CWE-319: Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
A kind of CWE-311 Missing Encryption of Sensitive Data.
From the CWE List. © The MITRE Corporation.
Newest
- sick eventcam appA remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to...9.8 Critical
- solarwinds serv-u, servu +1 moreSolarWinds Serv-U Exposure of Sensitive Information Vulnerability7.5 High
- fortinet fortios, fortiproxy +1 moreA cleartext transmission of sensitive information vulnerability [CWE-319] in Fortinet FortiOS...7.6 High
- asus rt-ax3000 firmware, asustek computer inc. asus router rt-ax3000 +1 moreASUS Router RT-AX3000 Firmware versions prior to 3.0.0.4.388.23403 uses sensitive cookies without...5.3 Medium
- atlas copco power focus, atlascopco power focus 6000 firmware +1 moreCVE-2023-18999.4 Critical
- ibm maximo application suiteIBM Maximo Application Suite information disclosure5.9 Medium
- hitron technologies inc. coda-5310, hitrontech coda-5310 firmware +1 moreHitron Technologies Inc. CODA-5310 - Insecure service Telnet7.5 High
- openprojectOpenProject vulnerable to project identifier information leakage through robots.txt7.5 High
- hangzhou hopechart iot technology co., ltd. hqt401, hopechart hqt401 firmware +1 moreImproper backend communication allows access and manipulation of the telemetry data8.6 High
- google androidthere is a possible use of unencrypted transport over cellular networks due to an insecure...7.5 High
- google androidthere is a possible use of unencrypted transport over cellular networks due to an insecure...7.5 High
- escanav escan management consolePrivilege Escalation in the "GetUserCurrentPwd" function in Microworld Technologies eScan...9.8 Critical
- faronics insightAn issue was discovered in Faronics Insight 10.0.19045 on Windows. A suitably positioned attacker...7.4 High
- dn88 highlighthighlight vulnerable to cleartext transmission of sensitive information5.4 Medium
- snap one ovrc cloud, snapone orvc +1 moreSnap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a...7.5 High
- schneider electric legacy ion products, powerlogic ion7400, powerlogic ion8650 +8 more +10 moreA CWE-319: Cleartext transmission of sensitive information vulnerability exists that could cause...8.8 High
- abb terra ac wallbox (ce) symbiosis, terra ac wallbox (ce) terra ac ptb, terra ac wallbox (jp) +12 more +14 moreConfiguration data is exchanged in plaintext and could be available to a nearby attacker if present during configuration or usage of the device via Bluetooth Low Energy (BLE).7.1 High
- keepassIn KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory...7.5 High
- tenda cp3 firmwareShenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 does not defend against physical...9.8 Critical
- seiko solutions inc. skybridge mb-a100/110, seiko-sol skybridge mb-a100 firmware, skybridge mb-a110 firmware +2 moreCleartext transmission of sensitive information exists in SkyBridge MB-A100/110 firmware Ver. 4.2...6.5 Medium
- vk.company mymailThe myMail app through 14.30 for iOS sends cleartext credentials in a situation where STARTTLS is...7.5 High
- tenda n301 firmwareCleartext Transmission in cookie:ecos_pw: in Tenda N301 v6.0, firmware v12.03.01.06_pt allows an...5.7 Medium
- tenda n301 firmwareCleartext Transmission in set-cookie:ecos_pw: Tenda N301 v6.0, Firmware v12.02.01.61_multi allows...5.7 Medium
- vtech vcs754a firmwareAn issue was discovered in vTech VCS754 version 1.1.1.A before 1.1.1.H, allows attackers to gain...8.8 High
- linuxfoundation baremetal operator, metal3-io baremetal-operator +1 moreIronic and ironic-inspector deployed within Baremetal Operator may expose as ConfigMaps6.0 Medium
- mattermost, mattermost server +1 moreUser password logged in audit logs7.2 High
- gitlabAn issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0...5.9 Medium
- jenkins thycotic devops secrets vault, jenkins project thycotic devops secrets vault plugin +1 moreJenkins Thycotic DevOps Secrets Vault Plugin does not properly mask credentials7.5 High
- jenkins azure key vault, jenkins project azure key vault plugin +1 moreJenkins Azure Key Vault Plugin does not properly mask credentials7.5 High
- jenkins kubernetes, jenkins project kubernetes plugin +1 moreJenkins Kubernetes Plugin does not properly mask credentials7.5 High
- docker desktopIn Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed5.9 Medium
- forgerock ldap connector, forgerock inc. openidm and java remote connector server (rcs) +1 moreWhen the LDAP connector is started with StartTLS configured, LDAP BIND credentials are transmitted insecurely, prior to establishing the TLS connection.7.5 High
- sambaThe Samba AD DC administration tool, when operating against a remote LDAP server, will by default...5.9 Medium
- sauter ey-as525f001 with moduweb, sauter-controls ey-as525f001 firmware +1 moreCVE-2023-279276.5 Medium
- netgear orbi router rbr750, rbs750 firmware +1 moreA cleartext transmission vulnerability exists in the Remote Management functionality of Netgear...6.5 Medium
- sauter-controls bacnetstac, sauter controls modunet300 (ey-am300f001, ey-am300f002), nova 106 (eyk300f001) bacnet communication card +7 more +9 moreSAUTER Controls Nova 200–220 Series Cleartext Transmission of Sensitive Information7.5 High
- apple music, music for android +1 moreThis issue was addressed with using HTTPS when sending information over the network. This issue...5.3 Medium
- ls electric xbc-dn32u, ls-electric xbc-dn32u firmware +1 moreCVE-2023-228067.5 High
- haxx curl, netapp active iq unified manager, clustered data ontap +8 more +10 moreA cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that...6.5 Medium
- haxx curl, netapp active iq unified manager, clustered data ontap +8 more +10 moreA cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that...9.1 Critical
- screencheck badgemakerInformation Disclosure in Authentication Component of ScreenCheck BadgeMaker 2.6.2.0 application...7.5 High
- palo alto networks cortex xdr agentCortex XDR Agent: Cleartext Exposure of Agent Admin Password6.0 Medium
- moxa sds-3008 series industrial ethernet switch, sds-3008-t firmware, sds-3008 firmware +2 moreA cleartext transmission vulnerability exists in the web application functionality of Moxa SDS...5.9 Medium
- couchbase serverCouchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive...7.5 High
- connectwise automateConnectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being...5.9 Medium
- lastyard last yardLast Yard 22.09.8-1 does not enforce HSTS headers9.8 Critical
- jenkins jira pipeline steps, jenkins project jira pipeline steps plugin +1 moreCleartext Transmission of Sensitive Information in Jenkins JIRA Pipeline Steps Plugin5.5 Medium
- ibm robotic process automation, robotic process automation as a service, robotic process automation for cloud pak +2 moreIBM Robotic Process Automation information disclosure5.9 Medium
- inhand networks inrouter 302, inrouter 615, inhandnetworks inrouter302 firmware +1 more +3 moreInHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version...6.5 Medium
- zephyrproject zephyrPossible to retrieve uncrypted firmware image6.5 Medium
- Show moreLoading…