CWE-311 · Missing Encryption of Sensitive Data (page 5)
Page 5 of 6 — CVEs classified under CWE-311, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-10623 | High | 8.1 | 2018-06-01 | macaca-chromedriver-zxa is a Node.js wrapper for the selenium chromedriver. macaca-chromedriver-zxa downloads binary resources over HTTP, which leaves it vulne… |
CVE-2016-10622 | High | 8.1 | 2018-06-01 | nodeschnaps is a NodeJS compatibility layer for Java (Rhino). nodeschnaps downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It… |
CVE-2016-10621 | High | 8.1 | 2018-06-01 | fibjs is a runtime for javascript applictions built on google v8 JS. fibjs downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It… |
CVE-2016-10620 | High | 8.1 | 2018-06-01 | atom-node-module-installer installs node modules for atom-shell applications. atom-node-module-installer binary resources over HTTP, which leaves it vulnerable… |
CVE-2016-10619 | High | 8.1 | 2018-06-01 | pennyworth is a natural language templating engine. pennyworth downloads data resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10618 | High | 8.1 | 2018-06-01 | node-browser is a wrapper webdriver by nodejs. node-browser downloads resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10617 | High | 8.1 | 2018-06-01 | box2d-native downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapp… |
CVE-2016-10616 | High | 8.1 | 2018-06-01 | openframe-image is an Openframe extension which adds support for images via fbi. openframe-image downloads data resources over HTTP, which leaves it vulnerable… |
CVE-2016-10615 | High | 8.1 | 2018-06-01 | curses is bindings for the native curses library, a full featured console IO library. curses downloads binary resources over HTTP, which leaves it vulnerable t… |
CVE-2016-10614 | High | 8.1 | 2018-06-01 | httpsync is a port of libcurl to node.js. httpsync downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to caus… |
CVE-2016-10613 | Medium | 5.9 | 2018-06-01 | bionode-sra is a Node.js wrapper for SRA Toolkit. bionode-sra downloads data resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10612 | High | 8.1 | 2018-06-01 | dalek-browser-ie-canary is Internet Explorer bindings for DalekJS. dalek-browser-ie-canary downloads binary resources over HTTP, which leaves it vulnerable to… |
CVE-2016-10610 | High | 8.1 | 2018-06-01 | unicode-json is a unicode lookup table. unicode-json before 2.0.0 downloads data resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10609 | High | 8.1 | 2018-06-01 | chromedriver126 is chromedriver version 1.26 for linux OS. chromedriver126 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It… |
CVE-2016-10608 | High | 7.5 | 2018-06-01 | robot-js is a module for native system automation for node.js. robot-js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It ma… |
CVE-2016-10607 | High | 8.1 | 2018-06-01 | openframe-glsviewer is a Openframe extension which adds support for shaders via glslViewer. openframe-glsviewer downloads binary resources over HTTP, which lea… |
CVE-2016-10606 | High | 8.1 | 2018-06-01 | grunt-webdriver-qunit is a grunt plugin to run qunit with webdriver in grunt grunt-webdriver-qunit downloads binary resources over HTTP, which leaves it vulner… |
CVE-2016-10605 | High | 8.1 | 2018-06-01 | dalek-browser-ie is Internet Explorer bindings for DalekJS. dalek-browser-ie downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks… |
CVE-2016-10604 | High | 8.1 | 2018-06-01 | dalek-browser-chrome is Google Chrome bindings for DalekJS. dalek-browser-chrome downloads binary resources over HTTP, which leaves it vulnerable to MITM attac… |
CVE-2016-10603 | High | 8.1 | 2018-06-01 | air-sdk is a NPM wrapper for the Adobe AIR SDK. air-sdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to… |
CVE-2016-10602 | High | 8.1 | 2018-06-01 | haxe is a cross-platform toolkit haxe downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code… |
CVE-2016-10600 | High | 8.1 | 2018-06-01 | webrtc-native uses WebRTC from chromium project. webrtc-native downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be poss… |
CVE-2016-10599 | High | 8.1 | 2018-06-01 | sauce-connect is a Node.js wrapper over the SauceLabs SauceConnect.jar program for establishing a secure tunnel for intranet testing. sauce-connect downloads b… |
CVE-2016-10598 | High | 7.5 | 2018-06-01 | arrayfire-js is a module for ArrayFire for the Node.js platform. arrayfire-js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks… |
CVE-2016-10597 | Medium | 5.9 | 2018-06-01 | cobalt-cli downloads resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10596 | High | 8.1 | 2018-06-01 | imageoptim is a Node.js wrapper for some images compression algorithms. imageoptim downloads zipped resources over HTTP, which leaves it vulnerable to MITM att… |
CVE-2016-10595 | High | 8.1 | 2018-06-01 | jdf-sass is a fork from node-sass, jdf use only. jdf-sass downloads executable resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possi… |
CVE-2016-10594 | High | 8.1 | 2018-06-01 | ipip is a Node.js module to query geolocation information for an IP or domain, based on database by ipip.net. ipip downloads data resources over HTTP, which le… |
CVE-2016-10592 | High | 8.1 | 2018-06-01 | jser-stat is a JSer.info stat library. jser-stat downloads data resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10588 | High | 8.1 | 2018-06-01 | nw is an installer for nw.js. nw downloads zipped resources over HTTP, It may be possible to cause remote code execution (RCE) by swapping out the requested zi… |
CVE-2016-10587 | High | 8.1 | 2018-06-01 | wasdk is a toolkit for creating WebAssembly modules. wasdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible… |
CVE-2016-10585 | High | 8.1 | 2018-06-01 | libxl provides Node bindings for the libxl library for reading and writing excel (XLS and XLSX) spreadsheets. libxl downloads zipped resources over HTTP, which… |
CVE-2016-10582 | High | 8.1 | 2018-06-01 | closurecompiler is a Closure Compiler for node.js. closurecompiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be… |
CVE-2016-10581 | High | 8.1 | 2018-06-01 | Steroids is PhoneGap on Steroids, providing native UI elements, multiple WebViews and enhancements for better developer productivity. steroids downloads zipped… |
CVE-2016-10580 | High | 8.1 | 2018-06-01 | nodewebkit is an installer for node-webkit. nodewebkit downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to… |
CVE-2016-10579 | High | 8.1 | 2018-06-01 | Chromedriver is an NPM wrapper for selenium ChromeDriver. Chromedriver before 2.26.1 downloads binary resources over HTTP, which leaves it vulnerable to MITM a… |
CVE-2016-10576 | High | 8.1 | 2018-06-01 | Fuseki server wrapper and management API in fuseki before 1.0.1 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be pos… |
CVE-2016-10575 | High | 8.1 | 2018-06-01 | Kindlegen is a simple Node.js wrapper of the official kindlegen program. Kindlegen versions before 1.1.0 download binary resources over HTTP, which leaves it v… |
CVE-2016-10574 | High | 8.1 | 2018-06-01 | apk-parser3 is a module to extract Android Manifest info from an APK file. apk-parser3 versions before 0.1.3 download binary resources over HTTP, which leaves… |
CVE-2016-10572 | High | 8.1 | 2018-05-31 | mongodb-instance before 0.0.3 installs mongodb locally. mongodb-instance downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It m… |
CVE-2016-10571 | High | 8.1 | 2018-05-31 | bkjs-wand is imagemagick wand support for node.js and backendjs bkjs-wand versions lower than 0.3.2 download binary resources over HTTP, which leaves it vulner… |
CVE-2016-10569 | High | 8.1 | 2018-05-31 | embedza is a module to create HTML snippets/embeds from URLs using info from oEmbed, Open Graph, meta tags. embedza versions below 1.2.4 download JavaScript re… |
CVE-2016-10565 | High | 8.1 | 2018-05-31 | operadriver is a Opera Driver for Selenium. operadriver versions below 0.2.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. I… |
CVE-2016-10564 | High | 8.1 | 2018-05-31 | apk-parser is a tool to extract Android Manifest info from an APK file. apk-parser versions below 0.1.6 download binary resources over HTTP, which leaves it vu… |
CVE-2016-10563 | High | 8.1 | 2018-05-31 | During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise the… |
CVE-2016-10562 | High | 8.1 | 2018-05-31 | iedriver is an NPM wrapper for Selenium IEDriver. iedriver versions below 3.0.0 download binary resources over HTTP, which leaves the module vulnerable to MITM… |
CVE-2016-10560 | High | 8.1 | 2018-05-31 | galenframework-cli is the node wrapper for the Galen Framework. galenframework-cli below 2.3.1 download binary resources over HTTP, which leaves it vulnerable… |
CVE-2016-10557 | High | 8.1 | 2018-05-31 | appium-chromedriver is a Node.js wrapper around Chromedriver. Versions below 2.9.4 download binary resources over HTTP, which leaves the module vulnerable to M… |
CVE-2016-10552 | High | 7.4 | 2018-05-31 | igniteui 0.0.5 and earlier downloads JavaScript and CSS resources over insecure protocol. |
CVE-2017-16003 | High | 8.1 | 2018-05-29 | windows-build-tools is a module for installing C++ Build Tools for Windows using npm. windows-build-tools versions below 1.0.0 download resources over HTTP, wh… |
CVE-2016-10698 | High | 8.1 | 2018-05-29 | mystem-fix is a node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem-fix downloads binary resources over HTTP, which leaves it vulnerable to… |
CVE-2016-10682 | High | 8.1 | 2018-05-29 | massif is a Phantomjs fork massif downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution… |
CVE-2016-10681 | High | 8.1 | 2018-05-29 | roslib-socketio - The standard ROS Javascript Library fork for add support to socket.io roslib-socketio downloads binary resources over HTTP, which leaves it v… |
CVE-2016-10680 | High | 8.1 | 2018-05-29 | adamvr-geoip-lite is a light weight native JavaScript implementation of GeoIP API from MaxMind adamvr-geoip-lite downloads geoip resources over HTTP, which lea… |
CVE-2016-10679 | High | 8.1 | 2018-05-29 | selenium-standalone-painful installs a start-selenium command line to start a standalone selenium server with chrome-driver. selenium-standalone-painful downlo… |
CVE-2016-10674 | High | 8.1 | 2018-05-29 | limbus-buildgen is a "build anywhere" build system. limbus-buildgen versions below 0.1.1 download binary resources over HTTP, which leaves it vulnerable to MIT… |
CVE-2016-10666 | High | 8.1 | 2018-05-29 | tomita-parser is a Node wrapper for Yandex Tomita Parser tomita-parser downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may… |
CVE-2016-10659 | High | 8.1 | 2018-05-29 | poco - The POCO libraries, downloads source file resources used for compilation over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to ca… |
CVE-2016-10658 | High | 8.1 | 2018-05-29 | native-opencv is the OpenCV library installed via npm native-opencv downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be… |
CVE-2016-10650 | High | 8.1 | 2018-05-29 | ntfserver is a Network Testing Framework Server. ntfserver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible… |
CVE-2016-10635 | High | 8.1 | 2018-05-29 | broccoli-closure is a Closure compiler plugin for Broccoli. broccoli-closure before 1.3.1 downloads binary resources over HTTP, which leaves it vulnerable to M… |
CVE-2016-10627 | High | 8.1 | 2018-05-29 | scala-bin is a binary wrapper for Scala. scala-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to caus… |
CVE-2016-10611 | High | 8.1 | 2018-05-29 | strider-sauce is Sauce Labs / Selenium support for Strider. strider-sauce downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It… |
CVE-2016-10601 | High | 8.1 | 2018-05-29 | webdrvr is a npm wrapper for Selenium Webdriver including Chromedriver / IEDriver / IOSDriver / Ghostdriver. webdrvr downloads binary resources over HTTP, whic… |
CVE-2016-10593 | High | 8.1 | 2018-05-29 | ibapi is an Interactive Brokers API addon for NodeJS. ibapi downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. Before 2.5.6, it… |
CVE-2016-10591 | High | 8.1 | 2018-05-29 | Prince is a Node API for executing XML/HTML to PDF renderer PrinceXML via prince(1) CLI. prince downloads zipped resources over HTTP, which leaves it vulnerabl… |
CVE-2016-10590 | High | 8.1 | 2018-05-29 | cue-sdk-node is a Corsair Cue SDK wrapper for node.js. cue-sdk-node downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be… |
CVE-2016-10589 | High | 8.1 | 2018-05-29 | selenium-binaries downloads Selenium related binaries for your OS. selenium-binaries downloads binary resources over HTTP, which leaves it vulnerable to MITM a… |
CVE-2016-10586 | High | 8.1 | 2018-05-29 | macaca-chromedriver is a Node.js wrapper for the selenium chromedriver. macaca-chromedriver before 1.0.29 downloads binary resources over HTTP, which leaves it… |
CVE-2016-10584 | High | 8.1 | 2018-05-29 | dalek-browser-chrome-canary provides Google Chrome bindings for DalekJS. dalek-browser-chrome-canary downloads binary resources over HTTP, which leaves it vuln… |
CVE-2016-10578 | High | 8.1 | 2018-05-29 | unicode loads unicode data downloaded from unicode.org into nodejs. Unicode before 9.0.0 downloads binary resources over HTTP, which leaves it vulnerable to MI… |
CVE-2016-10577 | High | 8.1 | 2018-05-29 | ibm_db is an asynchronous/synchronous interface for node.js to IBM DB2 and IBM Informix. ibm_db before 1.0.2 downloads binary resources over HTTP, which leaves… |
CVE-2016-10573 | High | 8.1 | 2018-05-29 | baryton-saxophone is a module to install and launch Selenium Server for Mac, Linux and Windows. baryton-saxophone versions below 3.0.1 download binary resource… |
CVE-2016-10570 | High | 8.1 | 2018-05-29 | pngcrush-installer is an installer for Pngcrush. pngcrush-installer versions below 1.8.10 download binary resources over HTTP, which leaves it vulnerable to MI… |
CVE-2016-10568 | High | 8.1 | 2018-05-29 | geoip-lite-country is a stripped down version of geoip-lite, supporting only country lookup. geoip-lite-country before 1.1.4 downloads data resources over HTTP… |
CVE-2016-10567 | High | 8.1 | 2018-05-29 | product-monitor is a HTML/JavaScript template for monitoring a product by encouraging product developers to gather all the information about the status of a pr… |
CVE-2016-10566 | High | 8.1 | 2018-05-29 | install-nw is a module which quickly and robustly installs and caches NW.js. install-nw versions below 1.1.5 download binary resources over HTTP, which leaves… |
CVE-2016-10559 | High | 8.1 | 2018-05-29 | selenium-download downloads the latest versions of the selenium standalone server and the chromedriver. selenium-download before 2.0.7 downloads binary resourc… |
CVE-2016-10558 | High | 8.1 | 2018-05-29 | aerospike is an Aerospike add-on module for Node.js. aerospike versions below 2.4.2 download binary resources over HTTP, which leaves the module vulnerable to… |
CVE-2018-8864 | Low | 3.1 | 2018-05-25 | In ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, and ALERT4000) devices, a missing encryption of sensitive data vulnerability caused… |
CVE-2018-6674 | Medium | 6.8 | 2018-05-25 | Privilege Escalation vulnerability in Microsoft Windows client (McTray.exe) in McAfee VirusScan Enterprise (VSE) 8.8 prior to Patch 13 allows local users to sp… |
CVE-2018-8849 | Medium | 4.6 | 2018-05-18 | Medtronic N'Vision Clinician Programmer 8840 N'Vision Clinician Programme and 8870 N'Vision removable Application Card do not encrypt PII and PHI while at rest. |
CVE-2018-10825 | Medium | 5.3 | 2018-05-15 | Mimo Baby 2 devices do not use authentication or encryption for the Bluetooth Low Energy (BLE) communication from a Turtle to a Lilypad, which allows attackers… |
CVE-2017-14012 | Medium | 4.6 | 2018-05-01 | Boston Scientific ZOOM LATITUDE PRM Model 3120 does not encrypt PHI at rest. CVSS v3 base score: 4.6; CVSS vector string: AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. |
CVE-2017-12716 | Medium | 6.5 | 2018-04-25 | Abbott Laboratories Accent and Anthem pacemakers manufactured prior to Aug 28, 2017 transmit unencrypted patient information via RF communications to programme… |
CVE-2018-4847 | Medium | 4.6 | 2018-04-23 | A vulnerability has been identified in SIMATIC WinCC OA Operator iOS App (All versions < V1.4). Insufficient protection of sensitive information (e.g. session… |
CVE-2018-7498 | Critical | 9.8 | 2018-03-28 | In Philips Alice 6 System version R8.0.2 or prior, the lack of proper data encryption passes up the guarantees of confidentiality, integrity, and accountabilit… |
CVE-2017-5251 | High | 8.1 | 2018-02-22 | In version 1012 and prior of Insteon's Insteon Hub, the radio transmissions used for communication between the hub and connected devices are not encrypted. |
CVE-2017-15397 | High | 7.4 | 2018-02-07 | Inappropriate implementation in ChromeVox in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker in a privileged network position to observe or ta… |
CVE-2018-5261 | High | 8.1 | 2018-02-02 | An issue was discovered in Flexense DiskBoss 8.8.16 and earlier. Due to the usage of plaintext information from the handshake as input for the encryption key u… |
CVE-2017-17763 | High | 7.5 | 2017-12-19 | SuperBeam through 4.1.3, when using the LAN or WiFi Direct Share feature, does not use HTTPS or any integrity-protection mechanism for file transfer, which mak… |
CVE-2017-14953 | Medium | 6.5 | 2017-12-01 | HikVision Wi-Fi IP cameras, when used in a wired configuration, allow physically proximate attackers to trigger association with an arbitrary access point by l… |
CVE-2017-8168 | Medium | 4.3 | 2017-11-22 | FusionSphere OpenStack with software V100R006C00SPC102(NFV) and V100R006C10 have an information leak vulnerability. Due to an incorrect configuration item, the… |
CVE-2017-15581 | High | 7.5 | 2017-10-27 | In the "Diary with lock" (aka WriteDiary) application 4.72 for Android, neither HTTPS nor other encryption is used for transmitting data, despite the documenta… |
CVE-2017-15609 | High | 7.5 | 2017-10-19 | Octopus before 3.17.7 allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop T… |
CVE-2017-12817 | High | 7.5 | 2017-08-25 | In Kaspersky Internet Security for Android 11.12.4.1622, some of the application trace files were not encrypted. |
CVE-2017-9632 | Critical | 9.8 | 2017-08-07 | A Missing Encryption of Sensitive Data issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWash M5, all versions, LaserWa… |
CVE-2017-9854 | Critical | 9.8 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. By sniffing for specific packets on the localhost, plaintext passwords can be obtained as they are ty… |
CVE-2017-7729 | High | 7.5 | 2017-07-11 | On iSmartAlarm cube devices, there is Incorrect Access Control because a "new key" is transmitted in cleartext. |
CVE-2017-7406 | Critical | 9.8 | 2017-07-07 | The D-Link DIR-615 device before v20.12PTb04 doesn't use SSL for any of the authenticated pages. Also, it doesn't allow the user to generate his own SSL Certif… |