CWE-319 · Cleartext Transmission of Sensitive Information (page 3)
Page 3 of 9 — CVEs classified under CWE-319, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-0556 | High | 8.8 | 2025-02-12 | In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communication of non-sensitive… |
CVE-2024-36558 | High | 7.5 | 2025-02-06 | Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h suffers from Cleartext Transmission of Sensitive Information due to lack of en… |
CVE-2024-43187 | Medium | 5.9 | 2025-02-04 | IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 transmits sensitive or security-critical data in cleartext in a communication channel… |
CVE-2025-23060 | Medium | 6.6 | 2025-02-04 | A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information. Exploiting this vu… |
CVE-2023-35017 | Medium | 5.9 | 2025-01-29 | IBM Security Verify Governance 10.0.2 Identity Manager can transmit user credentials in clear text that could be obtained by an attacker using man in the middl… |
CVE-2025-0784 | Low | 3.7 | 2025-01-28 | A vulnerability has been found in Intelbras InControl up to 2.21.58 and classified as problematic. This vulnerability affects unknown code of the file /v1/usua… |
CVE-2025-0631 | | 2025-01-28 | A Credential Exposure Vulnerability exists in the above-mentioned product and version. The vulnerability is due to using HTTP resulting in credentials being se… | |
CVE-2025-0432 | Medium | 5.7 | 2025-01-28 | EWON Flexy 202 transmits user credentials in clear text with no encryption when a user is added, or user credentials are changed via its webpage. |
CVE-2024-28786 | Medium | 6.5 | 2025-01-28 | IBM QRadar SIEM 7.5 transmits sensitive or security-critical data in cleartext in a communication channel that could be obtained by an unauthorized actor using… |
CVE-2024-41757 | Medium | 5.9 | 2025-01-24 | IBM Concert Software 1.0.0 and 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transp… |
CVE-2024-26155 | Medium | 6.8 | 2025-01-17 | All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 expose clear text credentials in the web portal. An attacker can access the ETIC RAS w… |
CVE-2024-48121 | Medium | 6.5 | 2025-01-15 | The HI-SCAN 6040i Hitrax HX-03-19-I was discovered to transmit user credentials in cleartext over the GIOP protocol. This allows attackers to possibly gain acc… |
CVE-2024-45102 | Medium | 6.8 | 2025-01-14 | A privilege escalation vulnerability was discovered that could allow a valid, authenticated LXCA user to escalate their permissions for a connected XCC instanc… |
CVE-2024-42181 | Low | 1.6 | 2025-01-12 | HCL MyXalytics is affected by a cleartext transmission of sensitive information vulnerability. The application transmits sensitive or security-critical data i… |
CVE-2024-46505 | Critical | 9.1 | 2025-01-09 | Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities. |
CVE-2024-11946 | Medium | 6.5 | 2024-12-30 | iXsystems TrueNAS CORE fetch_plugin_packagesites tar Cleartext Transmission of Sensitive Information Vulnerability. This vulnerability allows network-adjacent… |
CVE-2021-39081 | Medium | 5.9 | 2024-12-19 | IBM Cognos Analytics Mobile for Android 1.1.14 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive info… |
CVE-2024-10973 | Medium | 5.7 | 2024-12-17 | A vulnerability was found in Keycloak. The environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is alway… |
CVE-2024-49820 | Low | 3.7 | 2024-12-17 | IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information, caused by the failure t… |
CVE-2024-49819 | Medium | 4.1 | 2024-12-17 | IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information in cleartext in a commun… |
CVE-2024-53246 | Medium | 5.3 | 2024-12-10 | In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.3.2408.101, 9.2.2406.106, 9.2.2403.111, and 9.1.2312.206… |
CVE-2024-47577 | Low | 2.7 | 2024-12-10 | Webservice API endpoints for Assisted Service Module within SAP Commerce Cloud has information disclosure vulnerability. When an authorized agent searches for… |
CVE-2024-6515 | Critical | 9.6 | 2024-12-05 | Web browser interface may manipulate application username/password in clear text or Base64 encoding providing a higher probability of unintended credentails e… |
CVE-2021-29892 | Medium | 5.9 | 2024-12-03 | IBM Cognos Controller 11.0.0 and 11.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Tra… |
CVE-2024-9834 | Critical | 9.3 | 2024-11-14 | Improper data protection on the ventilator's serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of in… |
CVE-2024-28169 | Medium | 5.4 | 2024-11-13 | Cleartext transmission of sensitive information for some BigDL software maintained by Intel(R) before version 2.5.0 may allow an authenticated user to potentia… |
CVE-2024-43432 | Medium | 5.3 | 2024-11-11 | A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request header… |
CVE-2024-50634 | High | 8.8 | 2024-11-08 | A vulnerability in a weak JWT token in Watcharr v1.43.0 and below allows attackers to perform privilege escalation using a crafted JWT token. This vulnerabilit… |
CVE-2024-32946 | Medium | 5.9 | 2024-10-30 | A vulnerability in the LevelOne WBR-6012 router's firmware version R0.40e6 allows sensitive information to be transmitted in cleartext via Web and FTP services… |
CVE-2024-8013 | Low | 2.2 | 2024-10-28 | A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to… |
CVE-2024-50624 | Medium | 5.9 | 2024-10-28 | ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-controlled mail server because cleartext HTTP is us… |
CVE-2024-40595 | Medium | 5.3 | 2024-10-24 | An authentication-bypass issue in the RDP component of One Identity Safeguard for Privileged Sessions (SPS) On Premise before 7.5.1 (and LTS before 7.0.5.1) al… |
CVE-2024-40090 | Medium | 4.3 | 2024-10-21 | Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Information Disclosure. An information leak in the Boa webserver allows remote, unauthenticated attackers… |
CVE-2024-49387 | High | 7.5 | 2024-10-15 | Cleartext transmission of sensitive information in acep-collector service. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) befor… |
CVE-2024-48788 | High | 7.5 | 2024-10-11 | An issue in YESCAM (com.yescom.YesCam.zwave) 1.0.2 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-47833 | Medium | 6.5 | 2024-10-09 | Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions se… |
CVE-2024-9620 | Medium | 5.3 | 2024-10-08 | A flaw was found in Event-Driven Automation (EDA) in Ansible Automation Platform (AAP), which lacks encryption of sensitive information. An attacker with netwo… |
CVE-2024-47789 | | 2024-10-04 | ** UNSUPPORTED WHEN ASSIGNED ** This vulnerability exists in D3D Security IP Camera D8801 due to usage of weak authentication scheme of the HTTP header protoco… | |
CVE-2024-35495 | Medium | 4.3 | 2024-09-30 | An Information Disclosure vulnerability in the Telemetry component in TP-Link Kasa KP125M V1.0.0 and Tapo P125M 1.0.0 Build 220930 Rel.143947 allows attackers… |
CVE-2024-7713 | High | 7.5 | 2024-09-27 | The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 discloses the Open AI API Key, allowing unauthenticated users to obtain… |
CVE-2024-47124 | Medium | 4.3 | 2024-09-26 | The goTenna Pro App does not encrypt callsigns in messages. It is recommended to not use sensitive information in callsigns when using this and previous vers… |
CVE-2024-45838 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin does not encrypt callsigns in messages. It is advised to not use sensitive information in callsigns when using this and previous… |
CVE-2024-8059 | Medium | 4.3 | 2024-09-13 | IPMI credentials may be captured in XCC audit log entries when the account username length is 16 characters. |
CVE-2024-45101 | Medium | 6.8 | 2024-09-13 | A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, authenticated LXCA… |
CVE-2024-43180 | Medium | 4.3 | 2024-09-13 | IBM Concert 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http… |
CVE-2024-44105 | High | 8.2 | 2024-09-10 | Cleartext transmission of sensitive information in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authent… |
CVE-2024-41927 | Medium | 4.6 | 2024-09-04 | Cleartext transmission of sensitive information vulnerability exists in multiple IDEC PLCs. If an attacker sends a specific command to PLC's serial communicati… |
CVE-2024-39746 | Medium | 5.9 | 2024-08-22 | IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properl… |
CVE-2024-31905 | Medium | 5.9 | 2024-08-15 | IBM QRadar Network Packet Capture 7.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Trans… |
CVE-2024-31799 | Medium | 4.6 | 2024-08-15 | Information Disclosure in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to read the WiFi passphrase via the UART Debugging Po… |
CVE-2024-38167 | Medium | 6.5 | 2024-08-13 | .NET and Visual Studio Information Disclosure Vulnerability |
CVE-2024-7408 | Medium | 6.5 | 2024-08-12 | This vulnerability exists in Airveda Air Quality Monitor PM2.5 PM10 due to transmission of sensitive information in plain text during AP pairing mode. An attac… |
CVE-2024-38891 | High | 7.5 | 2024-08-02 | An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Sniffin… |
CVE-2024-32864 | Medium | 6.4 | 2024-08-01 | Under certain circumstances exacqVision Web Services will not enforce secure web communications (HTTPS) |
CVE-2024-41262 | High | 7.4 | 2024-07-31 | mmudb v1.9.3 was discovered to use the HTTP protocol in the ShowMetricsRaw and ShowMetricsAsText functions, possibly allowing attackers to intercept communicat… |
CVE-2024-41687 | High | 7.5 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to transmission of password in plain text. A remote attacker could exploit this vulnerabili… |
CVE-2024-6972 | Medium | 6.5 | 2024-07-25 | In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in clear-text. |
CVE-2024-41124 | Medium | 6.3 | 2024-07-19 | Puncia is the Official CLI utility for Subdomain Center & Exploit Observer. `API_URLS` is utilizing HTTP instead of HTTPS for communication that can lead to is… |
CVE-2024-5631 | | 2024-07-09 | Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, are transmitting user's login and password to a remote contro… | |
CVE-2024-6388 | Medium | 5.9 | 2024-06-27 | Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an a… |
CVE-2024-37183 | Medium | 5.7 | 2024-06-20 | Plain text credentials and session ID can be captured with a network sniffer. |
CVE-2024-0066 | Medium | 5.3 | 2024-06-18 | Johan Fagerström, member of the AXIS OS Bug Bounty Program, has found that a O3C feature may expose sensitive traffic between the client (Axis device) and (O3C… |
CVE-2024-27166 | High | 7.4 | 2024-06-14 | Coredump binaries in Toshiba printers have incorrect permissions. A local attacker can steal confidential information. As for the affected products/models/vers… |
CVE-2024-27163 | Medium | 6.5 | 2024-06-14 | Toshiba printers will display the password of the admin user in clear-text and additional passwords when sending 2 specific HTTP requests to the internal API… |
CVE-2024-35210 | Medium | 5.1 | 2024-06-11 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server is not enforcing HSTS. This c… |
CVE-2024-37393 | High | 7.5 | 2024-06-10 | Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote at… |
CVE-2024-37163 | Medium | 6.4 | 2024-06-07 | SkyScrape is a GUI Dashboard for AWS Infrastructure and Managing Resources and Usage Costs. SkyScrape's API requests are currently unsecured HTTP requests, le… |
CVE-2024-36426 | High | 7.5 | 2024-05-27 | In TARGIT Decision Suite 23.2.15007.0 before Autumn 2023, the session token is part of the URL and may be sent in a cleartext HTTP session. |
CVE-2024-35060 | High | 7.5 | 2024-05-21 | An issue in the YAML Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands via supplying a crafted YAML file. |
CVE-2024-35059 | High | 7.5 | 2024-05-21 | An issue in the Pickle Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands. |
CVE-2024-35058 | High | 7.5 | 2024-05-21 | An issue in the API wait function of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via supplying a crafted string. |
CVE-2024-35057 | High | 7.5 | 2024-05-21 | An issue in NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via a crafted packet. |
CVE-2024-31840 | Medium | 6.5 | 2024-05-21 | An issue was discovered in Italtel Embrace 1.6.4. The web application inserts cleartext passwords in the HTML source code. An authenticated user is able to edi… |
CVE-2024-30209 | Critical | 9.6 | 2024-05-14 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (… |
CVE-2024-28134 | High | 7.0 | 2024-05-14 | An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-b… |
CVE-2024-0098 | Medium | 5.5 | 2024-05-14 | NVIDIA ChatRTX for Windows contains a vulnerability in the ChatRTX UI and backend, where a user can cause a clear-text transmission of sensitive information is… |
CVE-2022-32510 | High | 7.1 | 2024-05-14 | An issue was discovered on certain Nuki Home Solutions devices. The HTTP API exposed by a Bridge used an unencrypted channel to provide an administrative inter… |
CVE-2024-1657 | High | 8.1 | 2024-04-25 | A flaw was found in the ansible automation platform. An insecure WebSocket connection was being used in installation from the Ansible rulebook EDA server. An a… |
CVE-2024-4161 | High | 8.6 | 2024-04-25 | In Brocade SANnav, before Brocade SANnav v2.3.0, syslog traffic received clear text. This could allow an unauthenticated, remote attacker to capture sensitiv… |
CVE-2023-4509 | Medium | 4.3 | 2024-04-18 | It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt. |
CVE-2024-31206 | High | 8.2 | 2024-04-04 | dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `dectalk-tts@1.0.0`, network requests to the third-party API are sent over HTTP, w… |
CVE-2024-28275 | Medium | 6.5 | 2024-04-03 | Puwell Cloud Tech Co, Ltd 360Eyes Pro v3.9.5.16(3090516) was discovered to transmit sensitive information in cleartext. This vulnerability allows attackers to… |
CVE-2024-25960 | High | 7.3 | 2024-03-28 | Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains a cleartext transmission of sensitive information vulnerability. A local low privileged attacke… |
CVE-2024-25735 | Critical | 9.1 | 2024-03-27 | An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext passwords via a SoftAP /device/config GET reque… |
CVE-2024-28250 | Medium | 6.1 | 2024-03-18 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.8 and 1.15.2… |
CVE-2024-28249 | Medium | 6.1 | 2024-03-18 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters wi… |
CVE-2024-0860 | High | 8.0 | 2024-03-14 | The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker to capture packets to craft… |
CVE-2024-25650 | Medium | 5.9 | 2024-03-14 | Insecure key exchange between Delinea PAM Secret Server 11.4 and the Distributed Engine 8.4.3 allows a PAM administrator to obtain the Symmetric Key (used to e… |
CVE-2024-26288 | High | 8.7 | 2024-03-12 | An unauthenticated remote attacker can influence the communication due to the lack of encryption of sensitive data via a MITM. Charging is not affected. |
CVE-2023-27291 | Medium | 4.5 | 2024-03-03 | IBM Watson CP4D Data Stores 4.6.0, 4.6.1, 4.6.2, and 4.6.3 does not encrypt sensitive or critical information before storage or transmission which could allow… |
CVE-2023-47745 | Medium | 6.2 | 2024-03-03 | IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 stores or tra… |
CVE-2021-39090 | Medium | 5.9 | 2024-02-29 | IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly en… |
CVE-2024-0220 | High | 8.3 | 2024-02-22 | B&R Automation Studio Upgrade Service and B&R Technology Guarding use insufficient cryptography for communication to the upgrade and the licensing servers. A n… |
CVE-2024-25631 | Medium | 6.1 | 2024-02-20 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who have enabled an external kvstore and Wireguard… |
CVE-2024-25630 | Medium | 6.1 | 2024-02-20 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cilium state (the defau… |
CVE-2023-39245 | Critical | 9.8 | 2024-02-15 | DELL ESI (Enterprise Storage Integrator) for SAP LAMA, version 10.0, contains an information disclosure vulnerability in EHAC component. An remote unauthentic… |
CVE-2024-21406 | High | 7.5 | 2024-02-13 | Windows Printing Service Spoofing Vulnerability |
CVE-2023-45716 | Low | 1.7 | 2024-02-09 | Sametime is impacted by sensitive information passed in URL. |
CVE-2023-42016 | Medium | 4.3 | 2024-02-09 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 does not set the secure attribute on authorization tokens or s… |
CVE-2023-32328 | High | 7.5 | 2024-02-07 | IBM Security Verify Access 10.0.0.0 through 10.0.6.1 uses insecure protocols in some instances that could allow an attacker on the network to take control of t… |