CWE-319 · Cleartext Transmission of Sensitive Information (page 3)
Page 3 of 10 — CVEs classified under CWE-319, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-44251 | High | 7.5 | 2025-07-10 | Ecovacs Deebot T10 1.7.2 transmits Wi-Fi credentials in cleartext during the pairing process. |
CVE-2025-27457 | Medium | 6.5 | 2025-07-03 | All communication between the VNC server and client(s) is unencrypted. This allows an attacker to intercept the traffic and obtain sensitive data. |
CVE-2025-36034 | Medium | 5.3 | 2025-06-26 | IBM InfoSphere DataStage Flow Designer in IBM InfoSphere Information Server 11.7 discloses sensitive user information in API requests in clear text that could… |
CVE-2025-5087 | | 2025-06-24 | Kaleris NAVIS N4 ULC (Ultra Light Client) communicates insecurely using zlib-compressed data over HTTP. An attacker capable of observing network traffic betwee… | |
CVE-2025-4378 | Critical | 10.0 | 2025-06-24 | Cleartext Transmission of Sensitive Information, Use of Hard-coded Credentials vulnerability in Ataturk University ATA-AOF Mobile Application allows Authentica… |
CVE-2025-32880 | Critical | 9.8 | 2025-06-20 | An issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a WLAN. With WLAN access, the COROS Pace 3 d… |
CVE-2025-26199 | Critical | 9.8 | 2025-06-18 | CloudClassroom-PHP-Project v1.0 is affected by an insecure credential transmission vulnerability. The application transmits passwords over unencrypted HTTP dur… |
CVE-2025-4227 | Low | 3.5 | 2025-06-13 | An improper access control vulnerability in the Endpoint Traffic Policy Enforcement https://docs.paloaltonetworks.com/globalprotect/6-0/globalprotect-app-new-… |
CVE-2025-49194 | High | 7.5 | 2025-06-12 | The server supports authentication methods in which credentials are sent in plaintext over unencrypted channels. If an attacker were to intercept traffic betwe… |
CVE-2025-49183 | High | 7.5 | 2025-06-12 | All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver. This leads to the poss… |
CVE-2025-44612 | Medium | 5.9 | 2025-05-30 | Tinxy WiFi Lock Controller v1 RF was discovered to transmit sensitive information in plaintext, including control information and device credentials, allowing… |
CVE-2025-5270 | High | 7.5 | 2025-05-27 | In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled. This vulnerability was fixed in Firefox 139 and Thunderbird 139. |
CVE-2025-3480 | Medium | 6.5 | 2025-05-22 | MedDream WEB DICOM Viewer Cleartext Transmission of Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to d… |
CVE-2025-0136 | | 2025-05-14 | Using the AES-128-CCM algorithm for IPSec on certain Palo Alto Networks PAN-OS® firewalls (PA-7500, PA-5400, PA-5400f, PA-3400, PA-1600, PA-1400, and PA-400 Se… | |
CVE-2025-40583 | Medium | 4.4 | 2025-05-13 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V2.1 HF0 with SINEMA Remote Connect Edge Client installed). Affect… |
CVE-2025-27720 | High | 7.4 | 2025-05-08 | The Pixmeo Osirix MD Web Portal sends credential information without encryption, which could allow an attacker to steal credentials. |
CVE-2024-12378 | Critical | 9.1 | 2025-05-08 | On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan t… |
CVE-2025-47419 | | 2025-05-06 | Cleartext Transmission of Sensitive Information vulnerability in Crestron Automate VX allows Sniffing Network Traffic. The device allows Web UI and API access… | |
CVE-2025-32887 | High | 7.1 | 2025-05-01 | An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. A command channel includes the next hop. which can be intercepted and used to… |
CVE-2025-32884 | Medium | 4.3 | 2025-05-01 | An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. By default, a GID is the user's phone number unless they specifically opt o… |
CVE-2025-32881 | Medium | 4.3 | 2025-05-01 | An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. By default, the GID is the user's phone number unless they specifically opt o… |
CVE-2025-25046 | Low | 3.7 | 2025-04-23 | IBM InfoSphere Information Server 11.7 DataStage Flow Designer transmits sensitive information via URL or query parameters that could be exposed to an unauth… |
CVE-2025-42603 | | 2025-04-23 | This vulnerability exists in the Meon KYC solutions due to transmission of sensitive data in plain text within the response payloads of certain API endpoints… | |
CVE-2025-32793 | Medium | 4.0 | 2025-04-21 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.15.0 to 1.15.15, 1.16.0 to 1.16.8, and 1.17.0 to 1.17.2… |
CVE-2025-43013 | Medium | 6.9 | 2025-04-17 | In JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possible |
CVE-2025-43704 | Medium | 4.7 | 2025-04-16 | Arctera/Veritas Data Insight before 7.1.2 can send cleartext credentials when configured to use HTTP Basic Authentication to a Dell Isilon OneFS server. |
CVE-2025-27722 | Medium | 5.9 | 2025-04-09 | Cleartext transmission of sensitive information issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a man-in-the-middle attack may allow a remote… |
CVE-2025-26654 | Medium | 6.8 | 2025-04-08 | SAP Commerce Cloud (Public Cloud) does not allow to disable unencrypted HTTP (port 80) entirely, but instead allows a redirect from port 80 to 443 (HTTPS). As… |
CVE-2025-3329 | Low | 3.1 | 2025-04-07 | A vulnerability classified as problematic has been found in Consumer Comanda Mobile up to 14.9.3.2/15.0.0.8. This affects an unknown part of the component Rest… |
CVE-2025-2861 | High | 7.5 | 2025-03-28 | SaTECH BCU in its firmware version 2.1.3 uses the HTTP protocol. The use of the HTTP protocol for web browsing has the problem that information is exchanged in… |
CVE-2024-45361 | Medium | 6.5 | 2025-03-27 | A protocol flaw vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited b… |
CVE-2025-2311 | Critical | 9.0 | 2025-03-20 | Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in Sechard Information Te… |
CVE-2024-10718 | High | 7.5 | 2025-03-20 | In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set. This could cause the user agent to send those cookie… |
CVE-2024-44276 | High | 7.3 | 2025-03-17 | This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in iOS 18.2 and iPadOS 18.2. A user in a privileged netw… |
CVE-2025-27594 | High | 7.5 | 2025-03-14 | The device uses an unencrypted, proprietary protocol for communication. Through this protocol, configuration data is transmitted and device authentication is p… |
CVE-2024-13872 | High | 7.5 | 2025-03-12 | Bitdefender Box, versions 1.3.11.490 through 1.3.11.505, uses the insecure HTTP protocol to download assets over the Internet to update and restart daemons and… |
CVE-2025-22493 | Medium | 5.6 | 2025-03-05 | Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software (FRS). Absence of this secure flag could lead into the session cookie being… |
CVE-2025-24849 | High | 7.1 | 2025-02-28 | Lack of encryption in transit for cloud infrastructure facilitating potential for sensitive data manipulation or exposure. |
CVE-2025-25728 | Medium | 6.5 | 2025-02-28 | Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to send communications to the update API in plaintex… |
CVE-2022-41545 | Medium | 6.4 | 2025-02-18 | The administrative web interface of a Netgear C7800 Router running firmware version 6.01.07 (and possibly others) authenticates users via basic authentication… |
CVE-2024-5462 | High | 7.5 | 2025-02-15 | If Brocade Fabric OS before Fabric OS 9.2.0 configuration settings are not set to encrypt SNMP passwords, then the SNMP privsecret / authsecret fields can be e… |
CVE-2025-1060 | High | 7.5 | 2025-02-13 | CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists that could result in the exposure of data when network traffic is being sniffed b… |
CVE-2025-0556 | High | 8.8 | 2025-02-12 | In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communication of non-sensitive… |
CVE-2024-36558 | High | 7.5 | 2025-02-06 | Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h suffers from Cleartext Transmission of Sensitive Information due to lack of en… |
CVE-2024-43187 | Medium | 5.9 | 2025-02-04 | IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 transmits sensitive or security-critical data in cleartext in a communication channel… |
CVE-2025-23060 | Medium | 6.6 | 2025-02-04 | A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information. Exploiting this vu… |
CVE-2023-35017 | Medium | 5.9 | 2025-01-29 | IBM Security Verify Governance 10.0.2 Identity Manager can transmit user credentials in clear text that could be obtained by an attacker using man in the middl… |
CVE-2025-0784 | Low | 3.7 | 2025-01-28 | A vulnerability has been found in Intelbras InControl up to 2.21.58 and classified as problematic. This vulnerability affects unknown code of the file /v1/usua… |
CVE-2025-0631 | | 2025-01-28 | A Credential Exposure Vulnerability exists in the above-mentioned product and version. The vulnerability is due to using HTTP resulting in credentials being se… | |
CVE-2025-0432 | Medium | 5.7 | 2025-01-28 | EWON Flexy 202 transmits user credentials in clear text with no encryption when a user is added, or user credentials are changed via its webpage. |
CVE-2024-28786 | Medium | 6.5 | 2025-01-28 | IBM QRadar SIEM 7.5 transmits sensitive or security-critical data in cleartext in a communication channel that could be obtained by an unauthorized actor using… |
CVE-2024-41757 | Medium | 5.9 | 2025-01-24 | IBM Concert Software 1.0.0 and 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transp… |
CVE-2024-26155 | Medium | 6.8 | 2025-01-17 | All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 expose clear text credentials in the web portal. An attacker can access the ETIC RAS w… |
CVE-2024-48121 | Medium | 6.5 | 2025-01-15 | The HI-SCAN 6040i Hitrax HX-03-19-I was discovered to transmit user credentials in cleartext over the GIOP protocol. This allows attackers to possibly gain acc… |
CVE-2024-45102 | Medium | 6.8 | 2025-01-14 | A privilege escalation vulnerability was discovered that could allow a valid, authenticated LXCA user to escalate their permissions for a connected XCC instanc… |
CVE-2024-42181 | Low | 1.6 | 2025-01-12 | HCL MyXalytics is affected by a cleartext transmission of sensitive information vulnerability. The application transmits sensitive or security-critical data i… |
CVE-2024-46505 | Critical | 9.1 | 2025-01-09 | Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities. |
CVE-2024-11946 | Medium | 6.5 | 2024-12-30 | iXsystems TrueNAS CORE fetch_plugin_packagesites tar Cleartext Transmission of Sensitive Information Vulnerability. This vulnerability allows network-adjacent… |
CVE-2021-39081 | Medium | 5.9 | 2024-12-19 | IBM Cognos Analytics Mobile for Android 1.1.14 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive info… |
CVE-2024-10973 | Medium | 5.7 | 2024-12-17 | A vulnerability was found in Keycloak. The environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is alway… |
CVE-2024-49820 | Low | 3.7 | 2024-12-17 | IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information, caused by the failure t… |
CVE-2024-49819 | Medium | 4.1 | 2024-12-17 | IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information in cleartext in a commun… |
CVE-2024-53246 | Medium | 5.3 | 2024-12-10 | In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.3.2408.101, 9.2.2406.106, 9.2.2403.111, and 9.1.2312.206… |
CVE-2024-47577 | Low | 2.7 | 2024-12-10 | Webservice API endpoints for Assisted Service Module within SAP Commerce Cloud has information disclosure vulnerability. When an authorized agent searches for… |
CVE-2024-6515 | Critical | 9.6 | 2024-12-05 | Web browser interface may manipulate application username/password in clear text or Base64 encoding providing a higher probability of unintended credentails e… |
CVE-2021-29892 | Medium | 5.9 | 2024-12-03 | IBM Cognos Controller 11.0.0 and 11.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Tra… |
CVE-2024-9834 | Critical | 9.3 | 2024-11-14 | Improper data protection on the ventilator's serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of in… |
CVE-2024-28169 | Medium | 5.4 | 2024-11-13 | Cleartext transmission of sensitive information for some BigDL software maintained by Intel(R) before version 2.5.0 may allow an authenticated user to potentia… |
CVE-2024-43432 | Medium | 5.3 | 2024-11-11 | A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request header… |
CVE-2024-50634 | High | 8.8 | 2024-11-08 | A vulnerability in a weak JWT token in Watcharr v1.43.0 and below allows attackers to perform privilege escalation using a crafted JWT token. This vulnerabilit… |
CVE-2024-32946 | Medium | 5.9 | 2024-10-30 | A vulnerability in the LevelOne WBR-6012 router's firmware version R0.40e6 allows sensitive information to be transmitted in cleartext via Web and FTP services… |
CVE-2024-8013 | Low | 2.2 | 2024-10-28 | A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to… |
CVE-2024-50624 | Medium | 5.9 | 2024-10-28 | ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-controlled mail server because cleartext HTTP is us… |
CVE-2024-40595 | Medium | 5.3 | 2024-10-24 | An authentication-bypass issue in the RDP component of One Identity Safeguard for Privileged Sessions (SPS) On Premise before 7.5.1 (and LTS before 7.0.5.1) al… |
CVE-2024-40090 | Medium | 4.3 | 2024-10-21 | Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Information Disclosure. An information leak in the Boa webserver allows remote, unauthenticated attackers… |
CVE-2024-49387 | High | 7.5 | 2024-10-15 | Cleartext transmission of sensitive information in acep-collector service. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) befor… |
CVE-2024-48788 | High | 7.5 | 2024-10-11 | An issue in YESCAM (com.yescom.YesCam.zwave) 1.0.2 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-47833 | Medium | 6.5 | 2024-10-09 | Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions se… |
CVE-2024-9620 | Medium | 5.3 | 2024-10-08 | A flaw was found in Event-Driven Automation (EDA) in Ansible Automation Platform (AAP), which lacks encryption of sensitive information. An attacker with netwo… |
CVE-2024-47789 | | 2024-10-04 | ** UNSUPPORTED WHEN ASSIGNED ** This vulnerability exists in D3D Security IP Camera D8801 due to usage of weak authentication scheme of the HTTP header protoco… | |
CVE-2024-35495 | Medium | 4.3 | 2024-09-30 | An Information Disclosure vulnerability in the Telemetry component in TP-Link Kasa KP125M V1.0.0 and Tapo P125M 1.0.0 Build 220930 Rel.143947 allows attackers… |
CVE-2024-7713 | High | 7.5 | 2024-09-27 | The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 discloses the Open AI API Key, allowing unauthenticated users to obtain… |
CVE-2024-47124 | Medium | 4.3 | 2024-09-26 | The goTenna Pro App does not encrypt callsigns in messages. It is recommended to not use sensitive information in callsigns when using this and previous vers… |
CVE-2024-45838 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin does not encrypt callsigns in messages. It is advised to not use sensitive information in callsigns when using this and previous… |
CVE-2024-8059 | Medium | 4.3 | 2024-09-13 | IPMI credentials may be captured in XCC audit log entries when the account username length is 16 characters. |
CVE-2024-45101 | Medium | 6.8 | 2024-09-13 | A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, authenticated LXCA… |
CVE-2024-43180 | Medium | 4.3 | 2024-09-13 | IBM Concert 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http… |
CVE-2024-44105 | High | 8.2 | 2024-09-10 | Cleartext transmission of sensitive information in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authent… |
CVE-2024-41927 | Medium | 4.6 | 2024-09-04 | Cleartext transmission of sensitive information vulnerability exists in multiple IDEC PLCs. If an attacker sends a specific command to PLC's serial communicati… |
CVE-2024-39746 | Medium | 5.9 | 2024-08-22 | IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properl… |
CVE-2024-31905 | Medium | 5.9 | 2024-08-15 | IBM QRadar Network Packet Capture 7.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Trans… |
CVE-2024-31799 | Medium | 4.6 | 2024-08-15 | Information Disclosure in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to read the WiFi passphrase via the UART Debugging Po… |
CVE-2024-38167 | Medium | 6.5 | 2024-08-13 | .NET and Visual Studio Information Disclosure Vulnerability |
CVE-2024-7408 | Medium | 6.5 | 2024-08-12 | This vulnerability exists in Airveda Air Quality Monitor PM2.5 PM10 due to transmission of sensitive information in plain text during AP pairing mode. An attac… |
CVE-2024-38891 | High | 7.5 | 2024-08-02 | An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Sniffin… |
CVE-2024-32864 | Medium | 6.4 | 2024-08-01 | Under certain circumstances exacqVision Web Services will not enforce secure web communications (HTTPS) |
CVE-2024-41262 | High | 7.4 | 2024-07-31 | mmudb v1.9.3 was discovered to use the HTTP protocol in the ShowMetricsRaw and ShowMetricsAsText functions, possibly allowing attackers to intercept communicat… |
CVE-2024-41687 | High | 7.5 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to transmission of password in plain text. A remote attacker could exploit this vulnerabili… |
CVE-2024-6972 | Medium | 6.5 | 2024-07-25 | In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in clear-text. |
CVE-2024-41124 | Medium | 6.3 | 2024-07-19 | Puncia is the Official CLI utility for Subdomain Center & Exploit Observer. `API_URLS` is utilizing HTTP instead of HTTPS for communication that can lead to is… |