CWE-319 · Cleartext Transmission of Sensitive Information (page 10)
Page 10 of 10 — CVEs classified under CWE-319, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-6018 | Critical | 9.1 | 2018-01-24 | Fixed sizes of HTTPS responses in Tinder iOS app and Tinder Android app allow an attacker to extract private sensitive information by sniffing network traffic. |
CVE-2018-6017 | Critical | 9.1 | 2018-01-24 | Unencrypted transmission of images in Tinder iOS app and Tinder Android app allows an attacker to extract private sensitive information by sniffing network tra… |
CVE-2017-17844 | Medium | 6.5 | 2017-12-27 | An issue was discovered in Enigmail before 1.9.9. A remote attacker can obtain cleartext content by sending an encrypted data block (that the attacker cannot d… |
CVE-2017-5259 | High | 8.8 | 2017-12-20 | In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path… |
CVE-2017-1694 | High | 8.1 | 2017-12-20 | IBM Integration Bus 9.0 and 10.0 transmits user credentials in plain in clear text which can be read by an attacker using man in the middle techniques. IBM X-F… |
CVE-2017-14486 | High | 7.5 | 2017-12-01 | The Vibease Wireless Remote Vibrator app for Android and the Vibease Chat app for iOS use cleartext to exchange messages with other apps and the PLAIN SASL mec… |
CVE-2017-15999 | Critical | 9.8 | 2017-10-29 | In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced user data. When logging in, the username… |
CVE-2017-1232 | Medium | 5.9 | 2017-10-26 | IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) transmits sensitive or security-critical data in cleartext in a communication channel that can be… |
CVE-2017-7147 | Medium | 5.3 | 2017-10-23 | An issue was discovered in certain Apple products. The Apple Support app before 1.2 for iOS is affected. The issue involves the "Analytics" component. It allow… |
CVE-2017-7143 | Medium | 5.5 | 2017-10-23 | An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the "Captive Network Assistant" component. It allows remo… |
CVE-2017-7133 | High | 7.5 | 2017-10-23 | An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "MobileBackup" component. It allows remote attackers to ob… |
CVE-2017-7078 | Medium | 5.3 | 2017-10-23 | An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. The issue involves the "Mail Drafts" component. I… |
CVE-2017-14009 | Medium | 6.5 | 2017-10-17 | An Information Exposure issue was discovered in ProMinent MultiFLEX M10a Controller web interface. When an authenticated user uses the Change Password feature… |
CVE-2017-15290 | High | 7.5 | 2017-10-12 | Mirasys Video Management System (VMS) 6.x before 6.4.6, 7.x before 7.5.15, and 8.x before 8.1.1 has a login process in which cleartext data is sent from a serv… |
CVE-2017-15042 | Medium | 5.9 | 2017-10-05 | An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on… |
CVE-2017-8444 | Medium | 5.9 | 2017-09-29 | The client-forwarder in Elastic Cloud Enterprise versions prior to 1.0.2 do not properly encrypt traffic to ZooKeeper. If an attacker is able to man in the mid… |
CVE-2017-6665 | Medium | 6.5 | 2017-08-07 | A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to reset… |
CVE-2017-1181 | High | 7.0 | 2017-07-17 | IBM Tivoli Monitoring Portal V6 client could allow a local attacker to gain elevated privileges for IBM Tivoli Monitoring, caused by the default console connec… |
CVE-2017-1000024 | High | 7.5 | 2017-07-17 | Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential passwo… |
CVE-2017-5652 | High | 7.5 | 2017-07-10 | During a routine security analysis, it was found that one of the ports in Apache Impala (incubating) 2.7.0 to 2.8.0 sent data in plaintext even when the cluste… |
CVE-2017-9035 | High | 7.4 | 2017-05-26 | Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to eavesdrop and tamper with updates by leveraging unencrypted communications with upda… |
CVE-2017-8851 | Medium | 5.9 | 2017-05-11 | An issue was discovered on OnePlus One and X devices. Due to a lenient updater-script on the OnePlus One and X OTA images, the fact that both products use the… |
CVE-2017-8850 | Medium | 5.9 | 2017-05-11 | An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. Due to a lenient updater-script in the OnePlus OTA images, and the fact that both ROMs use the… |
CVE-2017-3305 | Medium | 5.3 | 2017-04-24 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: C API). Supported versions that are affected are 5.5.55 and earlier and 5.6… |
CVE-2017-2412 | Medium | 5.9 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "iTunes Store" component. It allows man-in-the-middle at… |
CVE-2017-3815 | Medium | 5.3 | 2017-03-17 | An API Privilege vulnerability in Cisco TelePresence Server Software could allow an unauthenticated, remote attacker to emulate Cisco TelePresence Server endpo… |
CVE-2017-6370 | Medium | 5.3 | 2017-03-17 | TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartex… |
CVE-2017-6432 | High | 8.1 | 2017-03-09 | An issue was discovered on Dahua DHI-HCVR7216A-S3 3.210.0001.10 build 2016-06-06 devices. The Dahua DVR Protocol, which operates on TCP Port 37777, is an unenc… |
CVE-2017-6410 | Medium | 5.5 | 2017-03-02 | kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Aut… |
CVE-2017-6341 | Medium | 5.9 | 2017-02-27 | Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19… |
CVE-2015-0987 | Critical | 10.0 | 2015-10-06 | Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 rely on cleartext password transmission, which allows remot… |
CVE-2011-3022 | | 2012-02-16 | translate/translate_manager.cc in Google Chrome before 17.0.963.56 and 19.x before 19.0.1036.7 uses an HTTP session to exchange data for translation, which all… | |
CVE-2008-4122 | High | 7.5 | 2008-12-19 | Joomla! 1.5.8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by int… |
CVE-2008-4390 | High | 7.5 | 2008-12-09 | The Cisco Linksys WVC54GC wireless video camera before firmware 1.25 sends cleartext configuration data in response to a Setup Wizard remote-management command… |
CVE-2008-3289 | High | 7.5 | 2008-07-24 | EMC Dantz Retrospect Backup Client 7.5.116 sends the password hash in cleartext at an unspecified point, which allows remote attackers to obtain sensitive info… |
CVE-2008-0374 | High | 7.5 | 2008-01-22 | OKI C5510MFP Printer CU H2.15, PU 01.03.01, System F/W 1.01, and Web Page 1.00 sends the configuration of the printer in cleartext, which allows remote attacke… |
CVE-2007-5626 | Medium | 5.5 | 2007-10-23 | make_catalog_backup in Bacula 2.2.5, and probably earlier, sends a MySQL password as a command line argument, and sometimes transmits cleartext e-mail containi… |
CVE-2007-4786 | Medium | 5.3 | 2007-09-10 | Cisco Adaptive Security Appliance (ASA) running PIX 7.0 before 7.0.7.1, 7.1 before 7.1.2.61, 7.2 before 7.2.2.34, and 8.0 before 8.0.2.11, when AAA is enabled… |
CVE-2005-3140 | High | 7.5 | 2005-10-05 | Procom NetFORCE 800 4.02 M10 Build 20 and possibly other versions sends the NIS password map (passwd.nis) as a file attachment in diagnostic e-mail messages, w… |
CVE-2005-2069 | | 2005-06-30 | pam_ldap and nss_ldap, when used with OpenLDAP and connecting to a slave using TLS, does not use TLS for the subsequent connection if the client is referred to… | |
CVE-2004-1852 | | 2004-03-23 | DameWare Mini Remote Control 3.x before 3.74 and 4.x before 4.2 transmits the Blowfish encryption key in plaintext, which allows remote attackers to gain sensi… | |
CVE-2002-1949 | High | 7.5 | 2002-12-31 | The Network Attached Storage (NAS) Administration Web Page for Iomega NAS A300U transmits passwords in cleartext, which allows remote attackers to sniff the ad… |