CWE-311 · Missing Encryption of Sensitive Data (page 6)
Page 6 of 6 — CVEs classified under CWE-311, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-15581 | High | 7.5 | 2017-10-27 | In the "Diary with lock" (aka WriteDiary) application 4.72 for Android, neither HTTPS nor other encryption is used for transmitting data, despite the documenta… |
CVE-2017-15609 | High | 7.5 | 2017-10-19 | Octopus before 3.17.7 allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop T… |
CVE-2017-12817 | High | 7.5 | 2017-08-25 | In Kaspersky Internet Security for Android 11.12.4.1622, some of the application trace files were not encrypted. |
CVE-2017-9632 | Critical | 9.8 | 2017-08-07 | A Missing Encryption of Sensitive Data issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWash M5, all versions, LaserWa… |
CVE-2017-9854 | Critical | 9.8 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. By sniffing for specific packets on the localhost, plaintext passwords can be obtained as they are ty… |
CVE-2017-7729 | High | 7.5 | 2017-07-11 | On iSmartAlarm cube devices, there is Incorrect Access Control because a "new key" is transmitted in cleartext. |
CVE-2017-7406 | Critical | 9.8 | 2017-07-07 | The D-Link DIR-615 device before v20.12PTb04 doesn't use SSL for any of the authenticated pages. Also, it doesn't allow the user to generate his own SSL Certif… |
CVE-2017-3219 | High | 8.8 | 2017-06-21 | Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provid… |
CVE-2017-3218 | High | 8.8 | 2017-06-21 | Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician uses HTTP for software update… |
CVE-2017-9604 | High | 7.5 | 2017-06-13 | KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs… |
CVE-2017-9045 | Medium | 5.9 | 2017-05-18 | The Google I/O 2017 application before 5.1.4 for Android downloads multiple .json files from http://storage.googleapis.com without SSL, which makes it easier f… |
CVE-2017-8769 | Medium | 4.6 | 2017-05-18 | Facebook WhatsApp Messenger before 2.16.323 for Android uses the SD card for cleartext storage of files (Audio, Documents, Images, Video, and Voice Notes) asso… |
CVE-2017-7485 | Medium | 5.9 | 2017-05-12 | In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was… |
CVE-2017-8221 | High | 7.5 | 2017-04-25 | Wireless IP Camera (P2P) WIFICAM devices rely on a cleartext UDP tunnel protocol (aka the Cloud feature) for communication between an Android application and a… |
CVE-2017-5042 | Medium | 5.7 | 2017-04-24 | Cast in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android sent cookies to sites discovered via SSDP, which allowed… |
CVE-2017-6445 | High | 8.1 | 2017-03-05 | The auto-update feature of Open Embedded Linux Entertainment Center (OpenELEC) 6.0.3, 7.0.1, and 8.0.4 uses neither encrypted connections nor signed updates. A… |
CVE-2017-6297 | Medium | 5.9 | 2017-02-27 | The L2TP Client in MikroTik RouterOS versions 6.38.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-middle attackers to vi… |
CVE-2014-2379 | | 2014-09-05 | Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not use encryption, which allows remote attackers to interfere… | |
CVE-2012-1977 | | 2012-05-09 | WellinTech KingSCADA 3.0 uses a cleartext base64 format for storage of passwords in user.db, which allows context-dependent attackers to obtain sensitive infor… | |
CVE-2007-4961 | High | 7.5 | 2007-09-18 | The login_to_simulator method in Linden Lab Second Life, as used by the secondlife:// protocol handler and possibly other Second Life login mechanisms, sends a… |