CWE-319: Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
A kind of CWE-311 Missing Encryption of Sensitive Data.
From the CWE List. © The MITRE Corporation.
Newest
- globalnorthstar northstar club managementCleartext Transmission of Sensitive Information in /northstar/Admin/login.jsp in Northstar...7.5 High
- totolink x5000r firmwareTOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to use the HTTP protocol for authentication...7.5 High
- fresenius-kabi agilia connect, fresenius kabi agilia link+, fresenius-kabi agilia partner maintenance software +4 more +6 moreFresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm7.3 High
- jenkins active directory, jenkins project active directory plugin +1 moreUser passwords transmitted in plain text by Jenkins Active Directory Plugin6.5 Medium
- mediatek l9, lr11, lr12 +3 more +5 moreIn Modem EMM, there is a possible information disclosure due to a missing data encryption. This...7.5 High
- netgear r6700 firmwareNetgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the...7.5 High
- netgear r6700 firmwareNetgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the...7.5 High
- netgear rax43 firmwareNetgear RAX43 version 1.0.3.96 does not utilize secure communications to the web interface. By...6.8 Medium
- trendnet tew-827dru firmwareTrendnet AC2600 TEW-827DRU version 2.08B01 contains an security flaw in the web interface. HTTPS...7.5 High
- moxa mgate mb3180 series, mgate mb3280 series, mgate mb3480 series +3 more +5 moreICSA-21-357-01 Moxa MGate Protocol Gateways9.8 Critical
- ksmbd project ksmbd, netapp h300e firmware, h300s firmware +6 more +8 moreThe ksmbd server through 3.4.2, as used in the Linux kernel through 5.15.8, sometimes...7.5 High
- digipas egeetouch managerAn issue was discovered in the eGeeTouch 3rd Generation Travel Padlock application for Android....6.8 Medium
- wokkalokka wokka watch q50 firmwareWokka Lokka Q50 devices through 2021-11-30 allow remote attackers (who know the SIM phone number...8.1 High
- elastic kibanaKibana Sensitive Data Disclosure2.7 Low
- ibm security key lifecycle manager, security guardium key lifecycle manager +1 moreIBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain...5.9 Medium
- motorola binatone hubble cameras, binatoneglobal cn28 firmware, cn40 firmware +19 more +21 moreSome device communications in some Motorola-branded Binatone Hubble Cameras with backend Hubble...5.3 Medium
- rcdevs openotp tokenAn issue was discovered in the RCDevs OpenOTP app 1.4.13 and 1.4.14 for iOS. If it is installed...5.5 Medium
- siemens climatix pol909 (awb module), climatix pol909 (awm module), climatix pol909 firmware +2 moreA vulnerability has been identified in Climatix POL909 (AWM module) (All versions < V11.34). The...7.4 High
- ibm qradar network securityIBM QRadar Network Security 5.4.0 and 5.5.0 transmits sensitive or security-critical data in...6.8 Medium
- meross smart wi-fi 2 way wall switch, mss550x firmware +1 moreMeross MSS550X Missing Encryption of Sensitive Data7.4 High
- ibm business automation workflow, business process manager +1 moreIBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6...5.9 Medium
- azeotech daqfactoryAzeoTech DAQFactory5.7 Medium
- delta electronics dialinkDelta Electronics DIALink8.8 High
- datalust seq.app.emailplusDatalust Seq.App.EmailPlus (aka seq-app-htmlemail) 3.1.0-dev-00148, 3.1.0-dev-00170, and 3.1.0...7.5 High
- optinmonsterOptinMonster <= 2.6.4 Unprotected REST-API Endpoints8.2 High
- juniper ctpviewCTPView: HSTS not being enforced on CTPView server.7.4 High
- mitsubishi electric corporation melsec iq-r series safety cpu r08sfcpu, melsec iq-r series safety cpu r120sfcpu, melsec iq-r series safety cpu r16sfcpu +21 more +23 moreAuthorization bypass through user-controlled key vulnerability in MELSEC iQ-R series Safety CPU...9.1 Critical
- gitlabIn all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to...5.3 Medium
- laracms project laracmsLaraCMS v1.0.1 transmits sensitive information in cleartext which can be intercepted by attackers.7.5 High
- credova financialCredova_Financial <= 1.4.8 Sensitive Information Disclosure5.3 Medium
- riconmobile s9922l firmwareRICON Industrial Cellular Router S9922L 16.10.3(3794) is affected by cleartext storage of...5.3 Medium
- netgear r6400v2 firmware, r6700 firmware, r6700v3 firmware +8 more +10 moreThe update process of the Circle Parental Control Service on various NETGEAR routers allows...8.1 High
- haxx curl, apple macos, debian linux +29 more +31 moreA user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking...7.5 High
- barco mirrorop windows senderBarco MirrorOp Windows Sender before 2.5.3.65 uses cleartext HTTP and thus allows rogue software...8.8 High
- fetchmail, fedoraproject fedora +1 moreFetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such...5.9 Medium
- bbraun spacecom2A Cleartext Transmission of Sensitive Information vulnerability in B. Braun SpaceCom2 prior to...5.9 Medium
- kde kmailIn KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext...5.3 Medium
- ibm i2 analyzeIBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) does not set the...3.1 Low
- apache directory studioStartTLS and SASL confidentiality protection bypass7.5 High
- haxx curl, fedoraproject fedora, netapp cloud backup +16 more +18 moreWhen curl is instructed to get content using the metalink feature, and a user name and password...5.3 Medium
- arm mbed tls, debian linux +1 moreAn issue was discovered in Arm Mbed TLS before 2.23.0. A remote attacker can recover plaintext...7.5 High
- ibm qradar, qradar security information and event manager +1 moreIBM QRadar SIEM 7.3 and 7.4 uses less secure methods for protecting data in transit between hosts...5.3 Medium
- magicsmotion flamingo 2 firmwareMagicMotion Flamingo 2 lacks BLE encryption, enabling data sniffing and packet forgery.5.3 Medium
- idrive remotepciDrive RemotePC before 7.6.48 on Windows allows information disclosure. A man in the middle can...5.3 Medium
- qualcomm, inc. snapdragon compute, snapdragon connectivity, qualcomm aqt1000 firmware, qca6164 firmware +20 more +22 moreWeak configuration in WLAN could cause forwarding of unencrypted packets from one client to...4.3 Medium
- devolutions serverDevolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept...2.6 Low
- huawei emuiThere is a Cleartext Transmission of Sensitive Information Vulnerability in Huawei Smartphone....9.1 Critical
- bosch b426 firmware, b426 firmware +1 moreB426 Credential Disclosure8.8 High
- quassel-irc quassel, fedoraproject fedora +1 moreQuassel through 0.13.1, when --require-ssl is enabled, launches without SSL or TLS support if a...7.5 High
- i-doo veryfitproThe VeryFitPro (com.veryfit2hr.second) application 3.2.8 for Android does all communication with...8.1 High
- Show moreLoading…