Weakness (CWE)
CWE-319: Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
How to prevent it (5 mitigations)
-
Architecture and Design
Before transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic protocols.
-
Implementation
When using web applications with SSL, use SSL for the entire session from login to logout, not just for the initial login page.
-
Implementation
When designing hardware platforms, ensure that approved encryption algorithms (such as those recommended by NIST) protect paths from security critical data to trusted user applications.
-
Testing
Use tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
-
Operation
Configure servers to use encrypted channels for communication, which may include SSL or other secure protocols.
Source: MITRE CWE-319
652 results · Feed
-
Medium 5.3
Concrete CMS vulnerable to Cleartext Transmission of Sensitive Information
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 inadvertently disclose server-side sensitive information (secrets in environment variables and server information) when Debug Mode is left on in production.
-
Medium 5.3
Xiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to plain-text traffic sniffing.
-
High 7.5
POWERCOM CO., LTD. UPSMON PRO - Cleartext Transmission of Sensitive Information
UPSMON PRO transmits sensitive data in cleartext over HTTP protocol. An unauthenticated remote attacker can exploit this vulnerability to access sensitive data.
-
Critical 9.8
Cleartext Transmission of Sensitive Information vulnerability due to the use of Basic Authentication for HTTP connectio…
-
Medium 4.4
IBM Security Guardium information disclosure
IBM Security Guardium 10.5, 10.6, 11.0, 11.1, 11.2, 11.3, and 11.4 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 215587.
-
High 7.7
Pentaho Business Analytics Server - With the Data Lineage feature enabled, the system transmits database passwords in clear text
Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.2 and 8.3.0.25 with the Data Lineage feature enabled transmits database passwords in clear text. The transmission of sensitive data in clear text allows unauthorized actors wit…
-
High 7.5
In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, cur…
-
Critical 9.1
Communication traffic involving "Ethernet Q Commands" service of Haas Controller version 100.20.000.1110 is transmitted…
-
Low 3.7
BIG-IP TMM Vulnerability CVE-2022-41983
On specific hardware platforms, on BIG-IP versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, while Intel QAT (QuickAssist Technology) and the AES-GCM/CCM cipher is in use, undisclosed conditions can caus…
-
High 8.1
Plaintext transmission of CSRF tokens in tiny-csrf
tiny-csrf is a Node.js cross site request forgery (CSRF) protection middleware. In versions prior to 1.1.0 cookies were not encrypted and thus CSRF tokens were transmitted in the clear. This issue has been addressed in commit `8eead6d` and the patch with be i…
-
Critical 9.1
Media transport downgrade from the secure version (SRTP) to non-secure (RTP) in pjsip
PJSIP is a free and open source multimedia communication library written in C. When processing certain packets, PJSIP may incorrectly switch from using SRTP media transport to using basic RTP upon SRTP restart, causing the media to be sent insecurely. The vul…
-
Medium 6.5
A cleartext transmission of sensitive information exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 relating to Oauth toke…
-
Medium 6.5
The Trend Controls IC protocol through 2022-05-06 allows Cleartext Transmission of Sensitive Information. According to …
-
Critical 9.6
AutomationDirect Stride Field I/O Cleartext Transmission of Sensitive Information
Any attempt (good or bad) to log into AutomationDirect Stride Field I/O with a web browser may result in the device responding with its password in the communication packets.
-
High 7.7
AutomationDirect DirectLOGIC with Serial Communication Cleartext Transmission
AutomationDirect DirectLOGIC is vulnerable to a specifically crafted serial message to the CPU serial port that will cause the PLC to respond with the PLC password in cleartext. This could allow an attacker to access and make unauthorized changes. This issue …
-
High 7.5
AutomationDirect C-more EA9 HMI Cleartext Transmission
AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow an attacker to obtain the login credentials and login as a valid user. This issue affects: AutomationDirect C-more EA9 EA…
-
Medium —
Cleartext Transmission of Sensitive Information in moment-timezone
### Impact * if Alice uses `grunt data` (or `grunt release`) to prepare a custom-build, moment-timezone with the latest tzdata from IANA's website * and Mallory intercepts the request to IANA's unencrypted ftp server, Mallory can serve data which might exploi…
-
Medium 4.3
This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in macOS Montere…
-
Medium 5.7
Softing Secure Integration Server Cleartext Transmission of Sensitive Information
Softing Secure Integration Server V1.22 is vulnerable to authentication bypass via a machine-in-the-middle attack. The default the administration interface is accessible via plaintext HTTP protocol, facilitating the attack. The HTTP request may contain the se…
-
Unscored —
SAP BusinessObjects Business Intelligence Platform (Open Document) - versions 420, 430, allows an unauthenticated attac…
-
Medium 6.8
Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Cli…
-
Medium 4.3
Jenkins OpsGenie Plugin vulnerable to Cleartext Transmission of Sensitive Information
Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configuration forms, potentially resulting in their exposure.
-
Low 3.3
Cleartext Storage of Sensitive Information in Jenkins Build Notifications Plugin
Jenkins Build Notifications Plugin 1.5.0 and earlier transmits tokens in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
-
High 7.4
3.2.5 CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319
LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credentials.
-
High 8.0
Code injection in concrete CMS
Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing ‘concrete_secure’ instead of ‘concrete’. Concrete now only makes requests over …
-
Medium 5.9
An information disclosure vulnerability exists in the License registration functionality of Bachmann Visutec GmbH Atvis…
-
Medium 4.3
Information Disclosure via Export Module in TYPO3 CMS
TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the export functionality fails to limit the result set to allowed columns of a particular database table. This way, authentic…
-
High 7.5
A cleartext transmission of sensitive information vulnerability exists in the OAS Engine configuration communications f…
-
Low 3.7
Philips Interoperability Solution XDS - Clear Text Transmission of Sensitive Information
Philips Interoperability Solution XDS versions 2.5 through 3.11 and 2018-1 through 2021-1 are vulnerable to clear text transmission of sensitive information when configured to use LDAP via TLS and where the domain controller returns LDAP referrals, which may …
-
Medium 6.8
Rancher: Weave CNI password is not set if RKE template is used with CNI value overridden
A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network to read and change network data due to missing encryption of data transmitted via the network when a cluster is created from an RKE templa…
-
Critical 9.1
ThroughTek P2P SDK - Cleartext Transmission of Sensitive Information
The affected ThroughTek P2P products (SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, firmware using AVAPI module without enabling DTLS mechanism, and firmware using P2PTunnel or RDT module…
-
Unscored —
Cleartext transmission of sensitive information
Cleartext transmission of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240
-
Unscored —
Cleartext transmission of sensitive information
Cleartext transmission of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 29240
-
Low 2.4
Sensitive information accessible by physical probing of JTAG interface for some Intel(R) Processors with SGX may allow …
-
High 8.8
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not encrypt web traffic with …
-
Medium 5.3
An information disclosure vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. Networ…
-
High 7.5
Automation Direct CLICK PLC CPU Modules Cleartext Transmission of Sensitive Information
Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 passwords are sent as plaintext during unlocking and project transfers. An attacker who has network visibility can observe the password exchange.
-
High 7.5
Philips Vue PACS Cleartext Transmission of Sensitive Information
Philips Vue PACS versions 12.2.x.x and prior transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
-
Low 3.7
ISS BlackICE PC Protection Update cleartext transmission
A vulnerability was found in ISS BlackICE PC Protection. It has been declared as problematic. Affected by this vulnerability is the component Update Handler which allows cleartext transmission of data. NOTE: This vulnerability only affects products that are n…
-
High 7.1
Delta Electronics DIAEnergie CLEARTEXT Transmission of Sensitive Information
Delta Electronics DIAEnergie (Version 1.7.5 and prior) is vulnerable to cleartext transmission as the web application runs by default on HTTP. This could allow an attacker to remotely read transmitted information between the client and product.