CWE-497 将系统数据暴露到未授权控制的范围 类弱点 379 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-497属于敏感信息泄露漏洞，指产品未能阻止未授权方访问底层系统信息。攻击者常利用网络通信中的错误响应或调试信息，获取操作系统、数据库配置等敏感细节，进而辅助后续攻击。开发者应严格限制错误信息的输出，确保仅返回必要的业务数据，并实施最小权限原则，防止敏感系统细节暴露给外部不可信实体。
char* path = getenv("PATH"); ... sprintf(stderr, "cannot find exe on path %s\n", path);//assume getCurrentUser() returns a username that is guaranteed to be alphanumeric (avoiding CWE-78) $userName = getCurrentUser(); $command = 'ps aux | grep ' . $userName; system($command);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-50528 | WordPress plugin Stacks Mobile App Builder 安全漏洞 — Stacks Mobile App Builder | 7.5 | High | 2024-11-04 |
| CVE-2024-50425 | WordPress plugin WP Booking System 安全漏洞 — WP Booking System | 6.5 | Medium | 2024-10-29 |
| CVE-2024-48024 | WordPress plugin Keep Backup Daily 安全漏洞 — Keep Backup Daily | 7.5 | High | 2024-10-17 |
| CVE-2024-49252 | WordPress plugin Leyka 安全漏洞 — Leyka | 5.3 | Medium | 2024-10-16 |
| CVE-2024-9470 | Palo Alto Networks Cortex XSOAR 安全漏洞 — Cortex XSOAR | 4.3AI | Medium AI | 2024-10-09 |
| CVE-2024-6389 | GitLab 安全漏洞 — GitLab | 4.3 | Medium | 2024-09-12 |
| CVE-2024-8687 | Palo Alto Networks PAN-OS 安全漏洞 — PAN-OS | 9.8AI | Critical AI | 2024-09-11 |
| CVE-2023-42010 | IBM Sterling B2B Integrator 安全漏洞 — Sterling B2B Integrator Standard Edition | 3.1 | Low | 2024-07-17 |
| CVE-2024-39740 | IBM Datacap Navigator 安全漏洞 — Datacap Navigator | 4.3 | Medium | 2024-07-15 |
| CVE-2024-39675 | Siemens 多款产品安全漏洞 — RUGGEDCOM RMC30 | 8.8 | High | 2024-07-09 |
| CVE-2024-31223 | Fides 安全漏洞 — fides | 5.3 | Medium | 2024-07-03 |
| CVE-2024-5735 | Joomla! Admiror Frames 安全漏洞 — AdmirorFrames | 5.3AI | Medium AI | 2024-06-28 |
| CVE-2024-6388 | Canonical Ubuntu Advantage Desktop Daemon 安全漏洞 — Ubuntu Advantage Desktop Pro | 5.9 | Medium | 2024-06-27 |
| CVE-2022-4968 | Netplan 安全漏洞 — Netplan | 6.5 | Medium | 2024-06-07 |
| CVE-2024-4008 | ABB KNX 信息泄露漏洞 — 2.4! Display 55, SD/U12.55.11-825 | 9.6 | Critical | 2024-06-05 |
| CVE-2023-50180 | Fortinet FortiADC 安全漏洞 — FortiADC | 5.2 | Medium | 2024-05-14 |
| CVE-2024-1809 | WordPress plugin Analytify 安全漏洞 — Analytify – Google Analytics Dashboard For WordPress (GA4 analytics tracking) | 5.4 | Medium | 2024-05-02 |
| CVE-2024-31887 | IBM Security Verify Privilege 安全漏洞 — Security Verify Privilege | 7.5 | High | 2024-04-16 |
| CVE-2023-4605 | Lenovo XClarity Administrator 安全漏洞 — XClarity Administrator | 6.5 | Medium | 2024-04-05 |
| CVE-2024-31419 | Red Hat OpenShift Virtualization 安全漏洞 | 4.3 | Medium | 2024-04-03 |
| CVE-2023-50959 | IBM Cloud Pak for Business Automation 安全漏洞 — Cloud Pak for Business Automation | 5.3 | Medium | 2024-03-31 |
| CVE-2024-25634 | alf.io 安全漏洞 — alf.io | 7.2 | High | 2024-02-19 |
| CVE-2023-5081 | Lenovo Tab M8 HD 信息泄露漏洞 — Tablet | 3.3 | Low | 2024-01-19 |
| CVE-2024-22125 | SAP GUI 安全漏洞 — Microsoft Edge browser extension (SAP GUI connector for Microsoft Edge) | 7.4 | High | 2024-01-09 |
| CVE-2024-22124 | SAP Web Dispatcher 安全漏洞 — SAP NetWeaver (Internet Communication Manager) | 4.1 | Medium | 2024-01-09 |
| CVE-2023-41366 | SAP NetWeaver Application Server 安全漏洞 — SAP NetWeaver Application Server ABAP and ABAP Platform | 5.3 | Medium | 2023-11-14 |
| CVE-2023-34209 | EasyUse MailHunter Ultimate 安全漏洞 — MailHunter Ultimate | 5.0 | Medium | 2023-10-17 |
| CVE-2023-4237 | Red Hat Ansible Automation 安全漏洞 — Red Hat Ansible Automation Platform 2.4 for RHEL 8 | 7.3 | High | 2023-10-04 |
| CVE-2023-20111 | Cisco Identity Services Engine 安全漏洞 — Cisco Identity Services Engine Software | 6.5 | Medium | 2023-08-16 |
| CVE-2023-37487 | SAP Business One 信息泄露漏洞 — SAP Business One (Service Layer) | 5.3 | Medium | 2023-08-08 |
CWE-497（将系统数据暴露到未授权控制的范围） 是常见的弱点类别，本平台收录该类弱点关联的 379 条 CVE 漏洞。