CWE-311: Missing Encryption of Sensitive Data
The product does not encrypt sensitive or critical information before storage or transmission.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- ibm cics tx advanced, cics tx standard, cics tx +1 more +3 moreIBM CICS TX information disclosure3.7 Low
- hitron technologies inc. coda-5310, hitrontech coda-5310 firmware +1 moreHitron Technologies Inc. CODA-5310 - Insecure service Telnet7.5 High
- bmc patrolAn issue was discovered in BMC Patrol before 22.1.00. The agent's configuration can be remotely...7.5 High
- dell cloudiq collector, aiops collector +1 moreDell CloudIQ Collector version 1.10.2 contains a missing encryption of sensitive data...6.3 Medium
- jenkins ansible, jenkins project ansible plugin +1 moreJenkins Ansible Plugin stores and displays secrets in plain text4.3 Medium
- axis osAXIS OS 11.0.X - 11.3.x use a static RSA key in legacy LUA-components to protect Axis-specific...5.3 Medium
- vk.company mymailThe myMail app through 14.30 for iOS sends cleartext credentials in a situation where STARTTLS is...7.5 High
- tigergraphAn issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is unsecured read access...4.9 Medium
- jenkins report portal, jenkins project report portal plugin +1 moreJenkins Report Portal Plugin allows users with Item/Extended Read permission to view tokens on Jenkins controller4.3 Medium
- lynx technik ag yellowbrik, lynx-technik yellobrik pec 1864 firmware +1 moreYellowbrik PEC-1864 authentication bypass9.8 Critical
- mobymoby/moby's dockerd daemon encrypted overlay network traffic may be unencrypted6.8 Medium
- nextcloud desktop, nextcloud, kiteworks security-advisories +2 moreNextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders6.9 Medium
- netgear orbi router rbr750, rbs750 firmware +1 moreA cleartext transmission vulnerability exists in the Remote Management functionality of Netgear...6.5 Medium
- johnson controls system configuration tool (sct), johnsoncontrols metasys system configuration tool +1 moreSensitive Cookie in HTTPS Session Without 'Secure' Attribute in System Configuration Tool (SCT)7.5 High
- hashicorp boundaryBoundary Workers Store Rotated Credentials in Plaintext Even When a Key Management Service Configured5.0 Medium
- connectwiseIn Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore...5.3 Medium
- lastyard last yardIn Last Yard 22.09.8-1, the cookie can be stolen via via unencrypted traffic.5.3 Medium
- go-macaron csrfMacaron csrf csrf.go missing secure attribute3.7 Low
- usememos memos, usememos/memos +1 moreSensitive Cookie in HTTPS Session Without 'Secure' Attribute in usememos/memos4.3 Medium
- hcl software bigfix server automationHCL BigFix Server Automation (SA) is affected by a security vulnerability around Notification Service7.7 High
- phpmyfaq, thorsten thorsten/phpmyfaq +1 moreSensitive Cookie in HTTPS Session Without 'Secure' Attribute in thorsten/phpmyfaq6.3 Medium
- devolutions server, remote desktop manager +1 moreDashlane password and Keepass Server password in My Account Settings are not encrypted in the...6.5 Medium
- php point of sale point of sale, phppointofsale php point of sale +1 moreAuthenticated sensitive information disclosure in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.4.9 Medium
- alivecor kardiamobile, kardiamobile 6l firmware, kardiamobile card firmware +1 more +3 moreThe physical IoT device of the AliveCor's KardiaMobile, a smartphone-based personal...4.8 Medium
- corsair k63 firmwareMissing AES encryption in Corsair K63 Wireless 3.1.3 allows physically proximate attackers to...6.8 Medium
- ikus-soft rdiffweb, ikus060 ikus060/rdiffweb +1 moreSensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffweb4.9 Medium
- ikus-soft minarca, ikus060 ikus060/minarca +1 moreSensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/minarca7.5 High
- sap businessobjects business intelligence platform, sap se businessobjects business intelligence platform (cmc) +1 moreUnder certain conditions SAP BusinessObjects Business Intelligence Platform Central Management...5.3 Medium
- ikus-soft rdiffweb, ikus060 ikus060/rdiffweb +1 moreSensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffweb7.5 High
- baxter spectrum wireless battery module (wbm), spectrum iq 35700bax3 firmware, sigma spectrum 35700bax2 firmware +2 more +4 moreUnencrypted internal storage of security credentials4.2 Medium
- esri portal for arcgisPortal for ArcGIS system properties are not properly encrypted (10.8.1 only)6.7 Medium
- ibm cics tx, cics tx advanced, cics tx standard +2 moreIBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies....4.3 Medium
- dell bsafe crypto-c micro edition, bsafe crypto-c-micro-edition, bsafe micro-edition-suite +4 more +6 moreDell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, ...4.7 Medium
- openshift originInsecure cookies in Openshift Origin5.3 Medium
- openssl, debian linux, fedoraproject fedora +20 more +22 moreAES OCB fails to encrypt some bytes5.3 Medium
- google androidIn multiple functions of StorageManagerService.java and UserManagerService.java, there is a...5.5 Medium
- textpatternTextpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session...4.3 Medium
- ldap-account-manager ldap account manager, ldapaccountmanager lam, debian linux +2 moreMissing Encryption of Sensitive Data in ldap-account-manager5.5 Medium
- softwareag connxIn Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have...6.5 Medium
- schneider electric wiser smart, schneider-electric wiser smart eer21000 firmware, wiser smart eer21001 firmware +2 moreA CWE-311: Missing Encryption of Sensitive Data vulnerability exists that could allow...8.2 High
- hcl software bigfix mobile / modern client management, hcltech bigfix mobile, bigfix modern client management +2 moreHCL BigFix Mobile / Modern Client Management is vulnerable to sensitive information exposure6.8 Medium
- hcl software versionvault expressA Security Misconfiguration vulnerability affects HCL VersionVault Express9.1 Critical
- suse rancherRancher: Weave CNI password is not set if RKE template is used with CNI value overridden6.8 Medium
- siemens desigo dxr2, desigo pxc3, desigo pxc4 +5 more +7 moreA vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 ...6.5 Medium
- hcl bigfix webuiHCL BigFix WebUI Cookie missing attributes7.4 High
- dji air 2 firmware, air 2s firmware, fhantom 4 pro firmware +8 more +10 moreDJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone...4.0 Medium
- bigantsoft bigant serverBigAnt Server v5.6.06 was discovered to contain an incorrect access control issue.7.5 High
- philips vue pacs, myvue, speech +3 more +5 morePhilips Vue PACS Use of a Key Past its Expiration Date8.2 High
- gradle enterpriseGradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It...6.5 Medium
- jenkins gitlab authentication, jenkins project gitlab authentication plugin +1 moreClient Secret stored in plain text by Jenkins GitLab Authentication Plugin6.5 Medium
- Show moreLoading…