CWE-522 不充分的凭证保护机制 类弱点 523 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-522属于凭据保护不足漏洞，指产品在传输或存储认证凭据时使用了不安全的方法，易导致凭据被未授权方拦截或窃取。攻击者通常通过中间人攻击、网络嗅探或访问未加密的存储介质来获取敏感信息，进而冒充合法用户。开发者应避免使用明文传输，采用TLS等加密协议保护传输过程，并在存储时使用强哈希算法加盐处理，确保凭据机密性与完整性。
$user = $_GET['user']; $pass = $_GET['pass']; $checkpass = $_GET['checkpass']; if ($pass == $checkpass) { SetUserPassword($user, $pass); }... Properties prop = new Properties(); prop.load(new FileInputStream("config.properties")); String password = prop.getProperty("password"); DriverManager.getConnection(url, usr, password); ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-42933 | SAP Business One 安全漏洞 — SAP Business One (SLD) | 8.8 | High | 2025-09-09 |
| CVE-2025-41682 | Bender多款产品 安全漏洞 — CC612 | 8.8 | High | 2025-09-08 |
| CVE-2025-58366 | Onyxia 安全漏洞 — onyxia | 9.1AI | Critical AI | 2025-09-05 |
| CVE-2025-52549 | Copeland E3 Supervisory Control 安全漏洞 — E3 Supervisory Control | 9.8AI | Critical AI | 2025-09-02 |
| CVE-2025-52545 | Copeland E3 Supervisory Control 安全漏洞 — E3 Supervisory Control | 9.1AI | Critical AI | 2025-09-02 |
| CVE-2025-6519 | Copeland E3 Supervisory Control 安全漏洞 — E3 Supervisory Control | 9.8AI | Critical AI | 2025-09-02 |
| CVE-2025-55306 | GenX FX Trading System 安全漏洞 — GenX_FX | 9.8 | Critical | 2025-08-19 |
| CVE-2025-40751 | Siemens SIMATIC RTLS Locating Manager 安全漏洞 — SIMATIC RTLS Locating Manager | 6.3 | Medium | 2025-08-12 |
| CVE-2025-54882 | Himmelblau 安全漏洞 — himmelblau | 7.1 | High | 2025-08-07 |
| CVE-2025-54876 | Janssen 安全漏洞 — jans | 5.5AI | Medium AI | 2025-08-05 |
| CVE-2025-38739 | Dell Digital Delivery 安全漏洞 — Dell Digital Delivery | 7.2 | High | 2025-08-04 |
| CVE-2025-53008 | GLPI 安全漏洞 — glpi | 6.5 | Medium | 2025-07-30 |
| CVE-2025-5922 | TSplus Remote Access Admin Tool 安全漏洞 — TSplus Remote Access | 8.8AI | High AI | 2025-07-29 |
| CVE-2025-54428 | RevelaCode 安全漏洞 — RevelaCode-Backend | 9.8 | Critical | 2025-07-28 |
| CVE-2025-34139 | Sitecore多款产品 安全漏洞 — Experience Manager (XM) | 7.5 | - | 2025-07-25 |
| CVE-2025-6227 | Mattermost 安全漏洞 — Mattermost | 2.2 | Low | 2025-07-18 |
| CVE-2025-34078 | NSClient++ 安全漏洞 — NSClient++ | 7.8AI | High AI | 2025-07-02 |
| CVE-2025-6081 | Konica Minolta bizhub 227 Multifunction printers 安全漏洞 — bizhub 227 Multifunction printers | 6.8 | Medium | 2025-07-01 |
| CVE-2024-49364 | tiny-secp256k1 安全漏洞 — tiny-secp256k1 | 7.5AI | High AI | 2025-07-01 |
| CVE-2024-51984 | Brother Industries Multiple driver installers for Windows 安全漏洞 — HL-L8260CDN | 6.8 | Medium | 2025-06-25 |
| CVE-2025-6526 | 70mai M300 安全漏洞 — M300 | 3.1 | Low | 2025-06-23 |
| CVE-2025-30183 | CyberData 011209 Intercom 安全漏洞 — 011209 SIP Emergency Intercom | 7.5 | High | 2025-06-09 |
| CVE-2024-47081 | Requests 安全漏洞 — requests | 5.3 | Medium | 2025-06-09 |
| CVE-2025-3480 | MedDream WEB DICOM Viewer 安全漏洞 — WEB DICOM Viewer | 6.5AI | Medium AI | 2025-05-22 |
| CVE-2025-3079 | Canon ImageRunner 安全漏洞 — imageRUNNER Series | 8.7 | High | 2025-05-19 |
| CVE-2025-3078 | Canon ImageRunner 安全漏洞 — imageRUNNER ADVANCE Series | 8.7 | High | 2025-05-19 |
| CVE-2025-4679 | Synology Active Backup 安全漏洞 — Active Backup for Microsoft 365 | 6.5 | Medium | 2025-05-16 |
| CVE-2025-2772 | BEC Routers 安全漏洞 — Multiple Routers | 6.5 | - | 2025-04-23 |
| CVE-2025-32963 | MinIO Operator 安全漏洞 — operator | 9.9 | - | 2025-04-22 |
| CVE-2025-22372 | SicommNet BASEC 安全漏洞 — BASEC | 6.5AI | Medium AI | 2025-04-14 |
CWE-522（不充分的凭证保护机制） 是常见的弱点类别，本平台收录该类弱点关联的 523 条 CVE 漏洞。