CWE-522 不充分的凭证保护机制 类弱点 428 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-522属于凭据保护不足漏洞，指产品在传输或存储认证凭据时使用了不安全的方法，易导致凭据被未授权方拦截或窃取。攻击者通常通过中间人攻击、网络嗅探或访问未加密的存储介质来获取敏感信息，进而冒充合法用户。开发者应避免使用明文传输，采用TLS等加密协议保护传输过程，并在存储时使用强哈希算法加盐处理，确保凭据机密性与完整性。
$user = $_GET['user']; $pass = $_GET['pass']; $checkpass = $_GET['checkpass']; if ($pass == $checkpass) { SetUserPassword($user, $pass); }... Properties prop = new Properties(); prop.load(new FileInputStream("config.properties")); String password = prop.getProperty("password"); DriverManager.getConnection(url, usr, password); ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-49396 | Elvaco M-Bus Metering Gateway CMe3100 安全漏洞 — M-Bus Metering Gateway CMe3100 | 5.3AI | MediumAI | 2024-10-17 |
| CVE-2024-47161 | JetBrains TeamCity 安全漏洞 — TeamCity | 4.3 | Medium | 2024-10-08 |
| CVE-2024-40703 | IBM Cognos Analytics 安全漏洞 — Cognos Analytics | 5.5 | Medium | 2024-09-22 |
| CVE-2024-47162 | JetBrains YouTrack 安全漏洞 — YouTrack | 4.1 | Medium | 2024-09-19 |
| CVE-2024-8986 | Grafana 安全漏洞 — Grafana Plugin SDK | 9.1AI | CriticalAI | 2024-09-19 |
| CVE-2024-28981 | Hitachi Vantara Pentaho Data Integration & Analytics 安全漏洞 — Pentaho Data Integration & Analytics | 8.5 | High | 2024-09-11 |
| CVE-2024-39278 | Hughes WL3000 Fusion Software 安全漏洞 — WL3000 Fusion Software | 4.2 | Medium | 2024-09-05 |
| CVE-2024-40704 | IBM InfoSphere Information Server 安全漏洞 — InfoSphere Information Server | 4.9 | Medium | 2024-08-15 |
| CVE-2024-7813 | Prison Management System 安全漏洞 — Prison Management System | 5.3 | Medium | 2024-08-15 |
| CVE-2024-39818 | Zoom Meeting SDK和Zoom Workplace 安全漏洞 — Zoom Workplace Apps and SDKs | 7.5 | High | 2024-08-14 |
| CVE-2024-7389 | WordPress plugin Forminator 安全漏洞 — Forminator Forms – Contact Form, Payment Form & Custom Form Builder | 7.5 | High | 2024-08-02 |
| CVE-2023-41926 | Kiloview P1 4G Video Encoder和P2 4G Video Encoder 安全漏洞 — P1/P2 | 8.8 | High | 2024-07-02 |
| CVE-2024-39879 | JetBrains TeamCity 安全漏洞 — TeamCity | 5.0 | Medium | 2024-07-01 |
| CVE-2024-39878 | JetBrains TeamCity 安全漏洞 — TeamCity | 4.1 | Medium | 2024-07-01 |
| CVE-2024-38505 | JetBrains YouTrack 安全漏洞 — YouTrack | 5.3 | Medium | 2024-06-18 |
| CVE-2024-30119 | HCL Technologies DRYiCE Optibot Reset Station 安全漏洞 — DRYiCE Optibot Reset Station | 3.7 | Low | 2024-06-14 |
| CVE-2024-38285 | Motorola Solutions Vigilant Fixed LPR Coms Box 安全漏洞 — Vigilant Fixed LPR Coms Box (BCAV1F2-C600) | 6.5AI | MediumAI | 2024-06-13 |
| CVE-2024-38282 | Motorola Solutions Vigilant Fixed LPR Coms Box 安全漏洞 — Vigilant Fixed LPR Coms Box (BCAV1F2-C600) | 6.8AI | MediumAI | 2024-06-13 |
| CVE-2024-35208 | Siemens SINEC Traffic Analyzer 安全漏洞 — SINEC Traffic Analyzer | 6.3 | Medium | 2024-06-11 |
| CVE-2024-37051 | JetBrains 多款集成开发环境安全漏洞 — IntelliJ IDEA | 9.3 | Critical | 2024-06-10 |
| CVE-2024-36127 | apko 安全漏洞 — apko | 7.5 | High | 2024-06-03 |
| CVE-2024-5176 | Baxter Welch Allyn Configuration Tool 安全漏洞 — Welch Allyn Configuration Tool | 8.8 | - | 2024-05-31 |
| CVE-2024-35192 | Aqua Security Trivy 安全漏洞 — trivy | 5.5 | Medium | 2024-05-20 |
| CVE-2024-23583 | HCL BigFix Platform 安全漏洞 — BigFix Platform | 6.7 | Medium | 2024-05-17 |
| CVE-2024-27109 | General Electric Healthcare Imaging 安全漏洞 — EchoPAC Software Only | 7.6 | High | 2024-05-14 |
| CVE-2024-33497 | Siemens 多款产品 安全漏洞 — SIMATIC RTLS Locating Manager | 6.3 | Medium | 2024-05-14 |
| CVE-2024-33496 | Siemens 多款产品 安全漏洞 — SIMATIC RTLS Locating Manager | 6.3 | Medium | 2024-05-14 |
| CVE-2024-22345 | IBM TXSeries for Multiplatforms 安全漏洞 — TXSeries for Multiplatforms | 6.2 | Medium | 2024-05-10 |
| CVE-2024-23551 | HCL BigFix Compliance 安全漏洞 — BigFix Compliance | 6.5 | Medium | 2024-05-07 |
| CVE-2023-37400 | IBM Aspera 安全漏洞 — Aspera Faspex | 7.8 | High | 2024-04-19 |
CWE-522（不充分的凭证保护机制） 是常见的弱点类别，本平台收录该类弱点关联的 428 条 CVE 漏洞。