CWE-749 暴露危险的方法或函数 类弱点 170 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-749指危险方法或函数暴露，属于接口访问控制缺陷。当API包含未受限制的危险功能时，攻击者可利用该接口直接调用敏感操作，从而引发权限提升、数据泄露或系统破坏等严重后果。开发者应避免将高危功能暴露给外部，通过实施严格的身份验证、细粒度权限管理及最小权限原则，确保仅授权用户能访问特定方法，从而有效缓解此类风险。
public void removeDatabase(String databaseName) { try { Statement stmt = conn.createStatement(); stmt.execute("DROP DATABASE " + databaseName); } catch (SQLException ex) {...} }private void removeDatabase(String databaseName) { try { Statement stmt = conn.createStatement(); stmt.execute("DROP DATABASE " + databaseName); } catch (SQLException ex) {...} }// Android @Override public boolean shouldOverrideUrlLoading(WebView view, String url){ if (url.substring(0,14).equalsIgnoreCase("examplescheme:")){ if(url.substring(14,25).equalsIgnoreCase("getUserInfo")){ writeDataToView(view, UserData); return false; } else{ return true; } } }// iOS -(BOOL) webView:(UIWebView *)exWebView shouldStartLoadWithRequest:(NSURLRequest *)exRequest navigationType:(UIWebViewNavigationType)exNavigationType { NSURL *URL = [exRequest URL]; if ([[URL scheme] isEqualToString:@"exampleScheme"]) { NSString *functionString = [URL resourceSpecifier]; if ([functionString hasPrefix:@"specialFunction"]) { // Make data available back in webview. UIWebView *webView = [self writeDataToView:[URL query]]; } return NO; } return YES; }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2020-12927 | AMD VBIOS Flash Tool SDK 安全漏洞 — AMD VBIOS Flash Tool SDK | 7.8 | - | 2020-11-12 |
| CVE-2020-12912 | AMD Linux hwmon 安全漏洞 — AMD extension to Linux "hwmon" for Zen1 platforms | 6.5 | - | 2020-11-12 |
| CVE-2020-27123 | Cisco AnyConnect Secure Mobility Client for Windows 安全漏洞 — Cisco AnyConnect Secure Mobility Client | 5.5 | Medium | 2020-11-06 |
| CVE-2020-12928 | AMD Ryzen 安全特征问题漏洞 — AMD Ryzen Master | 7.8 | - | 2020-10-13 |
| CVE-2020-3416 | Cisco ASR 900 Series Aggregation Services Routers 代码注入漏洞 — Cisco IOS XE Software | 6.7 | Medium | 2020-09-24 |
| CVE-2020-3513 | Cisco IOS XE Software 和 Cisco ASR 900 代码注入漏洞 — Cisco IOS XE Software | 6.7 | Medium | 2020-09-24 |
| CVE-2020-17388 | Marvell QConvergeConsole 安全漏洞 — QConvergeConsole | 8.8 | - | 2020-08-25 |
| CVE-2020-17391 | Corel Parallels Desktop 安全漏洞 — Desktop | 6.5 | - | 2020-08-25 |
| CVE-2020-8212 | Citrix Systems XenMobile Server 安全漏洞 — Citrix XenMobile Server | 9.8 | - | 2020-08-17 |
| CVE-2020-15623 | CentOS Web Panel 安全漏洞 — CentOS Web Panel | 9.8 | - | 2020-07-28 |
| CVE-2020-10268 | KUKA controller KR C4 安全漏洞 — KR3R540, KRC4, KSS8.5.7HF1, Win7_Embedded | 4.6 | - | 2020-06-16 |
| CVE-2019-18342 | Siemens SiNVR 3 Central Control Server和SiNVR 3 Video Server 安全漏洞 — Control Center Server (CCS) | 9.9 | Critical | 2019-12-12 |
| CVE-2019-13945 | Siemens SIMATIC S7-200和S7-1200 输入验证错误漏洞 — SIMATIC S7-1200 CPU family (incl. SIPLUS variants) | 6.1 | - | 2019-12-12 |
| CVE-2019-10918 | 西门子 SIMATIC WinCC 安全漏洞 — SIMATIC PCS 7 V8.0 and earlier | 8.8 | - | 2019-05-14 |
| CVE-2019-5015 | Pixar Renderman 代码问题漏洞 — Pixar Renderman | 7.8 | - | 2019-03-08 |
| CVE-2018-10931 | Cobbler 资料不足漏洞 — cobbler | 9.8 | - | 2018-08-09 |
| CVE-2018-8868 | Medtronic MyCareLink Patient Monitor、24950 MyCareLink Monitor和24952 MyCareLink Monitor 安全漏洞 — 24950 MyCareLink Monitor | 6.2 | Medium | 2018-07-02 |
| CVE-2016-9469 | GitLab 安全漏洞 — GitLab Community Edition & GitLab Enterprise Edition 8.13.0, 8.13.0-ee, 8.13.1, 8.13.1-ee, 8.13.2, 8.13.2-ee, 8.13.3, 8.13.3-ee, 8.13.4, 8.13.4-ee, 8.13.5, 8.13.5-ee, 8.13.6, 8.13.6-ee, 8.13.7, 8.14.0, 8.14.0-ee, 8.14.1 | 8.2 | - | 2017-03-28 |
| CVE-2014-5415 | Beckhoff Embedded PC图像和Automation Device Specification TwinCAT组件安全漏洞 — Embedded PC Images | 9.1 | Critical | 2016-10-05 |
| CVE-2014-0758 | ICONICS GENESIS32 ActiveX控件输入验证漏洞 — GENESIS32 | 7.8 | - | 2014-02-24 |
CWE-749（暴露危险的方法或函数） 是常见的弱点类别，本平台收录该类弱点关联的 170 条 CVE 漏洞。