CWE-311: Missing Encryption of Sensitive Data
The product does not encrypt sensitive or critical information before storage or transmission.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- hcl software inotes, hcltech hcl inotes +1 moreHCL iNotes is susceptible to a sensitive cookie exposure vulnerability. This can allow an...5.9 Medium
- schneider-electric modicon m221 firmwareA CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Modicon M221 (all...5.7 Medium
- hackerone nextcloud server, nextcloud server +1 moreA cryptographic issue in Nextcloud Server 19.0.1 allowed an attacker to downgrade the encryption...4.1 Medium
- hackerone nextcloud server, nextcloud server +1 moreA too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed...2.2 Low
- synology diskstation manager (dsm), diskstation manager, skynas firmware +2 moreSynology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the...5.8 Medium
- synology router manager, router manager (srm) +1 moreSynology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session...5.8 Medium
- apple macos, mac os x +1 moreAn issue existed with Siri Suggestions access to encrypted data. The issue was fixed by limiting...7.5 High
- juniper junos, juniper networks junos os +1 moreJunos OS: SRX and NFX Series: Insufficient Web API private key protection6.5 Medium
- gradle enterpriseAn issue was discovered in Gradle Enterprise before 2020.2.5. Lack of the secure attribute on the...5.3 Medium
- gradle enterprise, enterprise cache node +1 moreAn issue was discovered in Gradle Enterprise 2018.2 and Gradle Enterprise Build Cache Node 4.1....7.5 High
- jenkins soapui pro functional testing, jenkins project soapui pro functional testing plugin +1 morePasswords stored in plain text by Jenkins ReadyAPI Functional Testing Plugin6.5 Medium
- jenkins team foundation server, jenkins project team foundation server plugin +1 moreCredentials stored in plain text by Jenkins tfs Plugin3.3 Low
- jenkins parameterized remote trigger, jenkins project parameterized remote trigger plugin +1 moreSecret stored in plain text by Jenkins Parameterized Remote Trigger Plugin4.3 Medium
- ibm spectrum protect serverIBM Spectrum Protect Server 8.1.0.000 through 8.1.10.000 could disclose sensitive information in...2.9 Low
- ibm guardium data encryption, security guardium data encryption, guardium for cloud key management +2 moreIBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not set the secure attribute on...3.7 Low
- cisco hyperflex hx-series software, hyperflex hx data platform +1 moreCisco Hyperflex HX-Series Software Weak Storage Vulnerability4.4 Medium
- diebold nixdorf procash 2100xe usb atm, dieboldnixdorf probase +1 moreDiebold Nixdorf ProCash 2100xe USB ATMs running Wincor Probase version 1.1.30 do not encrypt,...5.3 Medium
- ncr aptra xfs, selfserv atm +1 moreNCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the...7.1 High
- siemens sicam t, siemens ag sicam mmu, sicam sgu +3 more +5 moreA vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions)...8.1 High
- nordicsemi android ble library, dfu library +1 moreNordic Semiconductor Android BLE Library through 2.2.1 and DFU Library through 1.10.4 for Android...6.5 Medium
- solarwinds serv-uSolarWinds Serv-U File Server before 15.2.1 mishandles the Same-Site cookie attribute, aka Case...7.5 High
- ibm security identity manager virtual applianceIBM Security Identity Manager Virtual Appliance 7.0.2 does not set the secure attribute on...3.7 Low
- biotronik cardiomessenger ii-s gsm firmware, cardiomessenger ii-s t-line firmware +1 moreBIOTRONIK CardioMessenger II, The affected products do not encrypt sensitive information while at...4.6 Medium
- baxter em1200 firmware, em2400 firmware +1 moreBaxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems store...9.1 Critical
- zyxel cloudcnm secumanagerZyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded opt/axess/AXAssets/default_axess/axess...7.5 High
- zyxel cloudcnm secumanagerZyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_install_user API.5.3 Medium
- zyxel cloudcnm secumanagerZyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_install_user_key API.5.3 Medium
- zyxel cloudcnm secumanagerZyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_get_user_id_and_key API.5.3 Medium
- zyxel cloudcnm secumanagerZyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_get_instances_for_update API.5.3 Medium
- zyxel cloudcnm secumanagerZyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a /live/GLOBALS API with the CLOUDCNM key.5.3 Medium
- zyxel cloudcnm secumanagerZyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded APP_KEY in /opt/axess/etc/default/axess.5.3 Medium
- zyxel cloudcnm secumanagerZyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded OAUTH_SECRET_KEY in /opt/axess/etc...9.8 Critical
- argent recoverymanagerIn Argent RecoveryManager before 0xdc350d09f71c48c5D22fBE2741e4d6A03970E192, the executeRecovery...7.5 High
- aliasrobotics mir1000 firmware, mir100 firmware, mir200 firmware +8 more +10 moreRVD#2560: Unprotected intellectual property in Mobile Industrial Robots (MiR) controllers7.5 High
- mattermost serverMattermost Server SAML implementation does not require encryption or signature verification as default7.5 High
- mozilla thunderbird, canonical ubuntu linux +1 moreIf Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH...7.5 High
- ibm security identity governance and intelligenceIBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain...3.7 Low
- libreoffice, opensuse leap +1 moreCrash-recovered MSOffice encrypted documents defaulted to not to using encryption on next save5.3 Medium
- igniterealtime sparkAn issue was discovered in Ignite Realtime Spark 2.8.3 (and the ROAR plugin for it) on Windows. A...8.8 High
- openstack keystone, canonical ubuntu linux +1 moreOpenStack Keystone does not check signature TTL of the EC2 credential auth method5.4 Medium
- openstack keystone, canonical ubuntu linux +1 moreOpenStack Keystone V3 /credentials endpoint policy logic allows to change credentials owner or target project ID8.8 High
- f5 big-ip asm, big-ip application security manager +1 moreOn BIG-IP ASM 11.6.1-11.6.5.1, under certain configurations, the BIG-IP system sends data plane...7.5 High
- testlinkIn TestLink 1.9.20, a crafted login.php viewer parameter exposes cleartext credentials.7.5 High
- jetbrains golandIn JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS.7.5 High
- appinghouse memonoUsers can lock their notes with a password in Memono version 3.8. Thus, users needs to know a...7.5 High
- symantec management centerA CSRF token disclosure vulnerability allows a remote attacker, with access to an authenticated...5.9 Medium
- universal robots ur3, ur5 and ur10, universal-robots ur software +1 moreRVD#1489: Unprotected intelectual property in Universal Robots controller CB 3.1 across firmware versions7.5 High
- abb esomsABB eSOMS: Secure Flag not set3.5 Low
- arm mbed tls, mbed crypto, debian linux +1 more +3 moreArm Mbed TLS before 2.6.15 allows attackers to obtain sensitive information (an RSA private key)...5.9 Medium
- netsas enigma network management solutionNETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data rendered within web pages. It...7.5 High
- Show moreLoading…