CWE-311 · Missing Encryption of Sensitive Data (page 4)
Page 4 of 6 — CVEs classified under CWE-311, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-1003060 | High | 8.8 | 2019-04-04 | Jenkins Official OWASP ZAP Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with… |
CVE-2019-1003057 | High | 8.8 | 2019-04-04 | Jenkins Bitbucket Approve Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with a… |
CVE-2019-1003056 | High | 8.8 | 2019-04-04 | Jenkins WebSphere Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended… |
CVE-2019-1003055 | High | 8.8 | 2019-04-04 | Jenkins FTP publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with acces… |
CVE-2019-1003054 | High | 8.8 | 2019-04-04 | Jenkins Jira Issue Updater Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended… |
CVE-2019-1003053 | High | 8.8 | 2019-04-04 | Jenkins HockeyApp Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read perm… |
CVE-2019-1003052 | High | 8.8 | 2019-04-04 | Jenkins AWS Elastic Beanstalk Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed b… |
CVE-2019-1003051 | High | 8.8 | 2019-04-04 | Jenkins IRC Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the m… |
CVE-2018-17563 | Medium | 5.3 | 2019-04-01 | A Malformed Input String to /cgi-bin/api-get_line_status on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's configuration in cl… |
CVE-2019-1003048 | High | 7.8 | 2019-03-28 | A vulnerability in Jenkins PRQA Plugin 3.1.0 and earlier allows attackers with local file system access to the Jenkins home directory to obtain the unencrypted… |
CVE-2019-9862 | Medium | 6.5 | 2019-03-27 | An issue was discovered on ABUS Secvest wireless alarm system FUAA50000 3.01.01 in conjunction with Secvest remote control FUBE50014 or FUBE50015. Because "enc… |
CVE-2019-6518 | High | 7.5 | 2019-03-05 | Moxa IKS and EDS store plaintext passwords, which may allow sensitive information to be read by someone with access to the device. |
CVE-2018-1938 | Medium | 4.4 | 2019-03-05 | IBM Cloud Private 3.1.1 could alllow a local user with administrator privileges to intercept highly sensitive unencrypted data. IBM X-Force ID: 153318. |
CVE-2018-1937 | Medium | 4.4 | 2019-03-05 | IBM Cloud Private 3.1.1 could alllow a local user with administrator privileges to intercept highly sensitive unencrypted data. IBM X-Force ID: 153317. |
CVE-2018-5482 | Medium | 5.3 | 2019-03-04 | NetApp SnapCenter Server prior to 4.1 does not set the secure flag for a sensitive cookie in an HTTPS session which can allow the transmission of the cookie in… |
CVE-2018-1340 | High | 7.5 | 2019-02-07 | Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. This cookie lacked the "secure" flag, which could allow an… |
CVE-2018-10612 | Critical | 9.8 | 2019-01-29 | In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled b… |
CVE-2018-5481 | High | 7.4 | 2019-01-07 | OnCommand Unified Manager for 7-Mode (core package) prior to 5.2.4 uses cookies that lack the secure attribute in certain circumstances making it vulnerable to… |
CVE-2018-16879 | Critical | 9.8 | 2019-01-03 | Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery worker… |
CVE-2018-20100 | Critical | 9.8 | 2019-01-02 | An issue was discovered on August Connect devices. Insecure data transfer between the August app and August Connect during configuration allows attackers to di… |
CVE-2018-20465 | High | 7.2 | 2018-12-25 | Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% s… |
CVE-2018-18984 | Medium | 4.6 | 2018-12-14 | Medtronic CareLink and Encore Programmers do not encrypt or do not sufficiently encrypt sensitive PII and PHI information while at rest . |
CVE-2018-16837 | High | 7.8 | 2018-10-23 | Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials… |
CVE-2018-17915 | Critical | 9.8 | 2018-10-10 | All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server do not encrypt all device communication. This includes the XMeye service and firmw… |
CVE-2018-1683 | Medium | 5.9 | 2018-09-26 | IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by the failure to encrypt ORB communication. IBM… |
CVE-2018-3826 | Medium | 6.5 | 2018-09-19 | In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API. When the access_key and security_key parameters are set using… |
CVE-2018-6976 | Medium | 5.3 | 2018-09-11 | The VMware Content Locker for iOS prior to 4.14 contains a data protection vulnerability in the SQLite database. This vulnerability relates to unencrypted file… |
CVE-2018-6975 | Medium | 5.5 | 2018-09-11 | The AirWatch Agent for iOS prior to 5.8.1 contains a data protection vulnerability whereby the files and keychain entries in the Agent are not encrypted. |
CVE-2018-14608 | High | 7.5 | 2018-07-26 | Thomson Reuters UltraTax CS 2017 on Windows has a password protection option; however, the level of protection might be inconsistent with some customers' expec… |
CVE-2018-14607 | High | 7.5 | 2018-07-26 | Thomson Reuters UltraTax CS 2017 on Windows, in a client/server configuration, transfers customer records and bank account numbers in cleartext over SMBv2, whi… |
CVE-2017-3198 | Critical | 9.8 | 2018-07-09 | GIGABYTE BRIX UEFI firmware does not cryptographically validate images prior to updating the system firmware. Additionally, the firmware updates are served ove… |
CVE-2018-7781 | High | 8.8 | 2018-07-03 | In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, by sending a specially crafted request an authen… |
CVE-2018-4855 | Medium | 6.5 | 2018-07-03 | A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). Unencrypted storage of passwords in the client configurat… |
CVE-2018-5185 | Medium | 6.5 | 2018-06-11 | Plaintext of decrypted emails can leak through by user submitting an embedded form. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8. |
CVE-2018-5162 | High | 7.5 | 2018-06-11 | Plaintext of decrypted emails can leak through the src attribute of remote images, or links. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird… |
CVE-2017-16041 | Medium | 5.9 | 2018-06-04 | ikst versions before 1.1.2 download resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2017-16040 | High | 8.1 | 2018-06-04 | gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be poss… |
CVE-2017-16035 | High | 8.1 | 2018-06-04 | The hubl-server module is a wrapper for the HubL Development Server. During installation hubl-server downloads a set of dependencies from api.hubapi.com. It ap… |
CVE-2016-10697 | High | 8.1 | 2018-06-04 | react-native-baidu-voice-synthesizer is a baidu voice speech synthesizer for react native. react-native-baidu-voice-synthesizer downloads resources over HTTP… |
CVE-2016-10696 | High | 8.1 | 2018-06-04 | windows-latestchromedriver downloads the latest version of chromedriver.exe. windows-latestchromedriver downloads binary resources over HTTP, which leaves it v… |
CVE-2016-10695 | High | 8.1 | 2018-06-04 | The npm-test-sqlite3-trunk module provides asynchronous, non-blocking SQLite3 bindings. npm-test-sqlite3-trunk downloads binary resources over HTTP, which leav… |
CVE-2016-10694 | High | 8.1 | 2018-06-04 | alto-saxophone is a module to install and launch Chromedriver for Mac, Linux or Windows. alto-saxophone versions below 2.25.1 download binary resources over HT… |
CVE-2016-10693 | High | 8.1 | 2018-06-04 | pm2-kafka is a PM2 module that installs and runs a kafka server pm2-kafka downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It… |
CVE-2016-10691 | High | 8.1 | 2018-06-04 | windows-seleniumjar is a module that downloads the Selenium Jar file windows-seleniumjar downloads binary resources over HTTP, which leaves it vulnerable to MI… |
CVE-2016-10690 | High | 8.1 | 2018-06-04 | openframe-ascii-image module is an openframe plugin which adds support for ascii images via fim. openframe-ascii-image downloads resources over HTTP, which lea… |
CVE-2016-10689 | High | 8.1 | 2018-06-04 | The windows-iedriver module downloads fixed version of iedriverserver.exe windows-iedriver downloads binary resources over HTTP, which leaves it vulnerable to… |
CVE-2016-10688 | High | 8.1 | 2018-06-04 | Haxe 3 : The Cross-Platform Toolkit (a fork from David Mouton's damoebius/haxe-npm) haxe3 downloads resources over HTTP, which leaves it vulnerable to MITM att… |
CVE-2016-10687 | High | 8.1 | 2018-06-04 | windows-selenium-chromedriver is a module that downloads the Selenium Jar file. windows-selenium-chromedriver downloads binary resources over HTTP, which leave… |
CVE-2016-10686 | High | 8.1 | 2018-06-04 | fis-sass-all is another libsass wrapper for node. fis-sass-all downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be poss… |
CVE-2016-10685 | High | 8.1 | 2018-06-04 | pk-app-wonderbox is an integration with wonderbox pk-app-wonderbox downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be… |
CVE-2016-10684 | High | 8.1 | 2018-06-04 | healthcenter - IBM Monitoring and Diagnostic Tools health Center agent healthcenter downloads binary resources over HTTP, which leaves it vulnerable to MITM at… |
CVE-2016-10683 | High | 8.1 | 2018-06-04 | arcanist downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the… |
CVE-2016-10678 | High | 8.1 | 2018-06-04 | serc.js is a Selenium RC process wrapper serc.js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause… |
CVE-2016-10677 | High | 8.1 | 2018-06-04 | google-closure-tools-latest is a Node.js module wrapper for downloading the latest version of the Google Closure tools google-closure-tools-latest downloads bi… |
CVE-2016-10676 | High | 8.1 | 2018-06-04 | rs-brightcove is a wrapper around brightcove's web api rs-brightcove downloads source file resources over HTTP, which leaves it vulnerable to MITM attacks. It… |
CVE-2016-10675 | High | 8.1 | 2018-06-04 | libsbmlsim is a module that installs linux binaries for libsbmlsim libsbmlsim downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks… |
CVE-2016-10673 | High | 8.1 | 2018-06-04 | ipip-coffee queries geolocation information from IP ipip-coffee downloads geolocation resources over HTTP, which leaves it vulnerable to MITM attacks. This cou… |
CVE-2016-10672 | High | 8.1 | 2018-06-04 | cloudpub-redis is a module for CloudPub: Redis Backend cloudpub-redis downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may… |
CVE-2016-10671 | High | 8.1 | 2018-06-04 | mystem-wrapper is a Yandex mystem app wrapper module. mystem-wrapper downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may b… |
CVE-2016-10670 | High | 8.1 | 2018-06-04 | windows-seleniumjar-mirror downloads the Selenium Jar file windows-seleniumjar-mirror downloads binary resources over HTTP, which leaves it vulnerable to MITM… |
CVE-2016-10669 | High | 8.1 | 2018-06-04 | soci downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out… |
CVE-2016-10668 | High | 8.1 | 2018-06-04 | libsbml is a module that installs Linux binaries for libSBML libsbml downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possi… |
CVE-2016-10667 | High | 8.1 | 2018-06-04 | selenium-portal is a Selenium Testing Framework selenium-portal downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be pos… |
CVE-2016-10665 | High | 8.1 | 2018-06-04 | herbivore is a packet sniffing and crafting library. Built on libtins herbivore 0.0.3 and below download binary resources over HTTP, which leaves it vulnerable… |
CVE-2016-10664 | High | 8.1 | 2018-06-04 | mystem is a Node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem downloads binary resources over HTTP, which leaves it vulnerable to MITM at… |
CVE-2016-10663 | High | 8.1 | 2018-06-04 | wixtoolset is a Node module wrapper around the wixtoolset binaries wixtoolset downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks… |
CVE-2016-10662 | High | 8.1 | 2018-06-04 | tomita is a node wrapper for Yandex Tomita Parser tomita downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible t… |
CVE-2016-10661 | High | 8.1 | 2018-06-04 | phantomjs-cheniu is a Headless WebKit with JS API phantomjs-cheniu downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be… |
CVE-2016-10660 | High | 8.1 | 2018-06-04 | fis-parser-sass-bin a plugin for fis to compile sass using node-sass-binaries. fis-parser-sass-bin downloads binary resources over HTTP, which leaves it vulner… |
CVE-2016-10657 | High | 8.1 | 2018-06-04 | co-cli-installer downloads the co-cli module as part of the install process, but does so over HTTP, which leaves it vulnerable to MITM attacks. It may be possi… |
CVE-2016-10656 | High | 8.1 | 2018-06-04 | qbs is a build tool that helps simplify the build process for developing projects across multiple platforms. qbs downloads binary resources over HTTP, which le… |
CVE-2016-10655 | High | 8.1 | 2018-06-04 | The clang-extra module installs LLVM's clang-extra tools. clang-extra downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may… |
CVE-2016-10654 | High | 8.1 | 2018-06-04 | sfml downloads resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10653 | High | 8.1 | 2018-06-04 | xd-testing is a testing library for cross-device (XD) web applications. xd-testing downloads binary resources over HTTP, which leaves it vulnerable to MITM att… |
CVE-2016-10652 | High | 8.1 | 2018-06-04 | prebuild-lwip is a module for comprehensive, fast, and simple image processing and manipulation. prebuild-lwip downloads resources over HTTP, which leaves it v… |
CVE-2016-10651 | High | 8.1 | 2018-06-04 | webdriver-launcher is a Node.js Selenium Webdriver Launcher. webdriver-launcher downloads binary resources over HTTP, which leaves it vulnerable to MITM attack… |
CVE-2016-10649 | High | 8.1 | 2018-06-04 | frames-compiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by sw… |
CVE-2016-10648 | High | 8.1 | 2018-06-04 | marionette-socket-host is a marionette-js-runner host for sending actions over a socket. marionette-socket-host downloads binary resources over HTTP, which lea… |
CVE-2016-10647 | High | 8.1 | 2018-06-04 | node-air-sdk is an AIR SDK for nodejs. node-air-sdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cau… |
CVE-2016-10646 | High | 8.1 | 2018-06-04 | resourcehacker is a Node wrapper of Resource Hacker (windows executable resource editor). resourcehacker downloads binary resources over HTTP, which leaves it… |
CVE-2016-10645 | High | 8.1 | 2018-06-04 | grunt-images is a grunt plugin for processing images. grunt-images downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be… |
CVE-2016-10644 | High | 8.1 | 2018-06-04 | slimerjs-edge is a npm wrapper for installing the bleeding edge version of slimerjs. slimerjs-edge downloads binary resources over HTTP, which leaves it vulner… |
CVE-2016-10643 | High | 8.1 | 2018-06-04 | jstestdriver is a wrapper for Google's jstestdriver. jstestdriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be p… |
CVE-2016-10642 | High | 8.1 | 2018-06-04 | cmake installs the cmake x86 linux binaries. cmake downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to caus… |
CVE-2016-10641 | High | 8.1 | 2018-06-04 | node-bsdiff-android downloads resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10640 | High | 8.1 | 2018-06-04 | node-thulac is a node binding for thulac. node-thulac downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to c… |
CVE-2016-10639 | High | 8.1 | 2018-06-04 | redis-srvr is a npm wrapper for redis-server. redis-srvr downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible t… |
CVE-2016-10638 | High | 8.1 | 2018-06-04 | js-given is a JavaScript frontend to jgiven. js-given downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to c… |
CVE-2016-10637 | High | 8.1 | 2018-06-04 | haxe-dev is a cross-platform toolkit. haxe-dev downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause re… |
CVE-2016-10636 | High | 8.1 | 2018-06-04 | grunt-ccompiler is a Closure Compiler Grunt Plugin. grunt-ccompiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be… |
CVE-2016-10634 | High | 8.1 | 2018-06-01 | scala-standalone-bin is a Binary wrapper for ScalaJS. scala-standalone-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It… |
CVE-2016-10633 | High | 8.1 | 2018-06-01 | dwebp-bin is a dwebp node.js wrapper that convert WebP into PNG. dwebp-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It… |
CVE-2016-10632 | High | 8.1 | 2018-06-01 | apk-parser2 is a module which extracts Android Manifest info from an APK file. apk-parser2 downloads binary resources over HTTP, which leaves it vulnerable to… |
CVE-2016-10631 | High | 8.1 | 2018-06-01 | jvminstall is a module for downloading and unpacking jvm to local system. jvminstall downloads binary resources over HTTP, which leaves it vulnerable to MITM a… |
CVE-2016-10630 | Medium | 5.9 | 2018-06-01 | install-g-test downloads resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10629 | High | 8.1 | 2018-06-01 | nw-with-arm is a NW Installer including ARM-Build. nw-with-arm downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be poss… |
CVE-2016-10628 | High | 8.1 | 2018-06-01 | selenium-wrapper is a selenium server wrapper, including installation and chrome webdriver. selenium-wrapper downloads binary resources over HTTP, which leaves… |
CVE-2016-10626 | High | 8.1 | 2018-06-01 | mystem3 is a NodeJS wrapper for the Yandex MyStem 3. mystem3 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possib… |
CVE-2016-10625 | High | 8.1 | 2018-06-01 | headless-browser-lite is a minimal npm installer for phantomjs and slimerjs with no external dependencies. headless-browser-lite downloads binary resources ove… |
CVE-2016-10624 | High | 8.1 | 2018-06-01 | selenium-chromedriver is a simple utility for downloading the Selenium Webdriver for Google Chrome selenium-chromedriver downloads binary resources over HTTP… |