CWE-311 · Missing Encryption of Sensitive Data

513 CVEs classified under CWE-311 (Missing Encryption of Sensitive Data). Browse by severity and year.

Top CVEs for CWE-311
CVESeverityScorePublishedSummary
CVE-2023-6339Critical10.02024-01-02Google Nest WiFi Pro root code-execution & user-data compromise
CVE-2026-27944Critical9.82026-03-05Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses…
CVE-2023-4420Critical9.82023-08-24A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security (TLS) in the SICK LMS…
CVE-2023-0750Critical9.82023-04-06Yellobrik PEC-1864 implements authentication checks via javascript in the frontend interface.  When the device can be accessed over the network an attacker cou…
CVE-2020-15331Critical9.82022-09-29Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded OAUTH_SECRET_KEY in /opt/axess/etc/default/axess.
CVE-2019-14480Critical9.82020-12-16AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead to an authentication bypass or escalatio…
CVE-2019-3431Critical9.82019-12-23All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have encryption problems vulnerability. Attackers could sniff unencrypted account and pass…
CVE-2019-12924Critical9.82019-07-08MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploited by an unauthenticated user. It was po…
CVE-2018-10698Critical9.82019-06-07An issue was discovered on Moxa AWK-3121 1.14 devices. The device enables an unencrypted TELNET service by default. This allows an attacker who has been able t…
CVE-2019-11523Critical9.82019-06-06Anviz Global M3 Outdoor RFID Access Control executes any command received from any source. No authentication/encryption is done. Attackers can fully interact w…
CVE-2019-11367Critical9.82019-06-03An issue was discovered in AUO Solar Data Recorder before 1.3.0. The web portal uses HTTP Basic Authentication and provides the account and password in the WWW…
CVE-2019-6526Critical9.82019-04-15Moxa IKS-G6824A series Versions 4.5 and prior, EDS-405A series Version 3.8 and prior, EDS-408A series Version 3.8 and prior, and EDS-510A series Version 3.8 an…
CVE-2018-10612Critical9.82019-01-29In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled b…
CVE-2018-16879Critical9.82019-01-03Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery worker…
CVE-2018-20100Critical9.82019-01-02An issue was discovered on August Connect devices. Insecure data transfer between the August app and August Connect during configuration allows attackers to di…
CVE-2018-17915Critical9.82018-10-10All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server do not encrypt all device communication. This includes the XMeye service and firmw…
CVE-2017-3198Critical9.82018-07-09GIGABYTE BRIX UEFI firmware does not cryptographically validate images prior to updating the system firmware. Additionally, the firmware updates are served ove…
CVE-2018-7498Critical9.82018-03-28In Philips Alice 6 System version R8.0.2 or prior, the lack of proper data encryption passes up the guarantees of confidentiality, integrity, and accountabilit…
CVE-2017-9632Critical9.82017-08-07A Missing Encryption of Sensitive Data issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWash M5, all versions, LaserWa…
CVE-2017-9854Critical9.82017-08-05An issue was discovered in SMA Solar Technology products. By sniffing for specific packets on the localhost, plaintext passwords can be obtained as they are ty…
All CVEs classified under CWE-311 — newest first (page 1 of 6)
CVESeverityScorePublishedSummary
CVE-2026-19891Low3.72026-08-15A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggre…
CVE-2026-210792026-08-10Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data.
CVE-2026-20157High7.52026-07-15As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal secur…
CVE-2025-63579High7.52026-07-09Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. The security measure that encrypts incoming dat…
CVE-2026-54784High7.42026-07-08CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation…
CVE-2026-55568Medium5.92026-06-23Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in certain configurations, traffic expected to be protected by TLS on the hop to the proxy is transmi…
CVE-2026-53442Medium5.32026-06-10Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencryp…
CVE-2026-34486High7.52026-04-09Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issu…
CVE-2026-34992High7.52026-04-06Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to 2.4.5 and 2.5.2, a missing encryption vulnerability affects inter-Node Po…
CVE-2026-32891Critical9.02026-03-20Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contai…
CVE-2026-27944Critical9.82026-03-05Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses…
CVE-2025-69969Critical9.62026-03-04A lack of authentication and authorization mechanisms in the Bluetooth Low Energy (BLE) communication protocol of SRK Powertech Pvt Ltd Pebble Prism Ultra v2.9…
CVE-2025-15548Medium6.52026-01-29Some VX800v v1.0 web interface endpoints transmit sensitive information over unencrypted HTTP due to missing application layer encryption, allowing a network a…
CVE-2025-65098High7.42026-01-22Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any…
CVE-2025-13453Medium4.62026-01-14A potential vulnerability was reported in some ThinkPlus USB drives that could allow a user with physical access to read data stored on the drive.
CVE-2025-15065Medium6.32025-12-29Exposure of Sensitive Information to an Unauthorized Actor, Missing Encryption of Sensitive Data, Files or Directories Accessible to External Parties vulnerabi…
CVE-2025-367512025-12-13Encryption is missing on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X. This allows an attacker with access to the network to intercept a…
CVE-2025-13053Low3.72025-12-12When a user configures the NAS to retrieve UPS status or control the UPS, a non-enforced TLS certificate verification can allow an attacker able to intercept n…
CVE-2025-65825Medium4.62025-12-10The firmware on the basestation of the Meatmeet is not encrypted. An adversary with physical access to the Meatmeet device can disassemble the device, connect…
CVE-2025-64147Medium4.32025-10-29Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and c…
CVE-2025-64146Medium4.32025-10-29Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with It…
CVE-2025-64145Medium4.32025-10-29Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for attackers to observe…
CVE-2025-64144Medium4.32025-10-29Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users wi…
CVE-2025-64143Medium4.32025-10-29Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can b…
CVE-2025-48981High8.62025-10-08An insecure implementation of the proprietary protocol DNET in Product CGM MEDICO allows attackers within the intranet to eavesdrop and manipulate data on the…
CVE-2025-59410Low3.72025-09-17Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the code in the scheduler for downloading a tiny file is…
CVE-2025-10227Medium4.62025-09-10Missing Encryption of Sensitive Data (CWE-311) in the Object Archive component in AxxonSoft Axxon One (C-Werk) before 2.0.8 on Windows and Linux allows a loca…
CVE-2025-31977Medium5.32025-08-28HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms.  An attacker with network access could exploit this weakness…
CVE-2025-48862High7.12025-08-14Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set…
CVE-2024-41982Medium4.82025-08-12A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO…
CVE-2024-41980Low3.12025-08-12A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO…
CVE-2025-8763Low3.72025-08-09A vulnerability was found in Ruijie EG306MG 3.0(1)B11P309. It has been rated as problematic. This issue affects some unknown processing of the file /etc/strong…
CVE-2025-45768High7.02025-07-31pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses t…
CVE-2025-43274Medium4.42025-07-30A privacy issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6. A sandboxed process may be able to circumvent sandbox…
CVE-2025-406802025-07-24Lack of sensitive data encryption in CapillaryScope v2.5.0 of Capillary io, which stores both the proxy credentials and the JWT session token in plain text wit…
CVE-2025-33020Medium5.92025-07-23IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 transmits sensitive information without encryption that could allow an attacker to obtain highl…
CVE-2025-36062Medium5.92025-07-21IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 could be vulnerable to information exposure due to the use of unencrypted network traffic.
CVE-2025-53678Medium6.52025-07-09Jenkins User1st uTester Plugin 1.1 and earlier stores the uTester JWT token unencrypted in its global configuration file on the Jenkins controller, where it ca…
CVE-2025-53676Medium6.52025-07-09Jenkins Xooa Plugin 0.0.7 and earlier stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controller, where it can be…
CVE-2025-53673Medium6.52025-07-09Jenkins Sensedia Api Platform tools Plugin 1.0 stores the Sensedia API Manager integration token unencrypted in its global configuration file on the Jenkins co…
CVE-2025-53668Medium6.52025-07-09Jenkins VAddy Plugin 1.2.8 and earlier stores Vaddy API Auth Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by us…
CVE-2025-53666Medium6.52025-07-09Jenkins Dead Man's Snitch Plugin 0.1 stores Dead Man's Snitch tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by…
CVE-2025-53663Medium6.52025-07-09Jenkins IBM Cloud DevOps Plugin 2.0.16 and earlier stores SonarQube authentication tokens unencrypted in job config.xml files on the Jenkins controller, where…
CVE-2025-53659Medium6.52025-07-09Jenkins QMetry Test Management Plugin 1.13 and earlier stores Qmetry Automation API Keys unencrypted in job config.xml files on the Jenkins controller, where t…
CVE-2025-53653Medium4.32025-07-09Jenkins Aqua Security Scanner Plugin 3.2.8 and earlier stores Scanner Tokens for Aqua API unencrypted in job config.xml files on the Jenkins controller, where…
CVE-2014-6274High7.52025-06-26git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote used encryption=pubkey or encryption=hybrid, the embedded AWS…
CVE-2025-32875Medium5.72025-06-20An issue was discovered in the COROS application through 3.8.12 for Android. Bluetooth pairing and bonding is neither initiated nor enforced by the application…
CVE-2025-24008Medium6.52025-05-13A vulnerability has been identified in SIRIUS 3RK3 Modular Safety System (MSS) (All versions), SIRIUS Safety Relays 3SK2 (All versions). The affected devices d…
CVE-2025-472742025-05-12ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Due to the ordering of code used to start an…
CVE-2023-37405Medium6.52025-03-27IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, and 2.3.4.1 stor…
CVE-2025-29314High8.12025-03-24Insecure Shiro cookie configurations in OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allow attackers to access sensitive in…
CVE-2025-12432025-02-12The Temporal api-go library prior to version 1.44.1 did not send `update response` information to Data Converter when the proxy package within the api-go modul…
CVE-2024-38325Medium5.92025-01-27IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI could allow a remote attacker to obtain sensitive information, caused by sending net…
CVE-2024-41757Medium5.92025-01-24IBM Concert Software 1.0.0 and 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transp…
CVE-2024-7142Medium4.62025-01-10On Arista CloudVision Appliance (CVA) affected releases running on appliances that support hardware disk encryption (DCA-350E-CV only), the disk encryption mig…
CVE-2024-56439High7.52025-01-08Access control vulnerability in the identity authentication module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2024-47871Critical9.12024-10-10Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves **insecure communication** between the FRP (Fast Reverse Pr…
CVE-2024-20515Medium6.52024-10-02A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive…
CVE-2023-52950Medium5.32024-09-26Missing encryption of sensitive data vulnerability in login component in Synology Active Backup for Business Agent before 2.7.0-3221 allows adjacent man-in-the…
CVE-2023-52948Medium5.02024-09-26Missing encryption of sensitive data vulnerability in settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 allows local users…
CVE-2024-42495Medium6.52024-09-05Credentials to access device configuration were transmitted using an unencrypted protocol. These credentials would allow read-only access to network configurat…
CVE-2024-20503Medium5.52024-09-04A vulnerability in Cisco Duo Epic for Hyperdrive could allow an authenticated, local attacker to view sensitive information in cleartext on an affected system…
CVE-2024-42657High7.52024-08-19An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the lack of encryption during login…
CVE-2024-40620High7.52024-08-14CVE-2024-40620 IMPACT A vulnerability exists in the affected product due to lack of encryption of sensitive information. The vulnerability results in data bei…
CVE-2024-73962024-08-05Missing encryption of sensitive data in Korenix JetPort 5601v3 allows Eavesdropping.This issue affects JetPort 5601v3: through 1.2.
CVE-2024-23444Medium4.92024-07-31It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Req…
CVE-2024-41124Medium6.32024-07-19Puncia is the Official CLI utility for Subdomain Center & Exploit Observer. `API_URLS` is utilizing HTTP instead of HTTPS for communication that can lead to is…
CVE-2024-38302Medium6.82024-07-18Dell Data Lakehouse, version(s) 1.0.0.0, contain(s) a Missing Encryption of Sensitive Data vulnerability in the DDAE (Starburst). A low privileged attacker wit…
CVE-2024-5731Medium6.82024-06-14A vulnerability in the IPS Manager, Central Manager, and Local Manager communication workflow allows an attacker to control the destination of a request by man…
CVE-2024-382832024-06-13Sensitive customer information is stored in the device without encryption.
CVE-2023-49927Medium5.32024-06-05An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, E…
CVE-2024-35061High7.32024-05-21NASA AIT-Core v2.5.2 was discovered to use unencrypted channels to exchange data over the network, allowing attackers to execute a man-in-the-middle attack. Wh…
CVE-2024-27106Medium5.72024-05-14Vulnerable data in transit in GE HealthCare EchoPAC products
CVE-2024-25027Medium6.22024-03-31IBM Security Verify Access 10.0.6 could disclose sensitive snapshot information due to missing encryption. IBM X-Force ID: 281607.
CVE-2023-35888Medium5.92024-03-20IBM Security Verify Governance 10.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Trans…
CVE-2024-28250Medium6.12024-03-18Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.8 and 1.15.2…
CVE-2024-28249Medium6.12024-03-18Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters wi…
CVE-2024-29151Critical9.12024-03-18Rocket.Chat.Audit through 5ad78e8 depends on filecachetools, which does not exist in PyPI.
CVE-2021-39090Medium5.92024-02-29IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly en…
CVE-2024-25631Medium6.12024-02-20Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who have enabled an external kvstore and Wireguard…
CVE-2024-25630Medium6.12024-02-20Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cilium state (the defau…
CVE-2024-24768Medium6.52024-02-051Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword…
CVE-2023-50129Medium6.52024-01-11Missing encryption in the NFC tags of the Flient Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity to the original tags…
CVE-2023-50126Medium6.52024-01-11Missing encryption in the RFID tags of the Hozard alarm system (Alarmsysteem) v1.0 allow attackers to create a cloned tag via brief physical proximity to one o…
CVE-2023-38267Medium6.22024-01-11IBM Security Access Manager Appliance (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could all…
CVE-2023-6339Critical10.02024-01-02Google Nest WiFi Pro root code-execution & user-data compromise
CVE-2023-33037High7.12024-01-02Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.
CVE-2023-46219Medium5.32023-12-12When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS…
CVE-2023-42019Medium5.92023-12-01 IBM InfoSphere Information Server 11.7 could allow a remote attacker to cause a denial of service due to improper input validation. IBM X-Force ID: 265161…
CVE-2023-44098High7.52023-11-08Vulnerability of missing encryption in the card management module. Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2023-33228Medium4.52023-11-01The SolarWinds Network Configuration Manager was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users with admin…
CVE-2023-41096Medium6.82023-10-26Missing Encryption of Security Keys vulnerability in Silicon Labs Ember ZNet SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or ex…
CVE-2023-41095Medium6.82023-10-26Missing Encryption of Security Keys vulnerability in Silicon Labs OpenThread SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or ext…
CVE-2023-33837Medium4.12023-10-23IBM Security Verify Governance 10.0 does not encrypt sensitive or critical information before storage or transmission. IBM X-Force ID: 256020.
CVE-2022-22386Medium5.32023-10-17 IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP St…
CVE-2022-22377Medium5.32023-10-17IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Str…
CVE-2022-33161Medium5.32023-10-14IBM Security Directory Server 6.4.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transpo…
CVE-2023-23371Medium5.22023-10-06A cleartext transmission of sensitive information vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow loc…
CVE-2023-43618Medium5.32023-09-20An issue was discovered in Croc through 9.6.5. The protocol requires a sender to provide its local IP addresses in cleartext via an ips? message.
CVE-2023-4580Medium6.52023-09-11Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information. This vulnerability…