CWE-319: Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
A kind of CWE-311 Missing Encryption of Sensitive Data.
From the CWE List. © The MITRE Corporation.
Newest
- rubetek smarthome firmwareRubetek SmartHome 2020 devices use unencrypted 433 MHz communication between controllers and...9.8 Critical
- humaxdigital hga12r-02 firmwareAn issue was discovered on HUMAX HGA12R-02 BRGCAA 1.1.53 devices. A vulnerability in the...9.8 Critical
- linux kernel, redhat enterprise linux, enterprise mrg +2 moreA flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such...7.5 High
- mitel 6863i firmware, 6865i firmware, 6867i firmware +5 more +7 moreA key length vulnerability in the implementation of the SRTP 128-bit key on Mitel 6800 and 6900...5.9 Medium
- apple ios, ipados, safari +1 more +3 moreThe issue was addressed with improved UI handling. This issue is fixed in iOS 13.3.1 and iPadOS...6.5 Medium
- jetbrains scalaIn the JetBrains Scala plugin before 2019.2.1, some artefact dependencies were resolved over...7.5 High
- cloud foundry credhub, pivotal software cloud foundry cf-deployment +1 moreCredHub does not properly enable TLS for MySQL database connections7.6 High
- jenkins s3 publisher, jenkins project s3 publisher plugin +1 moreJenkins S3 Publisher Plugin transmits credentials in plain text during configuration7.5 High
- mfscripts yetishareThe user-introduction email in MFScripts YetiShare v3.5.2 through v4.5.4 may leak the (system...7.5 High
- corusent global tvThe Global TV application 2.3.2 for Android and 4.7.5 for iOS sends Unencrypted Analytics.5.3 Medium
- rogersmedia citytv videoThe Citytv Video application 4.08.0 for Android and 3.35 for iOS sends Unencrypted Analytics.7.5 High
- solarwinds n-centralSolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to...7.5 High
- ixpdata easyinstallIn IXP EasyInstall 6.2.13723, there are cleartext credentials in network communication on TCP...7.5 High
- apache kafka, oracle banking corporate lending process management, banking credit facilities process management +10 more +12 moreExposure of Sensitive Information to an Unauthorized Actor in Apache Kafka7.5 High
- granding grand ma300 firmwareGrand MA 300 allows retrieval of the access PIN from sniffed data.7.5 High
- dten d5 firmware, d7 firmware +1 moreDTEN D5 before 1.3 and D7 before 1.3 devices transfer customer data files via unencrypted HTTP.7.5 High
- upc connect box eurodocsis firmwareThe Administration page on Connect Box EuroDOCSIS 3.0 Voice Gateway CH7465LG-NCIP-6.12.18.25-2p6...7.5 High
- ibm financial transaction manager, financial transaction manager for multiplatform +1 moreIBM Financial Transaction Manager 3.0 does not set the secure attribute on authorization tokens...4.3 Medium
- asus as-101 firmware, dl-101 firmware, hg100 firmware +4 more +6 moreAn issue was discovered on ASUS HG100 1.05.12, WS-101 1.05.12, and TS-101 1.05.12 devices using...9.8 Critical
- humaxdigital hgb10r-02 firmwareAn issue was discovered on Humax Wireless Voice Gateway HGB10R-2 20160817_1855 devices. Admin...7.5 High
- humaxdigital hgb10r-02 firmwareAn issue was discovered on Humax Wireless Voice Gateway HGB10R-2 20160817_1855 devices. The...7.5 High
- apple texture, texture-android, texture-ios +2 moreSome analytics data was sent using HTTP rather than HTTPS. This was addressed by no longer...6.5 Medium
- elog, fedoraproject fedora +1 moreELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote...7.5 High
- elog, fedoraproject fedora +1 moreELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote...7.5 High
- jenkins sctmexecutor, jenkins project sctmexecutor plugin +1 moreJenkins SCTMExecutor Plugin stores credentials in plain text5.3 Medium
- petwant pf-103 firmware, skymee petalk ai firmware +1 moreUnencrypted HTTP communications for firmware upgrades in Petalk AI and PF-103 allow man-in-the...8.1 High
- siemens sppa-t3000 application serverA vulnerability has been identified in SPPA-T3000 Application Server (All versions). The RMI...5.9 Medium
- last.fm desktopThe Last.fm desktop app (Last.fm Scrobbler) through 2.1.39 on macOS makes HTTP requests that...5.3 Medium
- weidmueller ie-sw-pl08m-6tx-2sc firmware, ie-sw-pl08m-6tx-2scs firmware, ie-sw-pl08m-6tx-2st firmware +37 more +39 moreAn issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build...9.8 Critical
- weidmueller ie-sw-pl08m-6tx-2sc firmware, ie-sw-pl08m-6tx-2scs firmware, ie-sw-pl08m-6tx-2st firmware +37 more +39 moreAn issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build...9.8 Critical
- hashicorp terraformUse of a Broken or Risky Cryptographic Algorithm in Terraform7.5 High
- redhat satellite, red hat satellite 6, satellite proxy v 5.6 +2 moreRhn-proxy: rhn-satellite: rhn-proxy: information disclosure via clear-text credential transmission when accessing rhn satellite8.6 High
- inateck bcst-60 firmwareDue to unencrypted and unauthenticated data communication, the wireless barcode scanner Inateck...9.8 Critical
- anviz firmwareAnviz access control devices perform cleartext transmission of sensitive information (passwords...7.5 High
- huami mi fitThe Anhui Huami Mi Fit application before 4.0.11 for Android has an Unencrypted Update Check.5.3 Medium
- jenkins project qmetry for jira - test management plugin, qmetry jenkins qmetry for jira +1 moreJenkins QMetry for JIRA Plugin shows plain text password in configuration form6.5 Medium
- pidginPidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain...5.5 Medium
- broadcom data loss preventionData Loss Prevention - Unprotected Transport of Credentials4.8 Medium
- mysql-gui-tools, fedoraproject fedora +1 moremysql-gui-tools (mysql-query-browser and mysql-admin) before 5.0r14+openSUSE-2.3 exposes the...5.5 Medium
- dlink dir-600 b1 firmware, dir-615 j1 firmware, dir-645 a1 firmware +4 more +6 moreCertain D-Link devices have a hardcoded Alphanetworks user account with TELNET access because of ...9.8 Critical
- rakuten viberViber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to...8.8 High
- schneider-electric modicon 140cra firmware, modicon bmxcra firmware, modicon m340 firmware +1 more +3 moreA CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580,...6.5 Medium
- schneider-electric modicon m340 firmware, modicon m580 firmware, tsxmcpc002m firmware +20 more +22 moreA CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580,...7.5 High
- fujitsu lx390 firmwareAn issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack...7.5 High
- fujitsu lx390 firmwareAn issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack...6.6 Medium
- themooltipass moolticuteStephan Mooltipass Moolticute through 0.42.1 (and possibly earlier versions) has Incorrect Access...6.5 Medium
- tomedo serverThe Customer's Tomedo Server in Version 1.7.3 communicates to the Vendor Tomedo Server via HTTP ...9.8 Critical
- trend micro deep security manager, trendmicro deep security +1 moreThe Deep Security Manager application (Versions 10.0, 11.0 and 12.0), when configured in a...7.5 High
- infinitestudio infinite designThe Infinite Design application 3.4.12 for Android sends a username and password via TCP without...6.5 Medium
- cobham plc explorer 710, cobham explorer 710 firmware +1 moreThe web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext7.8 High
- Show moreLoading…