Skip to content
OpenAdvisories

Weakness (CWE)

CWE-319: Cleartext Transmission of Sensitive Information

Base Draft

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

How to prevent it (5 mitigations)

  1. Architecture and Design

    Before transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic protocols.

  2. Implementation

    When using web applications with SSL, use SSL for the entire session from login to logout, not just for the initial login page.

  3. Implementation

    When designing hardware platforms, ensure that approved encryption algorithms (such as those recommended by NIST) protect paths from security critical data to trusted user applications.

  4. Testing

    Use tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.

  5. Operation

    Configure servers to use encrypted channels for communication, which may include SSL or other secure protocols.

Source: MITRE CWE-319

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 4.8
    CVE-2026-107692 Public exploit

    War Thunder Account Impersonation

    The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the TCP handshake, using only LZ4 compression rather than encryption. An attacker positioned on the network path can passively intercept and d…

    Gaijin Entertainment War Thunder
  • Medium 5.9
    CVE-2026-69212 Public exploit

    Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect

    Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The FollowRedirect client middleware strips Authorization and Cookie headers only when a redirect changes authority, but authority comparison excludes the URI scheme. A same-author…

    http4s http4s
  • Medium 6.6
    CVE-2025-65855 Public exploit

    The OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware v18_178_221102_ASCII_PRO_1R5_50) uses hard…

  • Medium 4.3
    CVE-2023-46447 Public exploit

    The POPS! Rebel application 5.0 for Android, in POPS! Rebel Bluetooth Glucose Monitoring System, sends unencrypted gluc…

  • Medium 5.3
    CVE-2017-6370 Public exploit

    TYPO3 Information Disclosure Vulnerability

    TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields.

    typo3/cms Packagist