient.getLastLocation(); deriveStateFromCoords(userCurrLocation);
Bad · Java
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-102579 Moodle 成绩Web服务用户信息泄露漏洞 4.3 Medium 2026-09-30
CVE-2026-39372 InvoicePlane 附件EXIF元数据敏感信息泄露漏洞 — InvoicePlane 4.9 Medium 2026-09-25
CVE-2026-92565 Rallly 4.15.0 前信息泄露漏洞 — rallly 5.3 Medium 2026-09-16
CVE-2026-76855 Netcore NR255-V 信息泄露漏洞 — NR255-V 6.5 Medium 2026-09-15
CVE-2026-88875 WWBN AVideo 信息泄露漏洞 — AVideo 4.3 Medium 2026-09-10
CVE-2026-73008 Microsoft Windows Biometric Service 信息泄露漏洞 — Windows 10 Version 1607 5.5 Medium 2026-09-08
CVE-2026-69351 Microsoft Windows Universal Plug 信息泄露漏洞 — Windows 10 Version 1607 5.5 Medium 2026-09-08
CVE-2026-21827 HCL Connections 信息泄露漏洞 — Connections 3.1 Low 2026-08-31
CVE-2026-48048 XWiki Platform 信息泄露漏洞 — xwiki-platform 7.5 High 2026-08-10
CVE-2026-24078 Qualcomm Chipsets 信息泄露漏洞 — Snapdragon 6.5 Medium 2026-08-04
CVE-2026-56171 Microsoft Remote Desktop Web Client 信息泄露漏洞 — Remote Desktop Web Client 7.1 High 2026-07-17
CVE-2026-50657 Microsoft Defender for Endpoint 信息泄露漏洞 — Microsoft Defender for Endpoint for Mac 4.7 Medium 2026-07-14
CVE-2026-58297 Microsoft Edge 信息泄露漏洞 — Microsoft Edge (Chromium-based) 7.1 High 2026-07-03
CVE-2026-58296 Microsoft Edge 信息泄露漏洞 — Microsoft Edge (Chromium-based) 7.1 High 2026-07-03
CVE-2026-57960 Hi.Events 日志信息泄露漏洞 — Hi.Events 6.5 Medium 2026-06-29
CVE-2026-56124 shimosyan phpUploader 日志信息泄露漏洞 — phpUploader 7.5 High 2026-06-29
CVE-2026-48615 nodejs node.js 信息泄露漏洞 — node - - 2026-06-26
CVE-2026-49344 Sourcentis Mercator 信息泄露漏洞 — mercator - - 2026-06-19
CVE-2019-25762 joomboost JoomProject 信息泄露漏洞 — JoomProject 7.5 High 2026-06-19
CVE-2026-25699 Apache Answer 安全漏洞 — Apache Answer - - 2026-06-09
CVE-2020-25900 HelloTalk 安全漏洞 — HelloTalk 5.3 Medium 2026-06-05
CVE-2025-13477 Digital Operation Services WiFiBurada 安全漏洞 — WifiBurada 7.1 High 2026-05-21
CVE-2025-66172 Apache CloudStack 安全漏洞 — Apache CloudStack 6.5AI Medium AI 2026-05-08
CVE-2025-66171 Apache CloudStack 安全漏洞 — Apache CloudStack 6.5AI Medium AI 2026-05-08
CVE-2025-15623 Sparx Systems Sparx Pro Cloud Server 安全漏洞 — Sparx Pro Cloud Server 7.5AI High AI 2026-04-17
CVE-2026-3911 Keycloak 安全漏洞 — Red Hat build of Keycloak 26.4 2.7 Low 2026-03-11
CVE-2026-0102 Microsoft Edge 安全漏洞 — Microsoft Edge (Chromium-based) 3.1 Low 2026-02-17
CVE-2020-37173 WWBN AVideo 安全漏洞 — AVideo Platform 7.5 High 2026-02-11
CVE-2026-24321 SAP Commerce Cloud 安全漏洞 — SAP Commerce Cloud 5.3 Medium 2026-02-10
CVE-2025-66605 Yokogawa FAST/TOOLS 安全漏洞 — FAST/TOOLS 6.1AI Medium AI 2026-02-09

CWE-359（侵犯隐私） 是常见的弱点类别，本平台收录该类弱点关联的 147 条 CVE 漏洞。