CWE-311 · Missing Encryption of Sensitive Data (page 3)
Page 3 of 6 — CVEs classified under CWE-311, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-25842 | High | 7.5 | 2020-12-31 | The encryption function of NHIServiSignAdapter fail to verify the file path input by users. Remote attacker can access arbitrary files through the flaw without… |
CVE-2020-35587 | High | 7.5 | 2020-12-23 | In Solstice Pod before 3.0.3, the firmware can easily be decompiled/disassembled. The decompiled/disassembled files contain non-obfuscated code. NOTE: it is un… |
CVE-2019-14480 | Critical | 9.8 | 2020-12-16 | AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead to an authentication bypass or escalatio… |
CVE-2020-27055 | High | 7.5 | 2020-12-15 | In isSubmittable and showWarningMessagesIfAppropriate of WifiConfigController.java and WifiConfigController2.java, there is a possible insecure WiFi configurat… |
CVE-2020-28217 | High | 7.5 | 2020-12-11 | A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 (firmware 2.7 and older), that would allow an attacker to read network tra… |
CVE-2020-28216 | High | 7.5 | 2020-12-11 | A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 (firmware 2.7 and older), that would allow an attacker to read network tra… |
CVE-2020-4126 | Medium | 5.9 | 2020-12-01 | HCL iNotes is susceptible to a sensitive cookie exposure vulnerability. This can allow an unauthenticated remote attacker to capture the cookie by intercepting… |
CVE-2020-7567 | Medium | 5.7 | 2020-11-19 | A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to find the p… |
CVE-2020-8150 | Medium | 4.1 | 2020-11-09 | A cryptographic issue in Nextcloud Server 19.0.1 allowed an attacker to downgrade the encryption scheme and break the integrity of encrypted files. |
CVE-2020-8173 | Low | 2.2 | 2020-11-02 | A too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed decryption in shorter time than intended. |
CVE-2020-27651 | Medium | 5.8 | 2020-10-29 | Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attac… |
CVE-2020-27650 | Medium | 5.8 | 2020-10-29 | Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remo… |
CVE-2020-9774 | High | 7.5 | 2020-10-27 | An issue existed with Siri Suggestions access to encrypted data. The issue was fixed by limiting access to encrypted data. This issue is fixed in macOS Catalin… |
CVE-2020-15771 | High | 7.5 | 2020-09-18 | An issue was discovered in Gradle Enterprise 2018.2 and Gradle Enterprise Build Cache Node 4.1. Cross-site transmission of cookie containing CSRF token allows… |
CVE-2020-15767 | Medium | 5.3 | 2020-09-18 | An issue was discovered in Gradle Enterprise before 2020.2.5. The cookie used to convey the CSRF prevention token is not annotated with the “secure” attribute… |
CVE-2020-2250 | Medium | 6.5 | 2020-09-01 | Jenkins SoapUI Pro Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files on the Jenkins controller where they… |
CVE-2020-2249 | Low | 3.3 | 2020-09-01 | Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where… |
CVE-2020-2239 | Medium | 4.3 | 2020-09-01 | Jenkins Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file on the Jenkins controller where it c… |
CVE-2020-4591 | Low | 3.3 | 2020-08-28 | IBM Spectrum Protect Server 8.1.0.000 through 8.1.10.000 could disclose sensitive information in nondefault settings due to occasionally not encrypting the sec… |
CVE-2019-4686 | Medium | 5.3 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get… |
CVE-2020-3389 | Medium | 4.4 | 2020-08-26 | A vulnerability in the installation component of Cisco Hyperflex HX-Series Software could allow an authenticated, local attacker to retrieve the password that… |
CVE-2020-9062 | Medium | 5.3 | 2020-08-21 | Diebold Nixdorf ProCash 2100xe USB ATMs running Wincor Probase version 1.1.30 do not encrypt, authenticate, or verify the integrity of messages between the CCD… |
CVE-2020-10124 | High | 7.1 | 2020-08-21 | NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the integrity of messages between the BNA and the host computer, which cou… |
CVE-2020-10039 | High | 8.1 | 2020-07-14 | A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). An attacker in a privileged… |
CVE-2019-4704 | Medium | 4.3 | 2020-07-01 | IBM Security Identity Manager Virtual Appliance 7.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to ge… |
CVE-2020-12032 | Critical | 9.1 | 2020-06-29 | Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems store device data with sensitive information in an unencrypted data… |
CVE-2019-18254 | Medium | 4.6 | 2020-06-29 | BIOTRONIK CardioMessenger II, The affected products do not encrypt sensitive information while at rest. An attacker with physical access to the CardioMessenger… |
CVE-2020-10273 | High | 7.5 | 2020-06-24 | MiR controllers across firmware versions 2.8.1.1 and before do not encrypt or protect in any way the intellectual property artifacts installed in the robots. T… |
CVE-2020-4233 | Medium | 5.3 | 2020-05-28 | IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure… |
CVE-2020-12801 | Medium | 5.3 | 2020-05-18 | If LibreOffice has an encrypted document open and crashes, that document is auto-saved encrypted. On restart, LibreOffice offers to restore the document and pr… |
CVE-2020-12273 | High | 7.5 | 2020-04-27 | In TestLink 1.9.20, a crafted login.php viewer parameter exposes cleartext credentials. |
CVE-2020-10267 | High | 7.5 | 2020-04-06 | Universal Robots control box CB 3.1 across firmware versions (tested on 1.12.1, 1.12, 1.11 and 1.10) does not encrypt or protect in any way the intellectual pr… |
CVE-2019-19090 | Low | 3.5 | 2020-04-02 | For ABB eSOMS versions 4.0 to 6.0.2, the Secure Flag is not set in the HTTP response header. Unencrypted connections might access the cookie information, thus… |
CVE-2019-15653 | High | 7.5 | 2020-03-19 | Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism. The HTML source code of the login page… |
CVE-2019-4616 | Low | 3.5 | 2020-02-05 | IBM Cloud Automation Manager 3.2.1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie valu… |
CVE-2015-0558 | Medium | 5.3 | 2020-01-14 | The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6, and possibly other routers, uses "1236790" and the MAC addre… |
CVE-2012-5474 | Medium | 5.5 | 2019-12-30 | The file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release (python-django-horizon package before 2012.1.1) i… |
CVE-2019-19739 | High | 7.5 | 2019-12-30 | MFScripts YetiShare 3.5.2 through 4.5.3 does not set the Secure flag on session cookies, allowing the cookie to be sent over cleartext channels. |
CVE-2019-3431 | Critical | 9.8 | 2019-12-23 | All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have encryption problems vulnerability. Attackers could sniff unencrypted account and pass… |
CVE-2019-18833 | Medium | 5.9 | 2019-12-17 | Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information exposure (issue 2 of 2).. The encryption key of the media content which is shared be… |
CVE-2019-2231 | Medium | 4.4 | 2019-12-06 | In Blob::Blob of blob.cpp, there is a possible unencrypted master key due to improper input validation. This could lead to local information disclosure with Sy… |
CVE-2019-19464 | Medium | 5.3 | 2019-11-30 | The CBC Gem application before 9.24.1 for Android and before 9.26.0 for iOS has Unencrypted Analytics. |
CVE-2011-3355 | High | 7.3 | 2019-11-25 | evolution-data-server3 3.0.3 through 3.2.1 used insecure (non-SSL) connection when attempting to store sent email messages into the Sent folder, when the Sent… |
CVE-2019-4214 | Low | 3.7 | 2019-11-22 | IBM SmartCloud Analytics 1.3.1 through 1.3.5 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obta… |
CVE-2019-15704 | Medium | 5.5 | 2019-11-21 | A clear text storage of sensitive information vulnerability in FortiClient for Mac may allow a local attacker to read sensitive information logged in the conso… |
CVE-2019-18980 | High | 7.5 | 2019-11-14 | On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. Anyone ca… |
CVE-2010-3299 | Medium | 6.5 | 2019-11-12 | The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks. |
CVE-2010-3292 | Medium | 5.5 | 2019-11-12 | The update{_bad,}_phishing_sites scripts in mailscanner 4.79.11-2 downloads files and trusts them without using encryption (e.g., https) or digital signature c… |
CVE-2019-16210 | Medium | 5.5 | 2019-11-08 | Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save. |
CVE-2019-16206 | Medium | 5.5 | 2019-11-08 | The authentication mechanism, in Brocade SANnav versions before v2.0, logs plaintext account credentials at the ‘trace’ and the 'debug' logging level; which co… |
CVE-2019-18800 | High | 8.8 | 2019-11-06 | Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber account, because not all Viber protocol traffi… |
CVE-2019-10084 | High | 7.5 | 2019-11-05 | In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries… |
CVE-2019-11664 | Medium | 6.5 | 2019-09-18 | Clear text password in browser in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9… |
CVE-2019-11663 | Medium | 6.5 | 2019-09-18 | Clear text credentials are used to access managers app in Tomcat in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41… |
CVE-2019-4171 | Low | 3.7 | 2019-09-17 | IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 does not set the secure attribute on authorization tokens or session cookies. This could allow an atta… |
CVE-2019-9681 | Medium | 5.3 | 2019-09-17 | Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing firmware packages b… |
CVE-2019-13922 | Low | 2.7 | 2019-09-13 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). An attacker with administrative privileges can obtain the hash o… |
CVE-2019-13419 | High | 7.5 | 2019-08-13 | Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked. |
CVE-2019-13418 | High | 7.5 | 2019-08-12 | Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized. |
CVE-2019-5448 | High | 8.1 | 2019-07-30 | Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over t… |
CVE-2019-12924 | Critical | 9.8 | 2019-07-08 | MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploited by an unauthenticated user. It was po… |
CVE-2019-10103 | High | 8.1 | 2019-07-03 | JetBrains IntelliJ IDEA projects created using the Kotlin (JS Client/JVM Server) IDE Template were resolving Gradle artifacts using an http connection, potenti… |
CVE-2019-6169 | High | 7.5 | 2019-06-26 | A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow unencrypted downloads over FTP. |
CVE-2019-0307 | Low | 2.4 | 2019-06-12 | Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP Secu… |
CVE-2018-10698 | Critical | 9.8 | 2019-06-07 | An issue was discovered on Moxa AWK-3121 1.14 devices. The device enables an unencrypted TELNET service by default. This allows an attacker who has been able t… |
CVE-2018-10694 | High | 8.1 | 2019-06-07 | An issue was discovered on Moxa AWK-3121 1.14 devices. The device provides a Wi-Fi connection that is open and does not use any encryption mechanism by default… |
CVE-2018-10690 | High | 8.1 | 2019-06-07 | An issue was discovered on Moxa AWK-3121 1.14 devices. The device by default allows HTTP traffic thus providing an insecure communication mechanism for a user… |
CVE-2019-11523 | Critical | 9.8 | 2019-06-06 | Anviz Global M3 Outdoor RFID Access Control executes any command received from any source. No authentication/encryption is done. Attackers can fully interact w… |
CVE-2019-7311 | High | 7.8 | 2019-06-06 | An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. A lack of encryption in how the user login cookie (admin-auth) is stored on a victim's comp… |
CVE-2019-11367 | Critical | 9.8 | 2019-06-03 | An issue was discovered in AUO Solar Data Recorder before 1.3.0. The web portal uses HTTP Basic Authentication and provides the account and password in the WWW… |
CVE-2017-14852 | High | 8.6 | 2019-06-03 | An insecure communication was found between a user and the Orpak SiteOmat management console for all known versions, due to an invalid SSL certificate. The att… |
CVE-2019-10139 | High | 7.8 | 2019-05-17 | During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var`… |
CVE-2019-11836 | Medium | 4.6 | 2019-05-09 | The Rediffmail (aka com.rediff.mail.and) application 2.2.6 for Android has cleartext mail content in file storage, persisting after a logout. |
CVE-2018-13992 | High | 8.2 | 2019-05-07 | The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 allows for plaintext transmission (HTTP) of user credentials by default. |
CVE-2019-1692 | Medium | 5.3 | 2019-05-03 | A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) Software could allow an unauthenticated, rem… |
CVE-2019-1589 | Medium | 4.6 | 2019-05-03 | A vulnerability in the Trusted Platform Module (TPM) functionality of software for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructur… |
CVE-2019-11405 | High | 8.1 | 2019-04-22 | OpenAPI Tools OpenAPI Generator before 4.0.0-20190419.052012-560 uses http:// URLs in various build.gradle, build.gradle.mustache, and build.sbt files, which m… |
CVE-2019-11404 | High | 8.1 | 2019-04-22 | arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP instead of HTTPS. Any of these dependent… |
CVE-2018-17287 | Medium | 4.9 | 2019-04-18 | In Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as passwords, are obfuscated in the front-end, but the cleartext value c… |
CVE-2019-6526 | Critical | 9.8 | 2019-04-15 | Moxa IKS-G6824A series Versions 4.5 and prior, EDS-405A series Version 3.8 and prior, EDS-408A series Version 3.8 and prior, and EDS-510A series Version 3.8 an… |
CVE-2019-1573 | Low | 2.5 | 2019-04-09 | GlobalProtect Agent 4.1.0 for Windows and GlobalProtect Agent 4.1.10 and earlier for macOS may allow a local authenticated attacker who has compromised the end… |
CVE-2019-1003095 | Medium | 6.5 | 2019-04-04 | Jenkins Perfecto Mobile Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with acc… |
CVE-2019-1003094 | Medium | 6.5 | 2019-04-04 | Jenkins Open STF Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to… |
CVE-2019-1003089 | Medium | 6.5 | 2019-04-04 | Jenkins Upload to pgyer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Rea… |
CVE-2019-1003088 | Medium | 6.5 | 2019-04-04 | Jenkins Fabric Beta Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extend… |
CVE-2019-1003075 | High | 8.8 | 2019-04-04 | Jenkins Audit to Database Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with a… |
CVE-2019-1003074 | High | 8.8 | 2019-04-04 | Jenkins Hyper.sh Commons Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with ac… |
CVE-2019-1003073 | High | 8.8 | 2019-04-04 | Jenkins VS Team Services Continuous Deployment Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by… |
CVE-2019-1003072 | High | 8.8 | 2019-04-04 | Jenkins WildFly Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Re… |
CVE-2019-1003071 | High | 8.8 | 2019-04-04 | Jenkins OctopusDeploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with acces… |
CVE-2019-1003070 | High | 8.8 | 2019-04-04 | Jenkins veracode-scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with ac… |
CVE-2019-1003069 | High | 8.8 | 2019-04-04 | Jenkins Aqua Security Scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users wi… |
CVE-2019-1003068 | High | 8.8 | 2019-04-04 | Jenkins VMware vRealize Automation Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with E… |
CVE-2019-1003067 | High | 8.8 | 2019-04-04 | Jenkins Trac Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read… |
CVE-2019-1003066 | High | 8.8 | 2019-04-04 | Jenkins Bugzilla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to… |
CVE-2019-1003065 | High | 8.8 | 2019-04-04 | Jenkins CloudShare Docker-Machine Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by user… |
CVE-2019-1003064 | High | 8.8 | 2019-04-04 | Jenkins aws-device-farm Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with acc… |
CVE-2019-1003063 | High | 8.8 | 2019-04-04 | Jenkins Amazon SNS Build Notifier Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by user… |
CVE-2019-1003062 | High | 8.8 | 2019-04-04 | Jenkins AWS CloudWatch Logs Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by… |
CVE-2019-1003061 | High | 8.8 | 2019-04-04 | Jenkins jenkins-cloudformation-plugin Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users wit… |