目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-359 侵犯隐私 类漏洞列表 139

CWE-359 侵犯隐私 类弱点 139 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-359 指软件未能有效防止未授权主体访问个人私密信息，属于隐私泄露类漏洞。攻击者常利用身份验证缺陷、权限配置错误或接口逻辑漏洞，非法获取敏感数据。开发者应实施严格的访问控制策略，确保仅授权用户可访问数据，同时遵循最小权限原则，并对敏感信息进行加密存储与传输，从而杜绝非授权访问风险。

MITRE CWE 官方描述
CWE：CWE-359 向未授权主体暴露私人个人信息 英文：产品未能有效防止某人的私人、个人信息被以下主体访问：(1) 未明确获得访问该信息授权的人员；或 (2) 未获得信息所涉人员默示同意的人员。
常见影响 (1)
Confidentiality Read Application Data
缓解措施 (3)
Requirements Identify and consult all relevant regulations for personal privacy. An organization may be required to comply with certain federal and state regulations, depending on its location, the type of business it conducts, and the nature of any private data it handles. Regulations may include Safe Harbor Privacy Framework [REF-340], Gramm-Leach Bliley Act (GLBA) [REF-341], Health Insurance Portability a…
Architecture and Design Carefully evaluate how secure design may interfere with privacy, and vice versa. Security and privacy concerns often seem to compete with each other. From a security perspective, all important operations should be recorded so that any anomalous activity can later be identified. However, when private data is involved, this practice can in fact create risk. Although there are many ways in which pri…
Implementation, Operation Some tools can automatically analyze documents to redact, strip, or "sanitize" private information, although some human review might be necessary. Tools may vary in terms of which document formats can be processed. When calling an external program to automatically generate or convert documents, invoke the program with any available options that avoid generating sensitive metada…
代码示例 (2)
The following code contains a logging statement that tracks the contents of records added to a database by storing them in a log file. Among other values that are stored, the getPassword() function returns the user-supplied plaintext password associated with the account.
pass = GetPassword(); ... dbmsLog.WriteLine(id + ":" + pass + ":" + type + ":" + tstamp);
Bad · C#
This code uses location to determine the user's current US State location.
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
Bad · XML
locationClient = new LocationClient(this, this, this); locationClient.connect(); Location userCurrLocation; userCurrLocation = locationClient.getLastLocation(); deriveStateFromCoords(userCurrLocation);
Bad · Java
CVE ID 标题 CVSS 风险等级 Published
CVE-2022-0852 Red Hat Convert2RHEL 安全漏洞 — convert2rhel 5.5 - 2022-08-29
CVE-2022-2921 notrinoserp 安全漏洞 — notrinos/notrinoserp 9.8 - 2022-08-21
CVE-2022-35932 Nextcloud Talk 安全漏洞 — security-advisories 3.5 Low 2022-08-12
CVE-2021-46687 JFrog Artifactory 安全漏洞 — JFrog Artifactory 4.9 Medium 2022-07-06
CVE-2022-24890 Nextcloud Talk 信息泄露漏洞 — security-advisories 2.4 Low 2022-05-17
CVE-2022-1365 cross-fetch 安全漏洞 — lquixada/cross-fetch 7.5 - 2022-04-15
CVE-2022-24820 Xwiki Platform 访问控制错误漏洞 — xwiki-platform 5.3 Medium 2022-04-08
CVE-2022-24819 XWiki Platform 安全漏洞 — xwiki-platform 5.3 Medium 2022-04-08
CVE-2022-0482 Easy!Appointments 安全漏洞 — alextselegidis/easyappointments 7.5 - 2022-03-09
CVE-2022-24719 Fluture Node 输入验证错误漏洞 — fluture-node 2.6 Low 2022-03-01
CVE-2022-0155 Follow Redirects 安全漏洞 — follow-redirects/follow-redirects 6.5 - 2022-01-10
CVE-2021-36723 Amios Emuse - eServices/ eNvoice 信息泄露漏洞 — eServices / eNvoice 6.1 Medium 2021-12-29
CVE-2021-3980 elgg 安全漏洞 — elgg/elgg 7.5 - 2021-12-03
CVE-2021-28559 Adobe Acrobat 信息泄露漏洞 — Acrobat Reader 5.3 Medium 2021-09-02
CVE-2021-21823 komoot 信息泄露漏洞 — Komoot 7.5 - 2021-08-20
CVE-2021-22876 Haxx libcurl 信息泄露漏洞 — https://github.com/curl/curl 7.5 - 2021-04-01
CVE-2020-1688 Juniper Networks Junos OS SRX和Junos OS NFX 安全漏洞 — Junos OS 6.5 Medium 2020-10-16
CVE-2019-15623 Nextcloud 信息泄露漏洞 — Nextcloud Server 5.3 - 2020-02-04
CVE-2017-16769 Synology Photo Station Photo Viewer 信息泄露漏洞 — Synology Photo Station 5.3 - 2018-02-23

CWE-359（侵犯隐私） 是常见的弱点类别，本平台收录该类弱点关联的 139 条 CVE 漏洞。