Weakness (CWE)
CWE-319: Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
How to prevent it (5 mitigations)
-
Architecture and Design
Before transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic protocols.
-
Implementation
When using web applications with SSL, use SSL for the entire session from login to logout, not just for the initial login page.
-
Implementation
When designing hardware platforms, ensure that approved encryption algorithms (such as those recommended by NIST) protect paths from security critical data to trusted user applications.
-
Testing
Use tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
-
Operation
Configure servers to use encrypted channels for communication, which may include SSL or other secure protocols.
Source: MITRE CWE-319
652 results · Feed
-
Low 3.5
A vulnerability was reported in version 1.0 of the Bluetooth Transmission Alliance protocol adopted by Motorola Smart C…
-
High 8.7
Cleartext Transmission Vulnerability in Digisol DG-GR6821AC Router
This vulnerability exists in Digisol DG-GR6821AC Router due to cleartext transmission of credentials in its web management interface. A remote attacker could exploit this vulnerability by intercepting the network traffic and capturing cleartext credentials. S…
-
Low 3.1
Aap: sensitive cookie(s) set without security flags
A flaw was found in Ansible. Sensitive cookies without security flags over non-encrypted channels can lead to Man-in-the-Middle (MitM) and Cross-site scripting (XSS) attacks allowing attackers to read transmitted data.
-
High 7.5
Ecovacs Deebot T10 1.7.2 transmits Wi-Fi credentials in cleartext during the pairing process.
-
Medium 6.5
CVE-2025-27457
All communication between the VNC server and client(s) is unencrypted. This allows an attacker to intercept the traffic and obtain sensitive data.
-
Medium 5.3
IBM InfoSphere DataStage Flow Designer information disclosure
IBM InfoSphere DataStage Flow Designer in IBM InfoSphere Information Server 11.7 discloses sensitive user information in API requests in clear text that could be intercepted using man in the middle techniques.
-
Medium 6.0
Cleartext Transmission of Sensitive Information in Kaleris Navis N4
Kaleris NAVIS N4 ULC (Ultra Light Client) communicates insecurely using zlib-compressed data over HTTP. An attacker capable of observing network traffic between Ultra Light Clients and N4 servers can extract sensitive information, including plaintext credenti…
-
Critical 10.0
Hardcoded Credentials in Ataturk University's ATA-AOF Mobile Application
Cleartext Transmission of Sensitive Information, Use of Hard-coded Credentials vulnerability in Ataturk University ATA-AOF Mobile Application allows Authentication Abuse, Authentication Bypass. This issue affects ATA-AOF Mobile Application: before 20.06.2025.
-
Critical 9.8
An issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a WL…
-
Critical 9.8CVE-2025-26199 Public exploit
CloudClassroom-PHP-Project v1.0 is affected by an insecure credential transmission vulnerability. The application trans…
-
Low 1.0
GlobalProtect App: Interception in Endpoint Traffic Policy Enforcement
An improper access control vulnerability in the Endpoint Traffic Policy Enforcement https://docs.paloaltonetworks.com/globalprotect/6-0/globalprotect-app-new-features/new-features-released-in-gp-app/endpoint-traffic-policy-enforcement feature of the Palo Alto…
-
High 7.5
Unencrypted communication
The server supports authentication methods in which credentials are sent in plaintext over unencrypted channels. If an attacker were to intercept traffic between a client and this server, the credentials would be exposed.
-
High 7.5
Unencrypted communication (HTTP)
All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver. This leads to the possibility of information gathering and downloading media files.
-
Medium 5.9
Tinxy WiFi Lock Controller v1 RF was discovered to transmit sensitive information in plaintext, including control infor…
-
High 7.5
SNI was sometimes unencrypted
In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled. This vulnerability was fixed in Firefox 139 and Thunderbird 139.
-
Medium 5.3
PAN-OS: Unencrypted Data Transfer when using AES-128-CCM on Intel-based hardware devices
Using the AES-128-CCM algorithm for IPSec on certain Palo Alto Networks PAN-OS® firewalls (PA-7500, PA-5400, PA-5400f, PA-3400, PA-1600, PA-1400, and PA-400 Series) leads to unencrypted data transfer to devices that are connected to the PAN-OS firewall throug…
-
Medium 4.4
A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V2.1 HF0 with SINEMA Remot…
-
High 7.4
Pixmeo OsiriX MD Cleartext Transmission of Sensitive Information
The Pixmeo Osirix MD Web Portal sends credential information without encryption, which could allow an attacker to steal credentials.
-
Critical 9.1
On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan tunnels in the clear.
On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan tunnels in the clear.
-
Critical 10.0
Non-Secure Access
Cleartext Transmission of Sensitive Information vulnerability in Crestron Automate VX allows Sniffing Network Traffic. The device allows Web UI and API access over non-secure network ports which exposes sensitive information such as user passwords. This issue…
-
Medium 4.3
An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. By default, a GID is the user's pho…
-
Medium 4.3
An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. By default, the GID is the user's pho…
-
High 7.1
An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. A command channel includes the next h…
-
Low 3.7
IBM InfoSphere Information Server information disclosure
IBM InfoSphere Information Server 11.7 DataStage Flow Designer transmits sensitive information via URL or query parameters that could be exposed to an unauthorized actor using man in the middle techniques.
-
High 8.7
Information Disclosure Vulnerability in Meon KYC solutions
This vulnerability exists in the Meon KYC solutions due to transmission of sensitive data in plain text within the response payloads of certain API endpoints. An authenticated remote attacker could exploit this vulnerability by intercepting API response that …
-
Medium 4.0
Cilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.15.0 to 1.15.15, 1.16.0 to 1.16.8, and 1.17.0 to 1.17.2, are vulnerable when using Wireguard transparent encryption in a Cilium cluster, packets that origina…
-
Medium 6.9
In JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possible
-
Medium 4.7
Arctera/Veritas Data Insight before 7.1.2 can send cleartext credentials when configured to use HTTP Basic Authenticati…
-
Medium 5.9
Cleartext transmission of sensitive information issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a man…
-
Medium 6.8
Potential information disclosure vulnerability in SAP Commerce Cloud (Public Cloud)
SAP Commerce Cloud (Public Cloud) does not allow to disable unencrypted HTTP (port 80) entirely, but instead allows a redirect from port 80 to 443 (HTTPS). As a result, Commerce normally communicates securely over HTTPS. However, the confidentiality and integ…
-
Low 3.1
Consumer Comanda Mobile Restaurant Order cleartext transmission
A vulnerability classified as problematic has been found in Consumer Comanda Mobile up to 14.9.3.2/15.0.0.8. This affects an unknown part of the component Restaurant Order Handler. The manipulation of the argument Login/Password leads to cleartext transmissio…
-
Medium 6.9
Cleartext Transmission of Sensitive Information vulnerability in saTECH BCU
SaTECH BCU in its firmware version 2.1.3 uses the HTTP protocol. The use of the HTTP protocol for web browsing has the problem that information is exchanged in unencrypted text. Since sensitive data such as credentials are exchanged, an attacker could obtain …
-
Medium 6.5
Mi Connect Service APP protocol flaws lead to leaking sensitive user information
A protocol flaw vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited by attackers to leak sensitive user information.
-
Critical 9.0
Authentication Bypass in Sechard Information Technologies' SecHard
Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in Sechard Information Technologies SecHard allows Authentication Bypass, Interface Manipulation, Authentication Abuse, Harve…
-
High 7.3
This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in iOS 18.2 and …
-
High 7.5
Unencrypted transmission of password hash
The device uses an unencrypted, proprietary protocol for communication. Through this protocol, configuration data is transmitted and device authentication is performed. An attacker can thereby intercept the authentication hash and use it to log into the devic…
-
Critical 9.4
Bitdefender Box Insecure Update Mechanism Vulnerability in libboxhermes.so
Bitdefender Box, versions 1.3.11.490 through 1.3.11.505, uses the insecure HTTP protocol to download assets over the Internet to update and restart daemons and detection rules on the devices. Updates can be remotely triggered through the /set_temp_token API m…
-
Medium 5.6
Improper cookie attributes in Foreseer Reporting Software (FRS)
Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software (FRS). Absence of this secure flag could lead into the session cookie being transmitted over unencrypted HTTP connections. This security issue has been resolved in the latest v…
-
High 7.1
Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Cleartext Transmission of Sensitive Information
Lack of encryption in transit for cloud infrastructure facilitating potential for sensitive data manipulation or exposure.
-
Medium 6.5
Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to send comm…