Weakness (CWE)
CWE-319: Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
How to prevent it (5 mitigations)
-
Architecture and Design
Before transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic protocols.
-
Implementation
When using web applications with SSL, use SSL for the entire session from login to logout, not just for the initial login page.
-
Implementation
When designing hardware platforms, ensure that approved encryption algorithms (such as those recommended by NIST) protect paths from security critical data to trusted user applications.
-
Testing
Use tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
-
Operation
Configure servers to use encrypted channels for communication, which may include SSL or other secure protocols.
Source: MITRE CWE-319
652 results · Feed
-
High 8.4
Unencrypted communication to Active Directory services
When using domain users as BRAIN2 users, communication with Active Directory services is unencrypted. This can lead to the interception of authentication data and compromise confidentiality.
-
High 8.3
EXCHANGE OF SENSITIVE INFORMATION IN CLEAR TEXT
The web server of the device performs exchanges of sensitive information in clear text through an insecure protocol.
-
High 8.7
Nagios Log Server < 2024R2.0.2 Cluster Manager Credential Requests Sent Over Plaintext
Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes over an unencrypted channel even when SSL/TLS is enabled in the product configuration. As a result, a…
-
Critical 10.0
An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by d…
-
Critical 9.8
TM2 Monitoring v3.04 contains an authentication bypass and plaintext credential disclosure.
-
High 7.1
Unencrypted cleartext communication in EfficientLab WorkExaminer Professional
All WorkExaminer Professional traffic between monitoring client, console and server is transmitted as plain text. This allows an attacker with access to the network to read the transmitted sensitive data. An attacker can also freely modify the data on the wir…
-
Low 3.4
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 transmits passwords of user accounts in…
-
Critical 9.6CVE-2025-11492 Public exploit
HTTP Configuration and Encryption in Transit
In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the enc…
-
High 7.7
Windows Hello Security Feature Bypass Vulnerability
Cleartext transmission of sensitive information in Windows Hello allows an unauthorized attacker to bypass a security feature locally.
-
High 7.5
Murrelektronik: Unprotected Transport of Credentials
A cleartext transmission of sensitive information vulnerability in the affected products allows an unauthorized remote attacker to gain login credentials and access the Web-UI.
-
Low 3.1
Tomofun Furbo 360/Furbo Mini Bluetooth Low Energy cleartext transmission
A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. This affects an unknown function of the component Bluetooth Low Energy. The manipulation results in cleartext transmission of sensitive information. Access to the local network is required for thi…
-
Medium 4.7
Components of the YoSmart YoLink ecosystem through 2025-10-02 leverage unencrypted MQTT to communicate over the interne…
-
Medium 6.2
The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow L…
-
High 7.5
IBM Aspera HTTP Gateway information disclosure
IBM Aspera HTTP Gateway 2.0.0 through 2.3.1 stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user.
-
Medium 6.5
Unencrypted and Unauthenticated Communication Allows Data Exposure and Manipulation in iMonitor EAM
iMonitor EAM 9.6394 transmits communication between the EAM client agent and the EAM server, as well as between the EAM monitor management software and the server, in plaintext without authentication or encryption. An attacker with network access can intercep…
-
Low 3.7
Coinomi cleartext transmission
A vulnerability has been found in Coinomi up to 1.7.6. This issue affects some unknown processing. Such manipulation leads to cleartext transmission of sensitive information. The attack can be launched remotely. This attack is characterized by high complexity…
-
Low 3.7
LionCoders SalePro POS Login cleartext transmission
A vulnerability was detected in LionCoders SalePro POS up to 5.5.0. This issue affects some unknown processing of the component Login. Performing manipulation results in cleartext transmission of sensitive information. The attack can be initiated remotely. Th…
-
High 8.0
Cognex In-Sight Explorer and In-Sight Camera Firmware Cleartext Transmission of Sensitive Information
Cognex In-Sight Explorer and In-Sight Camera Firmware expose a proprietary protocol on TCP port 1069 to perform management operations such as modifying system properties. The user management functionality handles sensitive data such as registered usernames an…
-
High 8.6
An adjacent attacker without authentication can exploit this vulnerability to retrieve a set of user-privileged credent…
-
Critical 9.6
Sensitive Data Exposure in Dolusoft's Omaspot
Cleartext Transmission of Sensitive Information vulnerability in Dolusoft Omaspot allows Interception, Privilege Escalation. This issue affects Omaspot: before 12.09.2025.
-
High 8.8CVE-2025-50110 Public exploit
An issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, t…
-
High 8.4
Intelbras IWR 3000N 1.9.8 exposes the Wi-Fi password in plaintext via the /api/wireless endpoint. Any unauthenticated u…
-
High 7.4
Cleartext Transmission of Sensitive Data via Insecure HTTP Web Interface
Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit this to learn sensitive data during transmission.
-
High 7.5
Information Disclosure Vulnerability in MELSEC iQ-F Series CPU module
Cleartext Transmission of Sensitive Information vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to obtain credential information by intercepting SLMP communication messages, and read or w…
-
Medium 6.5
HCL BigFix Service Management (SM) is affected by a Sensitive Information Exposure vulnerability
HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data transmitted between internal components.
-
High 8.8
Aikaan IoT management platform v3.25.0325-5-g2e9c59796 sends a newly generated password to users in plaintext via email…
-
High 8.5
Authentication Hijack
The StrongDM Client insufficiently protected a pre-authentication token. Attackers could exploit this to intercept and reuse the token, potentially redeeming valid authentication credentials through a race condition.
-
Medium 4.7
In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference
-
High 7.4
Santesoft Sante PACS Server Cleartext Transmission of Sensitive Information
The Sante PACS Server Web Portal sends credential information without encryption.
-
High 7.0
YugabyteDB diagnostic information was transmitted over HTTP, which could expose sensitive data during transmission
-
Low 3.7
macrozheng mall login cleartext transmission
A vulnerability was found in macrozheng mall up to 1.0.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/login. The manipulation leads to cleartext transmission of sensitive information. The …
-
Medium 6.9
EG4 Electronics EG4 Inverters Cleartext Transmission of Sensitive Information
The MOD3 command traffic between the monitoring application and the inverter is transmitted in plaintext without encryption or obfuscation. This vulnerability may allow an attacker with access to a local network to intercept, manipulate, replay, or forge crit…
-
Low 2.3
Lego does not enforce HTTPS
Let's Encrypt client and ACME library written in Go (Lego). In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package (thus the lego library and the lego cli as well) don't enforce HTTPS when talking to CAs as an ACME client. Unlike the ht…
-
Medium 5.9
IBM Guardium Data Protection information disclosure
IBM Guardium Data Protection could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive credential information.
-
High 7.3
Couchbase Sync Gateway shows cleartext passwords in redacted and unredacted output
An issue was discovered in Couchbase Sync Gateway before 3.2.6. In sgcollect_info_options.log and sync_gateway.log, there are cleartext passwords in redacted and unredacted output.
-
Low 3.7
Comodo Dragon IP DNS Leakage Detector cleartext transmission
A vulnerability, which was classified as problematic, has been found in Comodo Dragon up to 134.0.6998.179. Affected by this issue is some unknown functionality of the component IP DNS Leakage Detector. The manipulation leads to cleartext transmission of sens…
-
Low 2.6
HCL IEM is affected by a password in cleartext vulnerability
HCL IEM is affected by a password in cleartext vulnerability. Sensitive information is transmitted without adequate protection, potentially exposing it to unauthorized access during transit.
-
Low 2.2
HCL IEM is affected by an authorization token sent in cookie vulnerability
HCL IEM is affected by an authorization token sent in cookie vulnerability. A token used for authentication and authorization is being handled in a manner that may increase its exposure to security risks.
-
High 7.5
DuraComm DP-10iN-100-MU Cleartext Transmission of Sensitive Information
DuraComm SPM-500 DP-10iN-100-MU transmits sensitive data without encryption over a channel that could be intercepted by attackers.
-
Medium 5.9
IBM Cognos Analytics Mobile (iOS) information disclosure
IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 could allow malicious actors to obtain sensitive information due to the cleartext transmission of data.