CWE-319: Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
A kind of CWE-311 Missing Encryption of Sensitive Data.
From the CWE List. © The MITRE Corporation.
Newest
- f5 big-ip (ltm, aam, afm, analytics, apm, asm, dns, edge gateway, fps, gtm, link controller, pem, webaccelerator), big-ip access policy manager, big-ip advanced firewall manager +11 more +13 moreOn BIG-IP 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, SNMP may expose...5.3 Medium
- ilnkp2p project ilnkp2pAn authentication flaw in Shenzhen Yunni Technology iLnkP2P allows remote attackers to actively...8.1 High
- cloud foundry cf-deployment, credhub, uaa release (oss) +2 more +4 moreJava Projects using HTTP to fetch dependencies8.7 High
- fortinet fortimanager, fortinet, inc. fortinet fortimanager +1 moreA cleartext transmission of sensitive information vulnerability in Fortinet FortiManager 5.2.0...8.1 High
- pivotal apps manager, pivotal software application service +1 moreInvitations Service supports HTTP connections8.1 High
- moxa eds-405a firmware, eds-408a firmware, eds-510a firmware +2 more +4 moreMoxa IKS-G6824A series Versions 4.5 and prior, EDS-405A series Version 3.8 and prior, EDS-408A...9.8 Critical
- gradle, fedoraproject fedora +1 moreInsecure transport protocol in Gradle5.9 Medium
- roundcube webmail, fedoraproject fedora, opensuse backports sle +1 more +3 moreIn Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails...4.3 Medium
- claws-mail mailIn Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP encrypted emails can wrap them...4.3 Medium
- trojita project trojitaIn KDE Trojita 0.7, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as...4.3 Medium
- kde kmail, debian linux +1 moreIn KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as...4.3 Medium
- eclipse hawkbit, the eclipse foundation eclipse hawkbit +1 moreCleartext Transmission of Sensitive Information, Inclusion of Functionality from Untrusted Control Sphere , and Download of Code Without Integrity Check in Eclipse hawkBit8.1 High
- ktlintHigh severity vulnerability that affects com.github.shyiko.ktlint:ktlint-core8.1 High
- ucweb uc browserThe UCWeb UC Browser application through 2019-03-26 for Android uses HTTP to download certain...5.9 Medium
- ucweb uc browserUCWeb UC Browser 7.0.185.1002 on Windows uses HTTP for downloading certain PDF modules, which...5.9 Medium
- abus secvest wireless alarm system fuaa50000 firmware, secvest wireless remote control fube50014 firmware, secvest wireless remote control fube50015 firmware +2 moreDue to unencrypted signal communication and predictability of rolling codes, an attacker can ...7.5 High
- medtronic amplia crt-d, carelink 2090 programmer, carelink monitor +44 more +46 moreMedtronic Conexus Radio Frequency Telemetry Protocol Cleartext Transmission of Sensitive Information6.5 Medium
- ibm sterling b2b integratorIBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 Standard Edition could allow highly sensitive...5.9 Medium
- estrongs es file explorer file managerThe Help feature in the ES File Explorer File Manager application 4.1.9.7.4 for Android allows...4.2 Medium
- mobotix s14 firmwareAn issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. The default management application...7.5 High
- sky goThe Sky Go Desktop application 1.0.19-1 through 1.0.23-1 for Windows performs several requests...5.9 Medium
- linux kernel, netapp active iq performance analytics services, element software management node +2 moreThe mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local...5.5 Medium
- apache nifiCleartext Transmission of Sensitive Information in Apache nifi7.5 High
- ibm i2 enterprise insight analysisIBM i2 Enterprise Insight Analysis 2.1.7 could allow a remote attacker to obtain sensitive...5.9 Medium
- huawei espace 7950 firmware, huawei technologies co., ltd. espace 7950 +1 moreThere is a SRTP icon display vulnerability in Huawei eSpace product. An unauthenticated, remote...7.4 High
- google cardboardThe Google Cardboard application 1.8 for Android and 1.2 for iOS sends potentially private...5.3 Medium
- sv3c h.264 poe ip camera firmwareThe SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B)...5.7 Medium
- mercedes-benz mercedes meAn issue was discovered in the Daimler Mercedes-Benz Me app 2.11.0-846 for iOS. The encrypted...7.5 High
- auto-maskin dcu-210e, marine pro observer, rp-210e +2 more +4 moreThe Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App use an embedded webserver that uses unencrypted plaintext for the transmission of the administrator PIN9.1 Critical
- auto-maskin dcu-210e, marine pro observer android app, marine pro observer +3 more +5 moreThe Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App transmit sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors9.1 Critical
- mensamaxAn issue was discovered in the MensaMax (aka com.breustedt.mensamax) application 4.3 for Android....8.1 High
- philips e-alert unit (non-medical device), e-alert firmware +1 morePhilips e-Alert Unit (non-medical device), Version R2.1 and prior. The software transmits...8.8 High
- druide antidote 9Druide Antidote through 9.5.1 on Windows and Linux allows remote code execution through the...8.1 High
- swisscom home app, qbeecam qbee multi-sensor camera firmware, qbeecam +2 moreThe QBee MultiSensor Camera through 4.16.4 accepts unencrypted network traffic from clients (such...6.5 Medium
- redhat wildfly, [unknown] jboss/wildfly +1 moreThe IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when...5.3 Medium
- dlink dir-601 firmwareAn issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having...8.0 High
- perforce puppet enterprise, puppet enterprise +1 moreWhen users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials...9.8 Critical
- medtronic minimed 530g mmt-551 firmware, minimed 530g mmt-751 firmware, minimed paradigm 508 insulin pump firmware +16 more +18 moreMedtronic MiniMed MMT-500/MMT-503 Remote Controllers Cleartext Transmission of Sensitive Information4.8 Medium
- dell emc networker, networker +1 moreDell EMC NetWorker versions between 9.0 and 9.1.1.8 through 9.2.1.3, and the version 18.1.0.1...8.8 High
- intuit lacerteIntuit Lacerte 2017 for Windows in a client/server environment transfers the entire customer list...7.5 High
- echelon i.lon 100, i.lon 600, smartserver 1 +5 more +7 moreEchelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON...9.8 Critical
- netgear dgn2200, dgnd3700, dgn2200 firmware +1 more +3 moreNetgear DGN2200 and DGND3700 disclose the administrator password9.8 Critical
- netgear wndr4500, wndr4500 firmware +1 moreNetgear WNDR4500 running firmware version V1.0.1.40_1.0.6877 reveals some sensitive information such as 2.4GHz & 5GHz Wireless Network Name (SSID) and Network Key (Password) in clear text7.5 High
- juniper junos, juniper networks junos os +1 moreJunos OS: SRX Series: Credentials exposed when using HTTP and HTTPS Firewall Pass-through User Authentication6.1 Medium
- sophos ssl vpn clientImproper restriction of communication channel to intended endpoints vulnerability in HTTP daemon...7.3 High
- apple iphone os, mac os x +1 moreAn issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10...7.5 High
- ibm infosphere information serverIBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow a remote attacker to obtain...5.9 Medium
- ikst project ikst, hackerone ikst node module +1 moreikst Downloads Resources over HTTP5.9 Medium
- gfe-sass project gfe-sass, hackerone gfe-sass node module +1 moregfe-sass downloads Resources over HTTP8.1 High
- hubspot hubl-server, hackerone hubl-server node module +1 morehubl-server downloads resources over HTTP8.1 High
- Show moreLoading…