Weakness (CWE)
CWE-319: Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
How to prevent it (5 mitigations)
-
Architecture and Design
Before transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic protocols.
-
Implementation
When using web applications with SSL, use SSL for the entire session from login to logout, not just for the initial login page.
-
Implementation
When designing hardware platforms, ensure that approved encryption algorithms (such as those recommended by NIST) protect paths from security critical data to trusted user applications.
-
Testing
Use tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
-
Operation
Configure servers to use encrypted channels for communication, which may include SSL or other secure protocols.
Source: MITRE CWE-319
652 results · Feed
-
Low 3.7
Delta Electronics WPLSoft Modbus cleartext transmission
A vulnerability was found in Delta Electronics WPLSoft 2.51. It has been classified as problematic. Affected is an unknown function of the component Modbus Handler. The manipulation leads to cleartext transmission of sensitive information. It is possible to l…
-
Medium 5.9
Cleartext Transmission of Sensitive Information in RDT400 in SICK APU allows an unprivileged remote attacker to retriev…
-
Medium 5.2
QVPN Device Client
A cleartext transmission of sensitive information vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to read sensitive data via unspecified vectors. We have already fixe…
-
Medium 6.8
BIG-IP APM Clients TunnelCrack vulnerability
BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
-
Medium 5.3
BIG-IP APM Clients TunnelCrack vulnerability
BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
-
Medium 5.7
Cleartext Transmission of Sensitive Information in Ormazabal products
The lack of web request control on ekorCCP and ekorRCI devices allows a potential attacker to create custom requests to execute malicious actions when a user is logged in.
-
High 8.8
Plaintext storage of user password
A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular user attributes. All users and client…
-
High 7.3
A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application lacks security …
-
High 8.1
An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform …
-
Medium 5.9
IBM Aspera Faspex information disclosure
IBM Aspera Faspex 5.0.5 transmits sensitive information in cleartext which could be obtained by an attacker using man in the middle techniques. IBM X-Force ID: 244121.
-
Medium 5.3
BUG-000158039 - There is an information disclosure issue in ArcGIS Server.
ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query that may result in a low severity information disclosure issue. The information disclosed is limited…
-
Low 3.5
QTS, QuTS hero and QuTScloud
A cleartext transmission of sensitive information vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows local network clients to read the contents of unexpected sensitive data via unspecified vectors…
-
High 7.4
Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP client
The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local DNS server that performs DNS queries in a secure manner, however, if a user is connected to WARP over an IPv6-capable network, te WARP client …
-
Low 3.7
Intergard SGS SQL Query cleartext transmission
A vulnerability was found in Intergard SGS 8.7.0. It has been declared as problematic. This vulnerability affects unknown code of the component SQL Query Handler. The manipulation leads to cleartext transmission of sensitive information. The attack can be ini…
-
Low 3.7
Intergard SGS Password Change cleartext transmission
A vulnerability was found in Intergard SGS 8.7.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Password Change Handler. The manipulation leads to cleartext transmission of sensitive information. The attac…
-
Critical 9.0
Cleartext Transmission Vulnerability in Hitachi Device Manager
Cleartext Transmission of Sensitive Information vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Server, Device Manager Agent, Host Data Collector components) allows Interception.This issue affects Hitachi Device Manager: before 8.8.5…
-
Low 3.5
CQI Data Sniffing
An insecure connection between Systems Manager and CQI Reporter application could expose infusion data to an attacker.
-
High 7.5
Cleartext Transmission of Sensitive Information in the SICK ICR890-4 could allow a remote attacker to gather sensitive …
-
High 7.5
SolarWinds Serv-U Exposure of Sensitive Information Vulnerability
SolarWinds Serv-U is submitting an HTTP request when changing or updating the attributes for File Share or File request. Part of the URL of the request discloses sensitive data.
-
High 7.6
A cleartext transmission of sensitive information vulnerability [CWE-319] in Fortinet FortiOS version 7.2.0 through 7.2…
-
Medium 5.3
ASUS Router RT-AX3000 Firmware versions prior to 3.0.0.4.388.23403 uses sensitive cookies without 'Secure' attribute. W…
-
Medium 5.9
IBM Maximo Application Suite information disclosure
IBM Maximo Application Suite - Manage Component 8.8.0 and 8.9.0 transmits sensitive information in cleartext that could be intercepted by an attacker using man in the middle techniques. IBM X-Force ID: 249208.
-
High 7.5
Hitron Technologies Inc. CODA-5310 - Insecure service Telnet
Hitron Technologies CODA-5310’s Telnet function transfers sensitive data in plaintext. An unauthenticated remote attacker can exploit this vulnerability to access credentials of normal users and administrator.
-
High 8.6
Improper backend communication allows access and manipulation of the telemetry data
Insufficient authentication in the MQTT backend (broker) allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles using the HopeChart HQT-401 telematics unit. Other models are possibly affected too. Multiple vulnerab…
-
Critical 9.8CVE-2023-33730 Public exploit
Privilege Escalation in the "GetUserCurrentPwd" function in Microworld Technologies eScan Management Console 14.0.1400.…
-
High 7.4
An issue was discovered in Faronics Insight 10.0.19045 on Windows. A suitably positioned attacker could perform a man-i…
-
Medium 5.4
highlight vulnerable to cleartext transmission of sensitive information
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which …
-
High 7.5
Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers. Because the…
-
High 8.8
A CWE-319: Cleartext transmission of sensitive information vulnerability exists that could cause disclosure of sensitiv…
-
High 7.1
Configuration data is exchanged in plaintext and could be available to a nearby attacker if present during configuration or usage of the device via Bluetooth Low Energy (BLE).
Cleartext Transmission of Sensitive Information vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (CE) (Terra AC MID), ABB Terra AC wallbox (CE) Terra AC Juno CE, ABB Terra AC wallbox (CE) Terra AC PTB, ABB T…
-
High 7.5CVE-2023-32784 Public exploit
In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a wor…
-
Critical 9.8
Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 does not defend against physical access to U-Boot via the U…
-
Medium 4.8
Cleartext transmission of sensitive information exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier. If the…
-
High 7.5
The myMail app through 14.30 for iOS sends cleartext credentials in a situation where STARTTLS is expected by a server.
-
Medium 5.7
Cleartext Transmission in set-cookie:ecos_pw: Tenda N301 v6.0, Firmware v12.02.01.61_multi allows an authenticated atta…
-
Medium 5.7
Cleartext Transmission in cookie:ecos_pw: in Tenda N301 v6.0, firmware v12.03.01.06_pt allows an authenticated attacker…
-
High 8.8CVE-2023-25437 EPSS 14%
An issue was discovered in vTech VCS754 version 1.1.1.A before 1.1.1.H, allows attackers to gain escalated privileges a…
-
Medium 6.0
Ironic and ironic-inspector deployed within Baremetal Operator may expose as ConfigMaps
Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of…
-
Medium 5.9
An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12…
-
High 7.5
Jenkins Thycotic DevOps Secrets Vault Plugin does not properly mask credentials
Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.