CWE-311 · Missing Encryption of Sensitive Data (page 2)
Page 2 of 6 — CVEs classified under CWE-311, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-22401 | Medium | 5.9 | 2023-09-08 | IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather or persuade a naive user to supply sensitive information. IBM X-Force ID: 222567. |
CVE-2022-22405 | Medium | 5.9 | 2023-09-08 | IBM Aspera Faspex 5.0.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security… |
CVE-2023-33833 | Low | 2.9 | 2023-08-31 | IBM Security Verify Information Queue 10.0.4 and 10.0.5 stores sensitive information in plain clear text which can be read by a local user. IBM X-Force ID: 2… |
CVE-2023-4420 | Critical | 9.8 | 2023-08-24 | A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security (TLS) in the SICK LMS… |
CVE-2023-40251 | Medium | 5.2 | 2023-08-17 | Missing Encryption of Sensitive Data vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allo… |
CVE-2023-4384 | Low | 3.7 | 2023-08-16 | A vulnerability has been found in MaximaTech Portal Executivo 21.9.1.140 and classified as problematic. This vulnerability affects unknown code of the componen… |
CVE-2023-39843 | Low | 2.4 | 2023-08-15 | Missing encryption in the RFID tag of Suleve 5-in-1 Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity to the original d… |
CVE-2023-39842 | Low | 2.4 | 2023-08-15 | Missing encryption in the RFID tag of Digoo DG-HAMB Smart Home Security System v1.0 allows attackers to create a cloned tag via brief physical proximity to the… |
CVE-2023-39841 | Medium | 4.6 | 2023-08-15 | Missing encryption in the RFID tag of Etekcity 3-in-1 Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity to the original… |
CVE-2023-39954 | Low | 3.8 | 2023-08-10 | user_oidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, an attacke… |
CVE-2023-37858 | Medium | 4.9 | 2023-08-09 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cry… |
CVE-2023-38699 | Critical | 9.1 | 2023-08-04 | MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False`… |
CVE-2023-38688 | High | 7.5 | 2023-08-04 | twitch-tui provides Twitch chat in a terminal. Prior to version 2.4.1, the connection is not using TLS for communication. In the configuration of the irc conne… |
CVE-2023-30561 | Medium | 6.1 | 2023-07-13 | The data flowing between the PCU and its modules is insecure. A threat actor with physical access could potentially read or modify data by attaching a speciall… |
CVE-2023-31825 | High | 7.5 | 2023-07-13 | An issue found in Inageya v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Inageya functio… |
CVE-2023-31822 | High | 7.5 | 2023-07-13 | An issue found in Entetsu Store v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Entetsu S… |
CVE-2023-31820 | High | 7.5 | 2023-07-13 | An issue found in Shizutetsu Store v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp functi… |
CVE-2023-31819 | High | 7.5 | 2023-07-13 | An issue found in KEISEI STORE Co, Ltd. LIVRE KEISEI v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in… |
CVE-2023-37943 | Medium | 5.9 | 2023-07-12 | Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory u… |
CVE-2023-37192 | High | 7.5 | 2023-07-07 | Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, potentially allowing… |
CVE-2023-33849 | Low | 3.7 | 2023-06-07 | IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 could transmit sensitive information in query parameters… |
CVE-2023-34258 | High | 7.5 | 2023-05-31 | An issue was discovered in BMC Patrol before 22.1.00. The agent's configuration can be remotely queried. This configuration contains the Patrol account passwor… |
CVE-2023-28045 | Medium | 6.3 | 2023-05-19 | Dell CloudIQ Collector version 1.10.2 contains a missing encryption of sensitive data vulnerability. An attacker with low privileges could potentially exploit… |
CVE-2023-32982 | Medium | 4.3 | 2023-05-16 | Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier stores extra variables unencrypted in job config.xml files on the Jenkins controller where they can be vi… |
CVE-2023-21404 | Medium | 5.3 | 2023-05-08 | AXIS OS 11.0.X - 11.3.x use a static RSA key in legacy LUA-components to protect Axis-specific source code. The static RSA key is not used in any other secure… |
CVE-2023-32290 | High | 7.5 | 2023-05-07 | The myMail app through 14.30 for iOS sends cleartext credentials in a situation where STARTTLS is expected by a server. |
CVE-2023-22948 | Medium | 4.9 | 2023-04-13 | An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is unsecured read access to an SSH private key. Any code that runs as the tigergraph u… |
CVE-2023-30523 | Medium | 4.3 | 2023-04-12 | Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller as part of its con… |
CVE-2023-0750 | Critical | 9.8 | 2023-04-06 | Yellobrik PEC-1864 implements authentication checks via javascript in the frontend interface. When the device can be accessed over the network an attacker cou… |
CVE-2023-28841 | Medium | 6.8 | 2023-04-04 | Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream pro… |
CVE-2023-28999 | Medium | 6.9 | 2023-04-04 | Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS… |
CVE-2022-38458 | Medium | 6.5 | 2023-03-21 | A cleartext transmission vulnerability exists in the Remote Management functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted man-in-the-midd… |
CVE-2022-21940 | High | 7.5 | 2023-02-09 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and v… |
CVE-2023-0690 | Medium | 5.0 | 2023-02-08 | HashiCorp Boundary from 0.10.0 through 0.11.2 contain an issue where when using a PKI-based worker with a Key Management Service (KMS) defined in the configura… |
CVE-2023-23127 | Medium | 5.3 | 2023-02-01 | In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS. NOTE: the vendor's position is that, by d… |
CVE-2022-47715 | Medium | 5.3 | 2023-02-01 | In Last Yard 22.09.8-1, the cookie can be stolen via via unencrypted traffic. |
CVE-2018-25060 | Low | 3.7 | 2022-12-30 | A vulnerability was found in Macaron csrf and classified as problematic. Affected by this issue is some unknown functionality of the file csrf.go. The manipula… |
CVE-2021-4239 | High | 7.5 | 2022-12-27 | The Noise protocol implementation suffers from weakened cryptographic security after encrypting 2^64 messages, and a potential denial of service attack. After… |
CVE-2022-38658 | High | 7.7 | 2022-12-24 | BigFix deployments that have installed the Notification Service on Windows are susceptible to disclosing SMTP BigFix operator's sensitive data in clear text. O… |
CVE-2022-4683 | Medium | 6.5 | 2022-12-23 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4409 | High | 7.5 | 2022-12-11 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9. |
CVE-2022-3781 | Medium | 6.5 | 2022-11-01 | Dashlane password and Keepass Server password in My Account Settings are not encrypted in the database in Devolutions Remote Desktop Manager 2022.2.26 and pri… |
CVE-2022-40295 | Medium | 4.9 | 2022-10-31 | The application was vulnerable to an authenticated information disclosure, allowing administrators to view unsalted user passwords, which could lead to the com… |
CVE-2022-41627 | Medium | 4.8 | 2022-10-27 | The physical IoT device of the AliveCor's KardiaMobile, a smartphone-based personal electrocardiogram (EKG) has no encryption for its data-over-sound protocol… |
CVE-2022-35860 | Medium | 6.8 | 2022-10-19 | Missing AES encryption in Corsair K63 Wireless 3.1.3 allows physically proximate attackers to inject and sniff keystrokes via 2.4 GHz radio transmissions. |
CVE-2020-15346 | Medium | 5.3 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a /live/GLOBALS API with the CLOUDCNM key. |
CVE-2020-15345 | Medium | 5.3 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_get_instances_for_update API. |
CVE-2020-15344 | Medium | 5.3 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_get_user_id_and_key API. |
CVE-2020-15343 | Medium | 5.3 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_install_user_key API. |
CVE-2020-15342 | Medium | 5.3 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_install_user API. |
CVE-2020-15340 | High | 7.5 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded opt/axess/AXAssets/default_axess/axess/TR69/Handlers/turbolink/sshkeys/id_rsa SSH key. |
CVE-2020-15331 | Critical | 9.8 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded OAUTH_SECRET_KEY in /opt/axess/etc/default/axess. |
CVE-2020-15330 | Medium | 5.3 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded APP_KEY in /opt/axess/etc/default/axess. |
CVE-2022-3251 | Medium | 5.3 | 2022-09-21 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/minarca prior to 4.2.2. |
CVE-2022-3250 | Medium | 5.3 | 2022-09-21 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.6. |
CVE-2022-39014 | Medium | 5.3 | 2022-09-13 | Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console (CMC) - version 430, allows an attacker to access certai… |
CVE-2022-3174 | High | 7.5 | 2022-09-13 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2. |
CVE-2022-26390 | Medium | 4.2 | 2022-09-09 | The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypt… |
CVE-2022-38194 | Medium | 6.7 | 2022-08-16 | In Esri Portal for ArcGIS versions 10.8.1, a system property is not properly encrypted. This may lead to a local user reading sensitive information from a prop… |
CVE-2022-34307 | Medium | 4.3 | 2022-08-01 | IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http… |
CVE-2020-35168 | Medium | 4.7 | 2022-07-11 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vul… |
CVE-2015-3207 | Medium | 5.3 | 2022-07-07 | In Openshift Origin 3 the cookies being set in console have no 'secure', 'HttpOnly' attributes. |
CVE-2021-40642 | Medium | 4.3 | 2022-06-29 | Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via textpattern/lib/txplib_misc.php… |
CVE-2022-31085 | Medium | 6.1 | 2022-06-27 | LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the… |
CVE-2021-40650 | Medium | 6.5 | 2022-06-14 | In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the secure flag set. |
CVE-2022-30237 | High | 8.2 | 2022-06-02 | A CWE-311: Missing Encryption of Sensitive Data vulnerability exists that could allow authentication credentials to be recovered when an attacker breaks the en… |
CVE-2021-27783 | Medium | 6.8 | 2022-05-25 | User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed. |
CVE-2021-27779 | Critical | 9.1 | 2022-05-25 | VersionVault Express exposes sensitive information that an attacker can use to impersonate the server or eavesdrop on communications with the server. |
CVE-2022-24045 | Medium | 6.5 | 2022-05-20 | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions <… |
CVE-2021-27764 | High | 7.4 | 2022-05-06 | Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI) |
CVE-2022-26281 | High | 7.5 | 2022-04-05 | BigAnt Server v5.6.06 was discovered to contain an incorrect access control issue. |
CVE-2022-27225 | Medium | 6.5 | 2022-03-16 | Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It uses Keycloak for identity management services. During the sign-… |
CVE-2021-37209 | Medium | 6.7 | 2022-03-08 | A vulnerability has been identified in RUGGEDCOM i800 (All versions < V4.3.8), RUGGEDCOM i801 (All versions < V4.3.8), RUGGEDCOM i802 (All versions < V4.3.8)… |
CVE-2022-26157 | Medium | 5.3 | 2022-02-28 | An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. The ASP.NET_Sessionid cookie is not protected by the Secure flag. T… |
CVE-2021-21963 | Medium | 5.9 | 2022-02-04 | An information disclosure vulnerability exists in the Web Server functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted man-in-th… |
CVE-2022-0183 | Medium | 4.6 | 2022-01-17 | Missing encryption of sensitive data vulnerability in 'MIRUPASS' PW10 firmware all versions and 'MIRUPASS' PW20 firmware all versions allows an attacker who ca… |
CVE-2022-23116 | High | 7.5 | 2022-01-12 | Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to decrypt secrets stored in Jen… |
CVE-2020-9058 | High | 8.1 | 2022-01-10 | Z-Wave devices based on Silicon Labs 500 series chipsets using CRC-16 encapsulation, including but likely not limited to the Linear LB60Z-1 version 3.5, Dome D… |
CVE-2020-9057 | High | 8.8 | 2022-01-10 | Z-Wave devices based on Silicon Labs 100, 200, and 300 series chipsets do not support encryption, allowing an attacker within radio range to take control of or… |
CVE-2021-37189 | High | 7.5 | 2021-12-10 | An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4. They do not set the Secure attribute for sensitive cookies in HTTPS sessions, which… |
CVE-2021-36189 | Medium | 6.8 | 2021-12-09 | A missing encryption of sensitive data in Fortinet FortiClientEMS version 7.0.1 and below, version 6.4.4 and below allows attacker to information disclosure vi… |
CVE-2021-37050 | High | 7.5 | 2021-12-08 | There is a Missing sensitive data encryption vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentialit… |
CVE-2021-38977 | Medium | 4.3 | 2021-11-15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able t… |
CVE-2021-40366 | High | 7.4 | 2021-11-09 | A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.42), Climatix POL909 (AWM module) (All versions < V11.34). The web serv… |
CVE-2021-35236 | Low | 3.1 | 2021-10-27 | The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie… |
CVE-2021-29883 | Medium | 4.3 | 2021-10-21 | IBM Standards Processing Engine (IBM Transformation Extender Advanced 9.0 and 10.0) does not set the secure attribute on authorization tokens or session cookie… |
CVE-2021-28496 | Medium | 5.7 | 2021-10-21 | On systems running Arista EOS and CloudEOS with the affected release version, when using shared secret profiles the password configured for use by BiDirectiona… |
CVE-2021-31386 | Medium | 5.3 | 2021-10-19 | A Protection Mechanism Failure vulnerability in the J-Web HTTP service of Juniper Networks Junos OS allows a remote unauthenticated attacker to perform Person-… |
CVE-2021-3882 | Medium | 6.8 | 2021-10-14 | LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy… |
CVE-2021-41302 | High | 7.3 | 2021-09-30 | ECOA BAS controller stores sensitive data (backup exports) in clear-text, thus the unauthenticated attacker can remotely query user password and obtain user’s… |
CVE-2021-22932 | High | 7.5 | 2021-08-16 | An issue has been identified in the CTX269106 mitigation tool for Citrix ShareFile storage zones controller which causes the ShareFile file encryption option t… |
CVE-2021-32001 | Medium | 6.5 | 2021-07-28 | K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material… |
CVE-2021-33900 | High | 7.5 | 2021-07-26 | While investigating DIRSTUDIO-1219 it was noticed that configured StartTLS encryption was not applied when any SASL authentication mechanism (DIGEST-MD5, GSSAP… |
CVE-2021-22782 | Medium | 5.5 | 2021-07-14 | Missing Encryption of Sensitive Data vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro)… |
CVE-2021-20567 | Medium | 4.4 | 2021-06-16 | IBM Resilient SOAR V38.0 could allow a local privileged attacker to obtain sensitive information due to improper or nonexisting encryption.IBM X-Force ID: 1992… |
CVE-2019-4471 | Medium | 6.5 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for a sensitive… |
CVE-2021-29248 | Medium | 5.3 | 2021-05-05 | BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the Secure flag for a cookie. |
CVE-2020-29024 | Medium | 5.3 | 2021-02-16 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in (GTA) GoToAppliance of Secomea GateManager could allow an attacker to gain access… |
CVE-2020-26732 | High | 7.5 | 2021-01-14 | SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session, which makes it eas… |
CVE-2018-19944 | High | 7.5 | 2020-12-31 | A cleartext transmission of sensitive information vulnerability has been reported to affect certain QTS devices. If exploited, this vulnerability allows a remo… |