CWE-319: Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
A kind of CWE-311 Missing Encryption of Sensitive Data.
From the CWE List. © The MITRE Corporation.
Newest
- juniper junos, juniper networks junos os +1 moreJunos OS: vSRX, SRX1500, SRX4K, ACX5K, EX4600, QFX5100, QFX5110, QFX5200, QFX10K and NFX Series: console management port device authentication credentials are logged in clear text5.9 Medium
- renphoAn issue was discovered in the RENPHO application 3.0.0 for iOS. It transmits JSON data...6.8 Medium
- vzug combi-stream mslq firmwareAn issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05...9.1 Critical
- jetbrains toolboxJetBrains Toolbox before 1.15.5605 was resolving an internal URL via a cleartext http connection.5.9 Medium
- apache minaApache MINA SSLFilter security Issue7.5 High
- jenkins sourcegear vault, jenkins project sourcegear vault plugin +1 moreJenkins SourceGear Vault plugin transmits credentials in plain text7.5 High
- jenkins ldap email, jenkins project ldap email plugin +1 moreJenkins LDAP Email Plugin shows plain text password in configuration form7.5 High
- jetbrains intellij ideaJetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link...5.9 Medium
- ibm sterling file gatewayIBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 displays sensitive information in HTTP requests...5.3 Medium
- nuvending nulockThe Nulock application 1.5.0 for mobile devices sends a cleartext password over Bluetooth, which...8.8 High
- f5 big-iq, big-iq centralized management +1 moreIn BIG-IQ 6.0.0-6.1.0, services for stats do not require authentication nor do they implement any...6.5 Medium
- jenkins aqua security scanner, jenkins project aqua security scanner plugin +1 moreJenkins Aqua Security Scanner Plugin showed plain text password in configuration form7.5 High
- jenkins aqua microscanner, jenkins project aqua microscanner plugin +1 moreJenkins Aqua MicroScanner Plugin showed plain text credential in configuration form5.3 Medium
- jenkins inedo proget, jenkins project inedo proget plugin +1 moreJenkins Inedo ProGet Plugin Plugin has Cleartext Transmission of Sensitive Information7.5 High
- jenkins inedo buildmaster, jenkins project inedo buildmaster plugin +1 moreJenkins Inedo BuildMaster Plugin showed plain text password in configuration form7.5 High
- netapp ontap select deploy administration utilityONTAP Select Deploy administration utility versions 2.2 through 2.12.1 transmit credentials in...9.8 Critical
- grafanaAn issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana (e.g., MySQL...4.9 Medium
- mozilla thunderbirdEncrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when...6.5 Medium
- jenkins project aqua security serverless scanner plugin, jenkins aqua security severless scanner +1 moreJenkins Aqua Security Serverless Scanner Plugin showed plain text password in job configuration form fields3.1 Low
- netapp oncommand workflow automationOnCommand Workflow Automation versions prior to 5.0 shipped without certain HTTP Security headers...5.3 Medium
- tiktokThe TikTok (formerly Musical.ly) application 12.2.0 for Android and iOS performs unencrypted...6.5 Medium
- jenkins ibm application security on cloud, jenkins project ibm application security on cloud plugin +1 moreJenkins IBM AppScan Plugin showed plain text password in job configuration form fields6.5 Medium
- belwith products, llc hickory smart ethernet bridge, belwith-keeler hickory smart ethernet bridge firmware +1 moreHickory Smart Lock Cleartext Password6.5 Medium
- pivotal software application service, pivotal application service (pas) +1 moreApps Manager sends tokens to Spring apps via HTTP5.4 Medium
- omg dds securityThe handshake protocol in Object Management Group (OMG) DDS Security 1.1 sends cleartext...7.5 High
- sap businessobjects business intelligence, sap se business objects business intelligence platform (web intelligence) +1 moreSAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.1, 4.2, can...6.5 Medium
- sap businessobjects business intelligence, sap se business objects business intelligence platform (cmc) +1 moreUnencrypted communication error in SAP Business Objects Business Intelligence Platform (Central...6.5 Medium
- jenkins mask passwords, jenkins project mask passwords plugin +1 moreInsertion of Sensitive Information into Log File in Jenkins Mask Passwords Plugin6.5 Medium
- enigmail, fedoraproject fedora +1 moreIn Enigmail below 2.1, an attacker in possession of PGP encrypted emails can wrap them as sub...6.5 Medium
- jenkins configuration as code, jenkins project configuration as code plugin +1 moreCleartext Transmission of Sensitive Information in Jenkins Configuration as Code Plugin4.9 Medium
- yarnMissing Encryption of Sensitive Data in yarn8.1 High
- oneidentity cloud access managerOne Identity Cloud Access Manager 8.1.3 does not use HTTP Strict Transport Security (HSTS), which...7.4 High
- jisiwei i3 firmwareA vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner. Actions...5.6 Medium
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +11 more +13 moreOn BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and...5.3 Medium
- moxa oncell g3150-hspa-t firmware, oncell g3150-hspa firmware +1 moreMoxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary monitoring...9.8 Critical
- moxa oncell g3150-hspa-t firmware, oncell g3150-hspa firmware +1 moreMoxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary...9.8 Critical
- mcafee epolicy orchestrator, mcafee, llc mcafee epolicy orchestrator (epo) +1 moreInformation Disclosure vulnerability in the Agent Handler in McAfee ePolicy Orchestrator (ePO) 5...6.8 Medium
- jetbrains kotlin, ktor +1 moreJetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0 were...8.1 High
- jetbrains kotlinJetBrains Kotlin versions before 1.3.30 were resolving artifacts using an http connection during...8.1 High
- djangoproject django, canonical ubuntu linux, debian linux +2 moreDjango Incorrect HTTP detection with reverse-proxy connecting via HTTPS5.3 Medium
- ibm api connectIBM API Connect 5.0.0.0 through 5.0.8.6 could allow an unauthorized user to obtain sensitive...5.3 Medium
- crossmatch digital persona u.are.u 4500 firmwareAn issue was discovered in Digital Persona U.are.U 4500 Fingerprint Reader v24. The key and salt...5.9 Medium
- siemens simatic mv400 family, simatic mv420 firmware, simatic mv440 firmware +2 moreA vulnerability has been identified in SIMATIC Ident MV420 family (All versions), SIMATIC Ident...5.3 Medium
- logitech r700 laser presentation remote firmwareDue to unencrypted and unauthenticated data communication, the wireless presenter Logitech R700...8.8 High
- inateck wp2002 firmwareDue to unencrypted and unauthenticated data communication, the wireless presenter Inateck WP2002...8.8 High
- inateck wp1001 firmwareDue to unencrypted and unauthenticated data communication, the wireless presenter Inateck WP1001...8.8 High
- ibm security information queueIBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 is missing the HTTP Strict...5.9 Medium
- netapp oncommand insightOncommand Insight versions prior to 7.3.5 shipped without certain HTTP Security headers...7.5 High
- netapp oncommand unified manager 7-mode, oncommand unified manager +1 moreOnCommand Unified Manager 7-Mode prior to version 5.2.4 shipped without certain HTTP Security...7.5 High
- eclipse xtend, xtext, the eclipse foundation eclipse xtext +2 morePotentially compromised builds8.1 High
- Show moreLoading…