CWE-311: Missing Encryption of Sensitive Data
The product does not encrypt sensitive or critical information before storage or transmission.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- netsas enigma network management solutionNETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data stored within the SQL database...6.5 Medium
- comba ap2600-i - a02 - 0202n00pd2 firmwareComba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure...7.5 High
- onap open network automation platformAn issue was detected in ONAP Portal through Dublin. By executing a padding oracle attack using...7.5 High
- wftpserver wing ftp serverAn issue was discovered in Wing FTP Server 6.2.5 before February 2020. Due to insecure...7.8 High
- ibm cloud automation managerIBM Cloud Automation Manager 3.2.1.0 does not set the secure attribute on authorization tokens or...4.3 Medium
- adbglobal p.dga4001n firmwareThe ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6...5.3 Medium
- dten d5 firmware, d7 firmware +1 moreDTEN D5 before 1.3 and D7 before 1.3 devices transfer customer data files via unencrypted HTTP.7.5 High
- openstack horizon, python-django-horizon, redhat openstack +2 more +4 moreThe file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0 and RHOS...5.5 Medium
- mfscripts yetishareMFScripts YetiShare 3.5.2 through 4.5.3 does not set the Secure flag on session cookies, allowing...7.5 High
- zte zxcloud goldendata vapAll versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have encryption problems...9.8 Critical
- barco clickshare button r9861500d01 firmwareBarco ClickShare Button R9861500D01 devices before 1.9.0 allow Information exposure (issue 2 of 2...5.9 Medium
- wolfsslwolfSSL and wolfCrypt 4.1.0 and earlier (formerly known as CyaSSL) generate biased DSA nonces....5.3 Medium
- google androidIn Blob::Blob of blob.cpp, there is a possible unencrypted master key due to improper input...4.4 Medium
- weidmueller ie-sw-pl08m-6tx-2sc firmware, ie-sw-pl08m-6tx-2scs firmware, ie-sw-pl08m-6tx-2st firmware +37 more +39 moreAn issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build...9.8 Critical
- huami mi fitThe Anhui Huami Mi Fit application before 4.0.11 for Android has an Unencrypted Update Check.5.3 Medium
- cbc gemThe CBC Gem application before 9.24.1 for Android and before 9.26.0 for iOS has Unencrypted...5.3 Medium
- evolution-data-server3evolution-data-server3 3.0.3 through 3.2.1 used insecure (non-SSL) connection when attempting to...7.3 High
- ibm smartcloud analytics, smartcloud analytics log analysis +1 moreIBM SmartCloud Analytics 1.3.1 through 1.3.5 does not set the secure attribute on authorization...3.7 Low
- fortinet forticlient, forticlient for mac os +1 moreA clear text storage of sensitive information vulnerability in FortiClient for Mac may allow a...5.5 Medium
- philips taolight smart wi-fi wiz connected led bulb 9290022656 firmwareOn Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected...7.5 High
- rails, debian linux +1 moreThe encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks.6.5 Medium
- mailscannerThe update{_bad,}_phishing_sites scripts in mailscanner 4.79.11-2 downloads files and trusts them...5.5 Medium
- broadcom brocade sannav, brocade sannav +1 moreThe authentication mechanism, in Brocade SANnav versions before v2.0, logs plaintext account...5.5 Medium
- broadcom brocade sannav, brocade sannav +1 moreBrocade SANnav versions before v2.0, logs plain text database connection password while...5.5 Medium
- rakuten viberViber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to...8.8 High
- apache impalaIn Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala...7.5 High
- fujitsu lx390 firmwareAn issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack...7.5 High
- ibm cloud orchestrator, cloud orchestrator enterprise +1 moreIBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through...4.0 Medium
- vzug combi-stream mslq firmwareAn issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05...9.1 Critical
- jetbrains toolboxJetBrains Toolbox before 1.15.5605 was resolving an internal URL via a cleartext http connection.5.9 Medium
- jetbrains intellij ideaJetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link...5.9 Medium
- micro focus service managerClear text password in browser in Micro Focus Service Manager product versions 9.30, 9.31, 9.32,...6.5 Medium
- micro focus service managerClear text credentials are used to access managers app in Tomcat in Micro Focus Service Manager...6.5 Medium
- ibm cognos controllerIBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 does not set the secure attribute on...3.7 Low
- dahua ipc-hdw1x2x,ipc-hfw1x2x,ipc-hdw2x2x,ipc-hfw2x2x,ipc-hdw4x2x,ipc-hfw4x2x,ipc-hdbw4x2x,ipc-hdw5x2x,ipc-hfw5x2x, dahuasecurity ipc-hdbw4x2x firmware, ipc-hdw1x2x firmware +7 more +9 moreOnline upgrade information in some firmware packages of Dahua products is not encrypted....5.3 Medium
- siemens sinema remote connect serverA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). An...2.7 Low
- opensslPadding Oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey3.7 Low
- opensslECDSA remote timing attack4.7 Medium
- floragunn search guardSearch Guard versions before 23.1 had an issue that for aggregations clear text values of...7.5 High
- floragunn search guardSearch Guard versions before 24.0 had an issue that values of string arrays in documents are not...7.5 High
- jenkins configuration as code, jenkins project configuration as code plugin +1 moreCleartext Transmission of Sensitive Information in Jenkins Configuration as Code Plugin4.9 Medium
- yarnMissing Encryption of Sensitive Data in yarn8.1 High
- mailenableMailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks...9.8 Critical
- jetbrains kotlinJetBrains IntelliJ IDEA projects created using the Kotlin (JS Client/JVM Server) IDE Template...8.1 High
- lenovo service bridgeA vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow unencrypted...6.5 Medium
- sap solution manager, sap se solution manager(diagnostics agent) +1 moreDiagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user...2.4 Low
- moxa awk-3121 firmwareAn issue was discovered on Moxa AWK-3121 1.14 devices. The device enables an unencrypted TELNET...9.8 Critical
- moxa awk-3121 firmwareAn issue was discovered on Moxa AWK-3121 1.14 devices. The device provides a Wi-Fi connection...8.1 High
- moxa awk-3121 firmwareAn issue was discovered on Moxa AWK-3121 1.14 devices. The device by default allows HTTP traffic...8.1 High
- anviz m3 firmwareAnviz Global M3 Outdoor RFID Access Control executes any command received from any source. No...9.8 Critical
- Show moreLoading…