CWE-319: Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
A kind of CWE-311 Missing Encryption of Sensitive Data.
From the CWE List. © The MITRE Corporation.
Newest
- steeltoeoss steeltoe.management.endpoint, steeltoe.management.endpointcore +1 moreSteeltoe's env sanitizer misses connection strings — leaks embedded DB passwords7.5 High
- hapijs wreck@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects6.5 Medium
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreClient side encryption fails to encrypt values in a $vectorSearch7.1 High
- gx india earth 1010, earth 2022 +1 moreCleartext Transmission of Credentials Vulnerability in GX Earth ONT Models8.7 High
- securly, securly chrome extension +1 moreCVE-2026-88747.1 High
- synology note station clientA cleartext transmission of sensitive information vulnerability in Synology Note Station Client...5.9 Medium
- djangoproject djangoPotential unencrypted email transmission via STARTTLS in the SMTP backend2.3 Low
- No product listedMercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over...5.9 Medium
- aws graph explorerHTTPS Fallback to HTTP in Graph Explorer8.2 High
- steipete codexbarCodexBar < 0.32.0 Session Cookie Exposure via HTTP Redirect8.2 High
- orca energy heat pump, user portal +1 moreMissing authentication and clear‑text data transmission affecting Orca heat pumps6.3 Medium
- eidetic-labs stigmemstigmem-node Insecure Federation Transport Configuration9.1 Critical
- agenticmail @agenticmail/api, @agenticmail/core +1 moreAgenticMail API/storage and outbound relay hardening8.2 High
- tp link systems inc. tapo d100c v1.0, tp-link systems inc. tapo p300 v1.0, tp-link tapo d100c firmware +3 more +5 moreBluetooth Communication Uses Unencrypted Transmission During Initial Setup on TP-Link's Tapo L535E, P300 and D100C7.3 High
- denoDeno: TLS retry copies stale upgrade hook, risking plaintext traffic7.4 High
- synology surveillance stationCleartext transmission of sensitive information vulnerability in Export Key functionality in...4.9 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260518] - Transport encryption downgrade for password and username reset links9.8 Critical
- nvidia isaac launchableNVIDIA Isaac Launchable for Linux contains a vulnerability where sensitive information is...7.5 High
- centralny instytut ochrony pracy - państwowy instytut badawczy sterLack of traffic encryption in STER2.3 Low
- hcl aionHCL AION is affected by a vulnerability where backend service details may be transmitted over insecure HTTP channels.4.3 Medium
- hcl aionHCL AION is affected by a vulnerability where encryption is not enforced for certain data transmissions or operations5.4 Medium
- No product listedFoscam VD1 Video Doorbell before V5.3.13_1072 is vulnerable to Cleartext Transmission of...5.3 Medium
- kddi corporation あんしんフィルター for auAndroid App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmission of...6.3 Medium
- rrwo catalyst::plugin::statsdCatalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids7.5 High
- rrwo plack::middleware::statsdPlack::Middleware::Statsd versions before 0.9.0 for Perl may leak user IP addresses5.3 Medium
- ezviz appSome EZVIZ products utilize older versions of cloud feature modules with legacy API interfaces,...5.3 Medium
- hcl dfxanalyticsHCL DFXAnalytics is affected by an Insufficient Transport Layer Protection vulnerability3.7 Low
- trendnet tew-821dap, tew-821dap firmware +1 moreTRENDnet TEW-821DAP Firmware Update ssi cleartext transmission6.3 Medium
- cdac-noida e-sushrut, hospital management information system (hmis)Sensitive Data Exposure Vulnerability in e-Sushrut HMIS8.8 High
- curlstale custom cookie host causes cookie leak7.5 High
- curlconnection reuse ignores TLS requirement5.9 Medium
- senselive x3050, x3500 firmware +1 moreSenseLive X3050 Cleartext transmission of sensitive information6.9 Medium
- hcl software bigfix service management (sm), hcltech bigfix service management +1 moreHCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption5.3 Medium
- connectwise automateUnencrypted Client‑Server Communication in ConnectWise Automate™ Solution Center7.1 High
- anviz cx2 lite firmware, cx7 firmware +1 moreAnviz Products Cleartext Transmission of Sensitive Information6.5 Medium
- flowiseai flowiseFlowise: Password Reset Link Sent Over Unsecured HTTP7.5 High
- cryptomatorCryptomator Hub OAuth token exchange HTTP downgrade via getAuthority() scheme confusion (CVE-2026-32303 bypass)4.8 Medium
- fortinet fortisoar, fortisoar on-premise, fortisoar paas +2 moreA cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0...6.2 Medium
- fortinet fortisoar, fortisoar on-premise, fortisoar paas +2 moreA cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0...5.4 Medium
- apache apisixApache APISIX: Openid-connect `tls_verify` field is disabled by default7.5 High
- apache apisixApache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP5.3 Medium
- openclawOpenClaw < 2026.4.2 - Cleartext Credential Transmission via Unencrypted WebSocket Gateway Endpoints5.9 Medium
- ibm maximo application suiteIBM Maximo Application Suite was vulnerable to because Cookie ltpatoken2_<workspace_name> was not set with secure flag4.3 Medium
- papercut ng/mf, mf, mf konica minolta +2 moreSession hijacking in PaperCut NG/MF embedded application for Konica Minolta devices3.6 Low
- gnome libsoup, red hat enterprise linux 10, enterprise linux 10.0 extended update support +15 more +17 moreLibsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment5.9 Medium
- ibm infosphere information serverIBM InfoSphere Information Server is vulnerable due to disclosure of sensitive information6.5 Medium
- ibm concertMultiple Vulnerabilities in IBM Concert Software5.9 Medium
- cisco ios xe softwareA vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated...6.1 Medium
- shenzhen hcc technology mpos m6 plusShenzhen HCC Technology MPOS M6 PLUS Cardholder Data cleartext transmission2.3 Low
- automated logic webctrl premium serverAutomated Logic WebCTRL Premium Server Cleartext Transmission of Sensitive Information9.1 Critical
- Show moreLoading…