Weakness (CWE)
CWE-319: Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
How to prevent it (5 mitigations)
-
Architecture and Design
Before transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic protocols.
-
Implementation
When using web applications with SSL, use SSL for the entire session from login to logout, not just for the initial login page.
-
Implementation
When designing hardware platforms, ensure that approved encryption algorithms (such as those recommended by NIST) protect paths from security critical data to trusted user applications.
-
Testing
Use tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
-
Operation
Configure servers to use encrypted channels for communication, which may include SSL or other secure protocols.
Source: MITRE CWE-319
280 results · Clear filters · Feed
-
Medium 6.8
Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery
Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturi…
-
Medium 6.5
Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and e…
-
Medium 5.7
Mobile VPN with SSL Client for Windows: Cleartext Transmission of VPN Credentials over Local Management Socket
Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker who can capture loopback traffic to obtain the user’s VPN username and password.
-
Medium 4.8
Fclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT P
Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PASV or PORT, file con…
-
Medium 6.5
Unauthorized Access to vSolution Matrix RTSP
When the vSolution Matrix feature is enabled, affected devices may make current screen content available through an unauthenticated RTSP/RTP stream to hosts on the same network segment. The stream is not encrypted, which may allow an unauthenticated host to v…
-
Medium 5.9
Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()
Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with a protocol error to capture service-account credentials and end-…
-
Medium 5.3
Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url
Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can observe a same-host HTTPS-to-HTTP downgrade redir…
-
Medium 6.8
SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting
SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login flow and session cooki…
-
Medium 5.3
Girafit Camera App 1.9.1 Hardcoded TURN Credentials Disclosure
Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network…
-
Medium 4.8CVE-2026-107692 Public exploit
War Thunder Account Impersonation
The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the TCP handshake, using only LZ4 compression rather than encryption. An attacker positioned on the network path can passively intercept and d…
-
Medium 5.1
IBM Aspera Enterprise Webapps Information Disclosure
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to cleartext transmission of sensitive information.
-
Medium 5.3
mcp-remote 0.8.0 through 0.14.3 Cleartext Credential Transmission via --device-code OAuth Grant
mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS endpoints. When discovered device authorization and token endpoints are non-loopba…
-
Medium 5.9
Mechanize sends credential headers to a different scheme or port after a redirect
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP r…
-
Medium 5.9
AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requ…
-
Medium 6.5
Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downgrade
A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing it to fall back to unencrypted communication if the encrypt…
-
Medium 5.3
Unencrypted 802.11 Network in Teledyne FLIR Robots running Aware2
Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 versions through 6.9.0.2 allows adjacent unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackBot robots running this software via sniffing or hij…
-
Medium 4.3
Joyland AI enables HTTP
Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it.
-
Medium 5.9
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cleartext Transmission of Se…
-
Medium 5.9
SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie
SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session…
-
Medium 6.5
Botslab G980H Dashcams Cleartext Transmission of Sensitive Information
The Botslab G980H dash camera firmware transmits sensitive information over unencrypted HTTP and RTSP connections. An attacker capable of intercepting communications on the device's WiFi network could obtain stored recordings, live video, location information…
-
Medium 5.9
Cleartext Transmission of Sensitive Information in Bransys ELD
Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that were connected to the affected MQTT broker.
-
Medium 5.9
Multiple vulnerabilities in IBM Controller
IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques.
-
Medium 6.0
mport permits repository and package mirror fetches over insecure transport
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a url_is_https() enforcement che…
-
Medium 5.9
AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, a request using an HTTP proxy to reach an HTTPS origin can expose preemptive origin crede…
-
Medium 5.9CVE-2026-69212 Public exploit
Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The FollowRedirect client middleware strips Authorization and Cookie headers only when a redirect changes authority, but authority comparison excludes the URI scheme. A same-author…
-
Medium 6.5
Softish C6 Ear Camera and EarVision Android Application Cleartext transmission of sensitive information
The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits cleartext traffic, and captured network traffic contains reconstructable JPEG or WEBP video frames transmitted over UDP.…
-
Medium 5.9
Cleartext transmission of sensitive data in HttpsUpgrades in Google Chrome on on iOS prior to 153.0.8010.36 allowed a r…
-
Medium 4.3
U-speed WIFI4 N300 T1 Pro v1.0.0 is vulnerable to Cleartext transmission of administration credentials over HTTP.
-
Medium 5.3
Apache SkyWalking: PagerDuty alarm hook transmits the integration routing key over cleartext HTTP
PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. PagerDuty serves this endpoint over HTTPS and will normally answer plain HTTP with a redirect. That does not remove the exposure. The initial POST -- including the JSON body conta…
-
Medium 5.9
Unauthenticated Sensitive Information Disclosure via Man-in-the-Middle in AOS-CX via API Endpoint
A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticated attacker to obtain sensitive information via a man-in-the-middle attack. Successful exploitation allows an attacker to retrieve data which could be used to further compromise th…
-
Medium 5.9
MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)
MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authentication plugins on transport encryption because the AuthenticationPlugin interface has n…
-
Medium 5.9
MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insecure connection. The my…
-
Medium 5.9
MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated ove…
-
Medium 6.1
CVE-2026-19854 CVE Record
When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the pro…
-
Medium 5.3
rclone before v1.75.0 Credential Exposure via S3 Redirect
rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture r…
-
Medium 5.3
rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect
rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext ho…
-
Medium 5.3
Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)
When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key.
-
Medium 6.3
Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways
A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate t…
-
Medium 6.0
`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching
The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials …
-
Medium 6.5
Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability is due to insufficient access control en…