CWE-319 · Cleartext Transmission of Sensitive Information (page 2)
Page 2 of 9 — CVEs classified under CWE-319, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-67159 | High | 7.5 | 2026-01-02 | Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext. |
CVE-2025-62578 | High | 7.5 | 2025-12-26 | DVP-12SE - Modbus/TCP Cleartext Transmission of Sensitive Information |
CVE-2025-61738 | | 2025-12-22 | Under certain circumstances, attacker can capture the network key, read or write encrypted packets on the PowerG network. | |
CVE-2025-65855 | Medium | 6.6 | 2025-12-17 | The OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware v18_178_221102_ASCII_PRO_1R5_50) uses hard-coded WiFi credentials identical across… |
CVE-2025-62330 | Medium | 5.9 | 2025-12-16 | HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information because the HTTP port remains accessible and does not redirect to HTTPS a… |
CVE-2023-53881 | High | 8.1 | 2025-12-15 | ReyeeOS 1.204.1614 contains an unencrypted CWMP communication vulnerability that allows attackers to intercept and manipulate device communication through a ma… |
CVE-2023-53875 | High | 8.8 | 2025-12-15 | GOM Player 2.3.90.5360 contains a remote code execution vulnerability in its Internet Explorer component that allows attackers to execute arbitrary code throug… |
CVE-2025-13489 | Medium | 5.9 | 2025-12-15 | IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.3 IBM DevOps Deploy transmits data in clear text that could allow an attacker to obtain sensitive information usi… |
CVE-2025-65827 | Critical | 9.1 | 2025-12-10 | The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP. As a result, an adversary locate… |
CVE-2025-66573 | High | 7.5 | 2025-12-04 | Solstice Pod API (version 5.5, 6.2) contains an unauthenticated API endpoint (`/api/config`) that exposes sensitive information such as the session key, server… |
CVE-2025-63364 | High | 7.5 | 2025-12-04 | Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discovered to transmit Ad… |
CVE-2024-48894 | Medium | 5.9 | 2025-12-01 | A cleartext transmission vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted HTTP request can lead to… |
CVE-2024-32384 | Medium | 6.8 | 2025-12-01 | Kerlink gateways running KerOS prior to version 5.10 expose their web interface exclusively over HTTP, without HTTPS support. This lack of transport layer secu… |
CVE-2025-63292 | Low | 3.5 | 2025-11-17 | Freebox v5 HD (firmware = 1.7.20), Freebox v5 Crystal (firmware = 1.7.20), Freebox v6 Révolution r1–r3 (firmware = 4.7.x), Freebox Mini 4K (firmware = 4.7.x)… |
CVE-2025-62765 | High | 7.5 | 2025-11-15 | General Industrial Controls Lynx+ Gateway is vulnerable to a cleartext transmission vulnerability that could allow an attacker to observe network traffic to o… |
CVE-2025-12508 | High | 8.4 | 2025-10-31 | When using domain users as BRAIN2 users, communication with Active Directory services is unencrypted. This can lead to the interception of authentication data… |
CVE-2025-64389 | | 2025-10-31 | The web server of the device performs exchanges of sensitive information in clear text through an insecure protocol. | |
CVE-2025-34271 | Critical | 9.8 | 2025-10-30 | Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes o… |
CVE-2025-61481 | Critical | 10.0 | 2025-10-27 | An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to… |
CVE-2025-56447 | Critical | 9.8 | 2025-10-22 | TM2 Monitoring v3.04 contains an authentication bypass and plaintext credential disclosure. |
CVE-2025-10641 | High | 7.1 | 2025-10-21 | All WorkExaminer Professional traffic between monitoring client, console and server is transmitted as plain text. This allows an attacker with access to the ne… |
CVE-2025-62643 | Low | 3.4 | 2025-10-17 | The Restaurant Brands International (RBI) assistant platform through 2025-09-06 transmits passwords of user accounts in cleartext e-mail messages. |
CVE-2025-11492 | Critical | 9.6 | 2025-10-16 | In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-mi… |
CVE-2025-53139 | High | 7.7 | 2025-10-14 | Cleartext transmission of sensitive information in Windows Hello allows an unauthorized attacker to bypass a security feature locally. |
CVE-2025-41718 | High | 7.5 | 2025-10-14 | A cleartext transmission of sensitive information vulnerability in the affected products allows an unauthorized remote attacker to gain login credentials and a… |
CVE-2025-11640 | Low | 3.1 | 2025-10-12 | A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. This affects an unknown function of the component Bluetooth Low Energy. The manipulation results… |
CVE-2025-59448 | Medium | 4.7 | 2025-10-06 | Components of the YoSmart YoLink ecosystem through 2025-10-02 leverage unencrypted MQTT to communicate over the internet. An attacker with the ability to monit… |
CVE-2025-59406 | Medium | 6.2 | 2025-10-02 | The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI C… |
CVE-2025-36274 | High | 7.5 | 2025-09-26 | IBM Aspera HTTP Gateway 2.0.0 through 2.3.1 stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user. |
CVE-2025-10540 | Medium | 6.5 | 2025-09-25 | iMonitor EAM 9.6394 transmits communication between the EAM client agent and the EAM server, as well as between the EAM monitor management software and the ser… |
CVE-2017-20200 | Low | 3.7 | 2025-09-23 | A vulnerability has been found in Coinomi up to 1.7.6. This issue affects some unknown processing. Such manipulation leads to cleartext transmission of sensiti… |
CVE-2025-10776 | Low | 3.7 | 2025-09-22 | A vulnerability was detected in LionCoders SalePro POS up to 5.5.0. This issue affects some unknown processing of the component Login. Performing manipulation… |
CVE-2025-54818 | High | 8.0 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware expose a proprietary protocol on TCP port 1069 to perform management operations such as modifying syst… |
CVE-2025-47698 | | 2025-09-18 | An adjacent attacker without authentication can exploit this vulnerability to retrieve a set of user-privileged credentials. These credentials are present duri… | |
CVE-2025-7743 | Critical | 9.6 | 2025-09-16 | Cleartext Transmission of Sensitive Information vulnerability in Dolusoft Omaspot allows Interception, Privilege Escalation. This issue affects Omaspot: befor… |
CVE-2025-50110 | High | 8.8 | 2025-09-15 | An issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, the GetHttpsResponse method transmits sen… |
CVE-2025-55976 | High | 8.4 | 2025-09-10 | Intelbras IWR 3000N 1.9.8 exposes the Wi-Fi password in plaintext via the /api/wireless endpoint. Any unauthenticated user on the local network can directly ob… |
CVE-2025-41708 | High | 7.4 | 2025-09-08 | Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit thi… |
CVE-2025-7731 | High | 7.5 | 2025-09-01 | Cleartext Transmission of Sensitive Information vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated… |
CVE-2025-31972 | Medium | 6.5 | 2025-08-28 | HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker… |
CVE-2025-52351 | High | 8.8 | 2025-08-21 | Aikaan IoT management platform v3.25.0325-5-g2e9c59796 sends a newly generated password to users in plaintext via email and also includes the same password as… |
CVE-2025-6180 | | 2025-08-20 | The StrongDM Client insufficiently protected a pre-authentication token. Attackers could exploit this to intercept and reuse the token, potentially redeeming v… | |
CVE-2025-57727 | Medium | 4.7 | 2025-08-20 | In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference |
CVE-2025-54156 | High | 7.4 | 2025-08-18 | The Sante PACS Server Web Portal sends credential information without encryption. |
CVE-2025-8863 | | 2025-08-11 | YugabyteDB diagnostic information was transmitted over HTTP, which could expose sensitive data during transmission | |
CVE-2025-8741 | Low | 3.7 | 2025-08-08 | A vulnerability was found in macrozheng mall up to 1.0.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of th… |
CVE-2025-52586 | Medium | 6.9 | 2025-08-08 | The MOD3 command traffic between the monitoring application and the inverter is transmitted in plaintext without encryption or obfuscation. This vulnerabilit… |
CVE-2025-54799 | | 2025-08-07 | Let's Encrypt client and ACME library written in Go (Lego). In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package (thus the lego librar… | |
CVE-2025-36020 | Medium | 5.9 | 2025-08-06 | IBM Guardium Data Protection could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive credential information. |
CVE-2025-52490 | High | 7.3 | 2025-07-29 | An issue was discovered in Couchbase Sync Gateway before 3.2.6. In sgcollect_info_options.log and sync_gateway.log, there are cleartext passwords in redacted a… |
CVE-2025-8205 | Low | 3.7 | 2025-07-26 | A vulnerability, which was classified as problematic, has been found in Comodo Dragon up to 134.0.6998.179. Affected by this issue is some unknown functionalit… |
CVE-2025-0252 | Low | 2.6 | 2025-07-25 | HCL IEM is affected by a password in cleartext vulnerability. Sensitive information is transmitted without adequate protection, potentially exposing it to una… |
CVE-2025-0250 | Low | 2.2 | 2025-07-25 | HCL IEM is affected by an authorization token sent in cookie vulnerability. A token used for authentication and authorization is being handled in a manner tha… |
CVE-2025-53703 | High | 7.5 | 2025-07-22 | DuraComm SPM-500 DP-10iN-100-MU transmits sensitive data without encryption over a channel that could be intercepted by attackers. |
CVE-2025-36107 | Medium | 5.9 | 2025-07-21 | IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 could allow malicious actors to obtain sensitive information due to the cleartext transmission of data. |
CVE-2025-2818 | Low | 3.5 | 2025-07-17 | A vulnerability was reported in version 1.0 of the Bluetooth Transmission Alliance protocol adopted by Motorola Smart Connect Android Application that could al… |
CVE-2025-53756 | | 2025-07-16 | This vulnerability exists in Digisol DG-GR6821AC Router due to cleartext transmission of credentials in its web management interface. A remote attacker could e… | |
CVE-2025-53861 | Low | 3.1 | 2025-07-11 | A flaw was found in Ansible. Sensitive cookies without security flags over non-encrypted channels can lead to Man-in-the-Middle (MitM) and Cross-site scripting… |
CVE-2025-44251 | High | 7.5 | 2025-07-10 | Ecovacs Deebot T10 1.7.2 transmits Wi-Fi credentials in cleartext during the pairing process. |
CVE-2025-27457 | Medium | 6.5 | 2025-07-03 | All communication between the VNC server and client(s) is unencrypted. This allows an attacker to intercept the traffic and obtain sensitive data. |
CVE-2025-36034 | Medium | 5.3 | 2025-06-26 | IBM InfoSphere DataStage Flow Designer in IBM InfoSphere Information Server 11.7 discloses sensitive user information in API requests in clear text that could… |
CVE-2025-5087 | | 2025-06-24 | Kaleris NAVIS N4 ULC (Ultra Light Client) communicates insecurely using zlib-compressed data over HTTP. An attacker capable of observing network traffic betwee… | |
CVE-2025-4378 | Critical | 10.0 | 2025-06-24 | Cleartext Transmission of Sensitive Information, Use of Hard-coded Credentials vulnerability in Ataturk University ATA-AOF Mobile Application allows Authentica… |
CVE-2025-32880 | Critical | 9.8 | 2025-06-20 | An issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a WLAN. With WLAN access, the COROS Pace 3 d… |
CVE-2025-26199 | Critical | 9.8 | 2025-06-18 | CloudClassroom-PHP-Project v1.0 is affected by an insecure credential transmission vulnerability. The application transmits passwords over unencrypted HTTP dur… |
CVE-2025-4227 | Low | 3.5 | 2025-06-13 | An improper access control vulnerability in the Endpoint Traffic Policy Enforcement https://docs.paloaltonetworks.com/globalprotect/6-0/globalprotect-app-new-… |
CVE-2025-49194 | High | 7.5 | 2025-06-12 | The server supports authentication methods in which credentials are sent in plaintext over unencrypted channels. If an attacker were to intercept traffic betwe… |
CVE-2025-49183 | High | 7.5 | 2025-06-12 | All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver. This leads to the poss… |
CVE-2025-44612 | Medium | 5.9 | 2025-05-30 | Tinxy WiFi Lock Controller v1 RF was discovered to transmit sensitive information in plaintext, including control information and device credentials, allowing… |
CVE-2025-5270 | High | 7.5 | 2025-05-27 | In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled. This vulnerability was fixed in Firefox 139 and Thunderbird 139. |
CVE-2025-3480 | Medium | 6.5 | 2025-05-22 | MedDream WEB DICOM Viewer Cleartext Transmission of Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to d… |
CVE-2025-0136 | | 2025-05-14 | Using the AES-128-CCM algorithm for IPSec on certain Palo Alto Networks PAN-OS® firewalls (PA-7500, PA-5400, PA-5400f, PA-3400, PA-1600, PA-1400, and PA-400 Se… | |
CVE-2025-40583 | Medium | 4.4 | 2025-05-13 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions with SINEMA Remote Connect Edge Client installed). Affected devices… |
CVE-2025-27720 | High | 7.4 | 2025-05-08 | The Pixmeo Osirix MD Web Portal sends credential information without encryption, which could allow an attacker to steal credentials. |
CVE-2024-12378 | Critical | 9.1 | 2025-05-08 | On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan t… |
CVE-2025-47419 | | 2025-05-06 | Cleartext Transmission of Sensitive Information vulnerability in Crestron Automate VX allows Sniffing Network Traffic. The device allows Web UI and API access… | |
CVE-2025-32887 | High | 7.1 | 2025-05-01 | An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. A command channel includes the next hop. which can be intercepted and used to… |
CVE-2025-32884 | Medium | 4.3 | 2025-05-01 | An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. By default, a GID is the user's phone number unless they specifically opt o… |
CVE-2025-32881 | Medium | 4.3 | 2025-05-01 | An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. By default, the GID is the user's phone number unless they specifically opt o… |
CVE-2025-25046 | Low | 3.7 | 2025-04-23 | IBM InfoSphere Information Server 11.7 DataStage Flow Designer transmits sensitive information via URL or query parameters that could be exposed to an unauth… |
CVE-2025-42603 | | 2025-04-23 | This vulnerability exists in the Meon KYC solutions due to transmission of sensitive data in plain text within the response payloads of certain API endpoints… | |
CVE-2025-32793 | Medium | 4.0 | 2025-04-21 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.15.0 to 1.15.15, 1.16.0 to 1.16.8, and 1.17.0 to 1.17.2… |
CVE-2025-43013 | Medium | 6.9 | 2025-04-17 | In JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possible |
CVE-2025-43704 | Medium | 4.7 | 2025-04-16 | Arctera/Veritas Data Insight before 7.1.2 can send cleartext credentials when configured to use HTTP Basic Authentication to a Dell Isilon OneFS server. |
CVE-2025-27722 | Medium | 5.9 | 2025-04-09 | Cleartext transmission of sensitive information issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a man-in-the-middle attack may allow a remote… |
CVE-2025-26654 | Medium | 6.8 | 2025-04-08 | SAP Commerce Cloud (Public Cloud) does not allow to disable unencrypted HTTP (port 80) entirely, but instead allows a redirect from port 80 to 443 (HTTPS). As… |
CVE-2025-3329 | Low | 3.1 | 2025-04-07 | A vulnerability classified as problematic has been found in Consumer Comanda Mobile up to 14.9.3.2/15.0.0.8. This affects an unknown part of the component Rest… |
CVE-2025-2861 | High | 7.5 | 2025-03-28 | SaTECH BCU in its firmware version 2.1.3 uses the HTTP protocol. The use of the HTTP protocol for web browsing has the problem that information is exchanged in… |
CVE-2024-45361 | Medium | 6.5 | 2025-03-27 | A protocol flaw vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited b… |
CVE-2025-2311 | Critical | 9.0 | 2025-03-20 | Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in Sechard Information Te… |
CVE-2024-10718 | High | 7.5 | 2025-03-20 | In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set. This could cause the user agent to send those cookie… |
CVE-2024-44276 | High | 7.3 | 2025-03-17 | This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in iOS 18.2 and iPadOS 18.2. A user in a privileged netw… |
CVE-2025-27594 | High | 7.5 | 2025-03-14 | The device uses an unencrypted, proprietary protocol for communication. Through this protocol, configuration data is transmitted and device authentication is p… |
CVE-2024-13872 | High | 7.5 | 2025-03-12 | Bitdefender Box, versions 1.3.11.490 through 1.3.11.505, uses the insecure HTTP protocol to download assets over the Internet to update and restart daemons and… |
CVE-2025-22493 | Medium | 5.6 | 2025-03-05 | Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software (FRS). Absence of this secure flag could lead into the session cookie being… |
CVE-2025-24849 | High | 7.1 | 2025-02-28 | Lack of encryption in transit for cloud infrastructure facilitating potential for sensitive data manipulation or exposure. |
CVE-2025-25728 | Medium | 6.5 | 2025-02-28 | Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to send communications to the update API in plaintex… |
CVE-2022-41545 | Medium | 6.4 | 2025-02-18 | The administrative web interface of a Netgear C7800 Router running firmware version 6.01.07 (and possibly others) authenticates users via basic authentication… |
CVE-2024-5462 | High | 7.5 | 2025-02-15 | If Brocade Fabric OS before Fabric OS 9.2.0 configuration settings are not set to encrypt SNMP passwords, then the SNMP privsecret / authsecret fields can be e… |
CVE-2025-1060 | High | 7.5 | 2025-02-13 | CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists that could result in the exposure of data when network traffic is being sniffed b… |