CWE-319: Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
A kind of CWE-311 Missing Encryption of Sensitive Data.
From the CWE List. © The MITRE Corporation.
Newest
- midnightbsd mportmport permits repository and package mirror fetches over insecure transport6.0 Medium
- asynchttpclient async-http-clientAsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request5.9 Medium
- asynchttpclient async-http-clientAsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP7.5 High
- advantech eki-1242eims, eki-1242ieims +1 moreNozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive Information...8.7 High
- fermax electronica s.a.u. duoxme, duox plus monitor firmware (veo wi-fi range) +1 moreCleartext Transmission of Sensitive Information in the Pairing Process vulnerability7.0 High
- http4sHttp4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect5.9 Medium
- suprema biostar 2An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and...7.7 High
- rclonerclone: http backend forwards custom/auth headers to a different host on redirect3.7 Low
- softish c6 ear camera, earvision android application +1 moreSoftish C6 Ear Camera and EarVision Android Application Cleartext transmission of sensitive information7.1 High
- google chromeCleartext transmission of sensitive data in HttpsUpgrades in Google Chrome on on iOS prior to 153...5.9 Medium
- No product listedU-speed WIFI4 N300 T1 Pro v1.0.0 is vulnerable to Cleartext transmission of administration...4.3 Medium
- apache software foundation skywalkingApache SkyWalking: PagerDuty alarm hook transmits the integration routing key over cleartext HTTP5.3 Medium
- pydantic httpcore2, httpx2 +1 moreHTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies8.1 High
- scrapyScrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default7.4 High
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 moreUnauthenticated Sensitive Information Disclosure via Man-in-the-Middle in AOS-CX via API Endpoint5.9 Medium
- arubanetworks fabric composerUnauthenticated Information Disclosure Leading to Data Exposure in HPE Networking Fabric Composer3.7 Low
- pnpmpnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings8.3 High
- org.mariadb r2dbc-mariadb, mariadb-corporation mariadb-connector-r2dbc +1 moreMariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)5.9 Medium
- mariadb-corporation mariadb-connector-jMariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials5.9 Medium
- mariadb-corporation mariadb-connector-nodejsMariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb5.9 Medium
- ebyte na111-m firmwareEbyte NA111-M Cleartext Transmission of Sensitive Information9.3 Critical
- ebyte na111-m firmwareEbyte NA111-M Cleartext Transmission of Sensitive Information8.7 High
- roocodeinc roo-codeRooCodeInc Roo-Code OAuth Callback oauth.ts cleartext transmission6.3 Medium
- grafana clickhouse datasourceCVE-2026-19854 CVE Record6.1 Medium
- jahlives openssl encryptopenssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs8.7 High
- milesight am102/102l v2, am103/103l v2, am304l +61 more +63 moreA cleartext transmission of sensitive information vulnerability in the NFC interface of multiple...8.3 High
- typo3 extension "syssy - typo3 monitoring & security checks"Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)5.3 Medium
- hp inc easy start for macosHP Easy Start for macOS - Security Update7.7 High
- merit lilin v1, tp-link dr3150 firmware, dr3220v-4g firmware +34 more +36 moreUnencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways6.3 Medium
- ozols grupa ozolsCritical flaw impacting OZOLS ERP's automatic update channel10.0 Critical
- python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 more`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching6.0 Medium
- dep0we atomic-agents-stackatomic-agents-stack before 1.1.0 Remote Code Execution via HTTP MCP9.2 Critical
- rclonerclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP Redirect9.3 Critical
- rclonerclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect6.0 Medium
- rclonerclone before v1.75.0 Credential Exposure via S3 Redirect6.0 Medium
- cisco catalyst sd-wan managerCisco Catalyst SD-WAN Manager Information Disclosure Vulnerability6.5 Medium
- rrwo data::entropy, data\ +1 moreData::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP7.5 High
- apple ipados, tvos, visionos +3 more +5 moreThis issue was addressed by using HTTPS when sending information over the network. This issue is...6.5 Medium
- zohocorp manageengine endpoint centralSensitive Data Exposure4.3 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows Ancillary Function Driver for WinSock Information Disclosure Vulnerability5.5 Medium
- gofiber fiberFiber: HSTS header never set in helmet middleware due to incorrect protocol check4.8 Medium
- oras-project oras-gooras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens2.1 Low
- ibm watsonx.data intelligenceVulnerabilities found in Watson Data Intelligence5.9 Medium
- ibm watsonx.data intelligenceCleartext Transmission of Sensitive Information in Watson Data Intelligence5.9 Medium
- home-assistant coreHome Assistant: iOS Companion App ignores internal SSID allowlist for connections – possible leak of access token and sensor data7.5 High
- apache apache-airflow-providers-ftp, apache software foundation airflow ftp provider +1 moreApache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P)7.5 High
- hclsoftware connectionsHCL Connections is vulnerable to broken access control3.5 Low
- yokogawa electric corporation ci server, fast/tools +1 moreOverview: A vulnerability has been found in FAST/TOOLS and CI Server. The web server may return...8.2 High
- guzzleGuzzle: Silent HTTPS-Proxy Downgrade to Cleartext5.9 Medium
- apollo pharmacy blood glucose monitoring system (model no. apg-01 bt)Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT Cleartext Transmission of Sensitive Information7.1 High
- Show moreLoading…