CWE-319 · Cleartext Transmission of Sensitive Information (page 2)
Page 2 of 10 — CVEs classified under CWE-319, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-5115 | High | 7.5 | 2026-03-31 | The PaperCut NG/MF (specifically, the embedded application for Konica Minolta devices) is vulnerable to session hijacking. The PaperCut NG/MF Embedded applicat… |
CVE-2026-5119 | Medium | 5.9 | 2026-03-30 | A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the… |
CVE-2026-1014 | Medium | 6.5 | 2026-03-25 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to exposure of sensitive information via JSON server response manipulation. |
CVE-2025-64648 | Medium | 5.9 | 2026-03-25 | IBM Concert 1.0.0 through 2.2.0 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques. |
CVE-2026-20115 | Medium | 6.1 | 2026-03-25 | A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information. This vulne… |
CVE-2026-4584 | Low | 3.1 | 2026-03-23 | A flaw has been found in Shenzhen HCC Technology MPOS M6 PLUS 1V.31-N. This affects an unknown part of the component Cardholder Data Handler. Executing a manip… |
CVE-2026-24060 | Critical | 9.1 | 2026-03-21 | Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted, and modified by an attacker. Valuable… |
CVE-2026-32309 | High | 7.5 | 2026-03-20 | Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.1, the Hub-based unlock flow explicitly supports hub+http and consumes Hu… |
CVE-2026-32838 | High | 7.5 | 2026-03-17 | Edimax GS-5008PL firmware version 1.00.54 and prior use cleartext HTTP for the web management interface without implementing TLS or SSL encryption. Attackers o… |
CVE-2026-32745 | Medium | 6.3 | 2026-03-13 | In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings |
CVE-2025-13718 | Low | 3.7 | 2026-03-13 | IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow a remote attacker to obtain sensitive information in cl… |
CVE-2026-23662 | High | 7.5 | 2026-03-10 | Missing authentication for critical function in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network. |
CVE-2026-23661 | High | 7.5 | 2026-03-10 | Cleartext transmission of sensitive information in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network. |
CVE-2025-70048 | High | 7.5 | 2026-03-09 | An issue pertaining to CWE-319: Cleartext Transmission of Sensitive Information was discovered in Nexusoft NexusInterface v3.2.0-beta.2. |
CVE-2026-2671 | Low | 3.1 | 2026-03-07 | A vulnerability was detected in Mendi Neurofeedback Headset V4. Affected by this vulnerability is an unknown functionality of the component Bluetooth Low Energ… |
CVE-2026-30795 | High | 7.5 | 2026-03-05 | Cleartext Transmission of Sensitive Information vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Heartb… |
CVE-2025-69969 | Critical | 9.6 | 2026-03-04 | A lack of authentication and authorization mechanisms in the Bluetooth Low Energy (BLE) communication protocol of SRK Powertech Pvt Ltd Pebble Prism Ultra v2.9… |
CVE-2025-13490 | Medium | 5.9 | 2026-03-03 | IBM App Connect Operator versions CD 11.3.0 through 11.6.0 and 12.1.0 through 12.20.0, LTS versions 12.0.0 through 12.0.20, and IBM App Connect Enterprise Cert… |
CVE-2026-20801 | Medium | 5.6 | 2026-03-03 | Cleartext Transmission of Sensitive Information (CWE-319) in a component used in the Gallagher Hanwha VMS and Gallagher NxWitness VMS integrations allows unpri… |
CVE-2024-43766 | Medium | 6.5 | 2026-03-02 | In multiple functions of btm_ble_sec.cc, there is a possible unencrypted communication due to Invalid error handling. This could lead to remote (proximal/adjac… |
CVE-2025-58107 | High | 7.5 | 2026-03-02 | In Microsoft Exchange through 2019, Exchange ActiveSync (EAS) configurations on on-premises servers may transmit sensitive data from Samsung mobile devices in… |
CVE-2026-27752 | Medium | 5.9 | 2026-02-27 | SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 transmit authentication credentials over unencrypted HTTP, allowing attackers to capture credentials… |
CVE-2026-24455 | High | 7.5 | 2026-02-20 | The embedded web interface of the device does not support HTTPS/TLS for authentication and uses HTTP Basic Authentication. Traffic is encoded but not encrypt… |
CVE-2025-27903 | Medium | 5.9 | 2026-02-17 | IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 IBM Db2 Recovery Expert for Linux, UNIX and Windows transmits data in a cleartext communication channel tha… |
CVE-2026-2539 | | 2026-02-15 | The RF communication protocol in the Micca KE700 car alarm system does not encrypt its data frames. An attacker with a radio interception tool (e.g., SDR) can… | |
CVE-2025-10174 | High | 8.3 | 2026-02-11 | Cleartext Transmission of Sensitive Information vulnerability in Pan Software & Information Technologies Ltd. PanCafe Pro allows Flooding. This issue affects… |
CVE-2025-66604 | Medium | 5.3 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The library version could be displayed on the web page. This informa… |
CVE-2026-0714 | Medium | 6.8 | 2026-02-05 | A physical attack vulnerability exists in certain Moxa industrial computers using TPM-backed LUKS full-disk encryption on Moxa Industrial Linux 3, where the di… |
CVE-2026-24441 | Medium | 5.9 | 2026-02-03 | Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior expose account credentials in plaintext within HTTP responses, allowing an on-path attacker to ob… |
CVE-2026-1777 | High | 7.2 | 2026-02-02 | The Amazon SageMaker Python SDK before v3.2.0 and v2.256.0 includes the ModelBuilder HMAC signing key in the cleartext response elements of the DescribeTrainin… |
CVE-2026-23564 | Medium | 6.5 | 2026-01-29 | A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker… |
CVE-2026-22274 | Medium | 6.5 | 2026-01-23 | Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains a Cleartext Transmission of Sensitive Information vulnerab… |
CVE-2026-22271 | High | 7.5 | 2026-01-23 | Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains a Cleartext Transmission of Sensitive Information vulnerab… |
CVE-2025-64769 | High | 7.1 | 2026-01-16 | The Process Optimization application suite leverages connection channels/protocols that by-default are not encrypted and could become subject to hijacking or… |
CVE-2025-13454 | Medium | 5.5 | 2026-01-14 | A potential vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to gain access to sensitive device infor… |
CVE-2025-69272 | High | 7.5 | 2026-01-12 | Cleartext Transmission of Sensitive Information vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Sniffing Attacks.This issue affects DX Ne… |
CVE-2026-22080 | | 2026-01-09 | This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the transmission of credentials encoded usin… | |
CVE-2026-22079 | | 2026-01-09 | This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the plaintext transmission of login credenti… | |
CVE-2019-25278 | Medium | 5.9 | 2026-01-08 | FaceSentry Access Control System 6.4.8 contains a cleartext transmission vulnerability that allows remote attackers to intercept authentication credentials. At… |
CVE-2026-22544 | | 2026-01-07 | An attacker with a network connection could detect credentials in clear text. | |
CVE-2020-36917 | High | 7.5 | 2026-01-06 | iDS6 DSSPro Digital Signage System 6.2 contains a sensitive information disclosure vulnerability that allows remote attackers to intercept authentication crede… |
CVE-2020-36914 | High | 7.5 | 2026-01-06 | QiHang Media Web Digital Signage 3.0.9 contains a sensitive information disclosure vulnerability that allows remote attackers to intercept user authentication… |
CVE-2025-67159 | High | 7.5 | 2026-01-02 | Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext. |
CVE-2025-62578 | High | 7.5 | 2025-12-26 | DVP-12SE - Modbus/TCP Cleartext Transmission of Sensitive Information |
CVE-2025-61738 | | 2025-12-22 | Under certain circumstances, attacker can capture the network key, read or write encrypted packets on the PowerG network. | |
CVE-2025-65855 | Medium | 6.6 | 2025-12-17 | The OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware v18_178_221102_ASCII_PRO_1R5_50) uses hard-coded WiFi credentials identical across… |
CVE-2025-62330 | Medium | 5.9 | 2025-12-16 | HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information because the HTTP port remains accessible and does not redirect to HTTPS a… |
CVE-2023-53881 | High | 8.1 | 2025-12-15 | ReyeeOS 1.204.1614 contains an unencrypted CWMP communication vulnerability that allows attackers to intercept and manipulate device communication through a ma… |
CVE-2023-53875 | High | 8.8 | 2025-12-15 | GOM Player 2.3.90.5360 contains a remote code execution vulnerability in its Internet Explorer component that allows attackers to execute arbitrary code throug… |
CVE-2025-13489 | Medium | 5.9 | 2025-12-15 | IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.3 IBM DevOps Deploy transmits data in clear text that could allow an attacker to obtain sensitive information usi… |
CVE-2025-65827 | Critical | 9.1 | 2025-12-10 | The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP. As a result, an adversary locate… |
CVE-2025-66573 | High | 7.5 | 2025-12-04 | Solstice Pod API (version 5.5, 6.2) contains an unauthenticated API endpoint (`/api/config`) that exposes sensitive information such as the session key, server… |
CVE-2025-63364 | High | 7.5 | 2025-12-04 | Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discovered to transmit Ad… |
CVE-2024-48894 | Medium | 5.9 | 2025-12-01 | A cleartext transmission vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted HTTP request can lead to… |
CVE-2024-32384 | Medium | 6.8 | 2025-12-01 | Kerlink gateways running KerOS prior to version 5.10 expose their web interface exclusively over HTTP, without HTTPS support. This lack of transport layer secu… |
CVE-2025-63292 | Low | 3.5 | 2025-11-17 | Freebox v5 HD (firmware = 1.7.20), Freebox v5 Crystal (firmware = 1.7.20), Freebox v6 Révolution r1–r3 (firmware = 4.7.x), Freebox Mini 4K (firmware = 4.7.x)… |
CVE-2025-62765 | High | 7.5 | 2025-11-15 | General Industrial Controls Lynx+ Gateway is vulnerable to a cleartext transmission vulnerability that could allow an attacker to observe network traffic to o… |
CVE-2025-12508 | High | 8.4 | 2025-10-31 | When using domain users as BRAIN2 users, communication with Active Directory services is unencrypted. This can lead to the interception of authentication data… |
CVE-2025-64389 | | 2025-10-31 | The web server of the device performs exchanges of sensitive information in clear text through an insecure protocol. | |
CVE-2025-34271 | Critical | 9.8 | 2025-10-30 | Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes o… |
CVE-2025-61481 | Critical | 10.0 | 2025-10-27 | An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to… |
CVE-2025-56447 | Critical | 9.8 | 2025-10-22 | TM2 Monitoring v3.04 contains an authentication bypass and plaintext credential disclosure. |
CVE-2025-10641 | High | 7.1 | 2025-10-21 | All WorkExaminer Professional traffic between monitoring client, console and server is transmitted as plain text. This allows an attacker with access to the ne… |
CVE-2025-62643 | Low | 3.4 | 2025-10-17 | The Restaurant Brands International (RBI) assistant platform through 2025-09-06 transmits passwords of user accounts in cleartext e-mail messages. |
CVE-2025-11492 | Critical | 9.6 | 2025-10-16 | In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-mi… |
CVE-2025-53139 | High | 7.7 | 2025-10-14 | Cleartext transmission of sensitive information in Windows Hello allows an unauthorized attacker to bypass a security feature locally. |
CVE-2025-41718 | High | 7.5 | 2025-10-14 | A cleartext transmission of sensitive information vulnerability in the affected products allows an unauthorized remote attacker to gain login credentials and a… |
CVE-2025-11640 | Low | 3.1 | 2025-10-12 | A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. This affects an unknown function of the component Bluetooth Low Energy. The manipulation results… |
CVE-2025-59448 | Medium | 4.7 | 2025-10-06 | Components of the YoSmart YoLink ecosystem through 2025-10-02 leverage unencrypted MQTT to communicate over the internet. An attacker with the ability to monit… |
CVE-2025-59406 | Medium | 6.2 | 2025-10-02 | The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI C… |
CVE-2025-36274 | High | 7.5 | 2025-09-26 | IBM Aspera HTTP Gateway 2.0.0 through 2.3.1 stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user. |
CVE-2025-10540 | Medium | 6.5 | 2025-09-25 | iMonitor EAM 9.6394 transmits communication between the EAM client agent and the EAM server, as well as between the EAM monitor management software and the ser… |
CVE-2017-20200 | Low | 3.7 | 2025-09-23 | A vulnerability has been found in Coinomi up to 1.7.6. This issue affects some unknown processing. Such manipulation leads to cleartext transmission of sensiti… |
CVE-2025-10776 | Low | 3.7 | 2025-09-22 | A vulnerability was detected in LionCoders SalePro POS up to 5.5.0. This issue affects some unknown processing of the component Login. Performing manipulation… |
CVE-2025-54818 | High | 8.0 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware expose a proprietary protocol on TCP port 1069 to perform management operations such as modifying syst… |
CVE-2025-47698 | | 2025-09-18 | An adjacent attacker without authentication can exploit this vulnerability to retrieve a set of user-privileged credentials. These credentials are present duri… | |
CVE-2025-7743 | Critical | 9.6 | 2025-09-16 | Cleartext Transmission of Sensitive Information vulnerability in Dolusoft Omaspot allows Interception, Privilege Escalation. This issue affects Omaspot: befor… |
CVE-2025-50110 | High | 8.8 | 2025-09-15 | An issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, the GetHttpsResponse method transmits sen… |
CVE-2025-55976 | High | 8.4 | 2025-09-10 | Intelbras IWR 3000N 1.9.8 exposes the Wi-Fi password in plaintext via the /api/wireless endpoint. Any unauthenticated user on the local network can directly ob… |
CVE-2025-41708 | High | 7.4 | 2025-09-08 | Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit thi… |
CVE-2025-7731 | High | 7.5 | 2025-09-01 | Cleartext Transmission of Sensitive Information vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated… |
CVE-2025-31972 | Medium | 6.5 | 2025-08-28 | HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker… |
CVE-2025-52351 | High | 8.8 | 2025-08-21 | Aikaan IoT management platform v3.25.0325-5-g2e9c59796 sends a newly generated password to users in plaintext via email and also includes the same password as… |
CVE-2025-6180 | | 2025-08-20 | The StrongDM Client insufficiently protected a pre-authentication token. Attackers could exploit this to intercept and reuse the token, potentially redeeming v… | |
CVE-2025-57727 | Medium | 4.7 | 2025-08-20 | In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference |
CVE-2025-54156 | High | 7.4 | 2025-08-18 | The Sante PACS Server Web Portal sends credential information without encryption. |
CVE-2025-8863 | | 2025-08-11 | YugabyteDB diagnostic information was transmitted over HTTP, which could expose sensitive data during transmission | |
CVE-2025-8741 | Low | 3.7 | 2025-08-08 | A vulnerability was found in macrozheng mall up to 1.0.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of th… |
CVE-2025-52586 | Medium | 6.9 | 2025-08-08 | The MOD3 command traffic between the monitoring application and the inverter is transmitted in plaintext without encryption or obfuscation. This vulnerabilit… |
CVE-2025-54799 | | 2025-08-07 | Let's Encrypt client and ACME library written in Go (Lego). In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package (thus the lego librar… | |
CVE-2025-36020 | Medium | 5.9 | 2025-08-06 | IBM Guardium Data Protection could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive credential information. |
CVE-2025-52490 | High | 7.3 | 2025-07-29 | An issue was discovered in Couchbase Sync Gateway before 3.2.6. In sgcollect_info_options.log and sync_gateway.log, there are cleartext passwords in redacted a… |
CVE-2025-8205 | Low | 3.7 | 2025-07-26 | A vulnerability, which was classified as problematic, has been found in Comodo Dragon up to 134.0.6998.179. Affected by this issue is some unknown functionalit… |
CVE-2025-0252 | Low | 2.6 | 2025-07-25 | HCL IEM is affected by a password in cleartext vulnerability. Sensitive information is transmitted without adequate protection, potentially exposing it to una… |
CVE-2025-0250 | Low | 2.2 | 2025-07-25 | HCL IEM is affected by an authorization token sent in cookie vulnerability. A token used for authentication and authorization is being handled in a manner tha… |
CVE-2025-53703 | High | 7.5 | 2025-07-22 | DuraComm SPM-500 DP-10iN-100-MU transmits sensitive data without encryption over a channel that could be intercepted by attackers. |
CVE-2025-36107 | Medium | 5.9 | 2025-07-21 | IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 could allow malicious actors to obtain sensitive information due to the cleartext transmission of data. |
CVE-2025-2818 | Low | 3.5 | 2025-07-17 | A vulnerability was reported in version 1.0 of the Bluetooth Transmission Alliance protocol adopted by Motorola Smart Connect Android Application that could al… |
CVE-2025-53756 | | 2025-07-16 | This vulnerability exists in Digisol DG-GR6821AC Router due to cleartext transmission of credentials in its web management interface. A remote attacker could e… | |
CVE-2025-53861 | Low | 3.1 | 2025-07-11 | A flaw was found in Ansible. Sensitive cookies without security flags over non-encrypted channels can lead to Man-in-the-Middle (MitM) and Cross-site scripting… |