CWE-319 · Cleartext Transmission of Sensitive Information (page 4)
Page 4 of 9 — CVEs classified under CWE-319, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-40544 | Medium | 5.7 | 2024-02-06 | An attacker with access to the network where the affected devices are located could maliciously actions to obtain, via a sniffer, sensitive informat… |
CVE-2023-50962 | Medium | 5.9 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 MFA does not implement the "HTTP Strict Transport Security" (HSTS) web security policy mechanism. IBM X-Force ID: 276004. |
CVE-2023-46889 | Medium | 5.7 | 2024-01-23 | Meross MSH30Q 4.5.23 is vulnerable to Cleartext Transmission of Sensitive Information. During the device setup phase, the MSH30Q creates an unprotected Wi-Fi a… |
CVE-2023-42144 | Medium | 5.5 | 2024-01-23 | Cleartext Transmission during initial setup in Shelly TRV 20220811-15234 v.2.1.8 allows a local attacker to obtain the Wi-Fi password. |
CVE-2023-46447 | Medium | 4.3 | 2024-01-20 | The POPS! Rebel application 5.0 for Android, in POPS! Rebel Bluetooth Glucose Monitoring System, sends unencrypted glucose measurements over BLE. |
CVE-2023-50614 | High | 7.5 | 2024-01-18 | An issue discovereed in EBYTE E880-IR01-V1.1 allows an attacker to obtain sensitive information via crafted POST request to /cgi-bin/luci. |
CVE-2023-51741 | High | 7.5 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to transmission of authentication credentials in plaintext over the network. A remote… |
CVE-2023-51740 | High | 7.5 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to transmission of authentication credentials in plaintext over the network. A remote… |
CVE-2024-0056 | High | 8.7 | 2024-01-09 | Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability |
CVE-2023-6094 | Medium | 5.3 | 2023-12-31 | A vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior. The vulnerability results from lack of protection for sensiti… |
CVE-2023-31300 | High | 7.5 | 2023-12-29 | An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via t… |
CVE-2023-34829 | Medium | 6.5 | 2023-12-28 | Incorrect access control in TP-Link Tapo before v3.1.315 allows attackers to access user credentials in plaintext. |
CVE-2023-28616 | High | 7.5 | 2023-12-26 | An issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1. It affects user accounts… |
CVE-2023-51390 | Medium | 6.5 | 2023-12-21 | journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out… |
CVE-2023-50703 | Medium | 6.3 | 2023-12-20 | An attacker with network access could perform a man-in-the-middle (MitM) attack and capture sensitive information to gain unauthorized access to the applicati… |
CVE-2023-39172 | Critical | 9.1 | 2023-12-07 | The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic. |
CVE-2023-24547 | Medium | 5.9 | 2023-12-06 | On affected platforms running Arista MOS, the configuration of a BGP password will cause the password to be logged in clear text that can be revealed in local… |
CVE-2023-42579 | Medium | 6.5 | 2023-12-05 | Improper usage of insecure protocol (i.e. HTTP) in SogouSDK of Chinese Samsung Keyboard prior to versions 5.3.70.1 in Android 11, 5.4.60.49, 5.4.85.5, 5.5.00.5… |
CVE-2023-46385 | High | 7.5 | 2023-11-30 | LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. An admin credential is passed as a value of URL parameters with… |
CVE-2023-46383 | High | 7.5 | 2023-11-30 | LOYTEC electronics GmbH LINX Configurator (all versions) uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext an… |
CVE-2023-6248 | Critical | 10.0 | 2023-11-21 | The Syrus4 IoT gateway utilizes an unsecured MQTT server to download and execute arbitrary commands, allowing a remote unauthenticated attacker to execute code… |
CVE-2023-43503 | Low | 3.5 | 2023-11-14 | A vulnerability has been identified in COMOS (All versions < V10.4.4). Caching system in the affected application leaks sensitive information such as user and… |
CVE-2023-46382 | High | 7.5 | 2023-11-04 | LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) use cleartext HTTP for login. |
CVE-2023-46380 | High | 7.5 | 2023-11-04 | LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) send password-change requests via cleartex… |
CVE-2017-7252 | High | 7.5 | 2023-11-03 | bcrypt password hashing in Botan before 2.1.0 does not correctly handle passwords with a length between 57 and 72 characters, which makes it easier for attacke… |
CVE-2023-5035 | Low | 3.1 | 2023-11-02 | A vulnerability has been identified in PT-G503 Series firmware versions prior to v5.2, where the Secure attribute for sensitive cookies in HTTPS sessions is no… |
CVE-2023-45321 | High | 8.3 | 2023-10-25 | The Android Client application, when enrolled with the define method 1 (the user manually inserts the server ip address), use HTTP protocol to retrieve sensit… |
CVE-2023-33837 | Medium | 4.1 | 2023-10-23 | IBM Security Verify Governance 10.0 does not encrypt sensitive or critical information before storage or transmission. IBM X-Force ID: 256020. |
CVE-2023-38276 | Medium | 5.9 | 2023-10-22 | IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 exposes sensitive information in environment variables which could aid in further attacks against the system… |
CVE-2023-38275 | Medium | 5.9 | 2023-10-22 | IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 exposes sensitive information in container images which could lead to further attacks against the system. IB… |
CVE-2023-41088 | Medium | 6.3 | 2023-10-19 | The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker with access to th… |
CVE-2023-34441 | Medium | 6.8 | 2023-10-19 | Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to stea… |
CVE-2022-22385 | Medium | 5.9 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information to an attacked due to the transmission of data in clear text. IBM X-Force… |
CVE-2023-5461 | Low | 3.7 | 2023-10-09 | A vulnerability was found in Delta Electronics WPLSoft 2.51. It has been classified as problematic. Affected is an unknown function of the component Modbus Han… |
CVE-2023-5100 | Medium | 5.9 | 2023-10-09 | Cleartext Transmission of Sensitive Information in RDT400 in SICK APU allows an unprivileged remote attacker to retrieve potentially sensitive information via… |
CVE-2023-23371 | Medium | 5.2 | 2023-10-06 | A cleartext transmission of sensitive information vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow loc… |
CVE-2023-3361 | High | 7.7 | 2023-10-04 | A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 creden… |
CVE-2022-47892 | Medium | 5.3 | 2023-10-03 | All versions of NetMan 204 could allow an unauthenticated remote attacker to read a file (config.cgi) containing sensitive information, like credentials. |
CVE-2023-43125 | Medium | 6.8 | 2023-09-27 | BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated |
CVE-2023-43124 | Medium | 5.3 | 2023-09-27 | BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated |
CVE-2023-42147 | High | 7.5 | 2023-09-20 | An issue in CloudExplorer Lite 1.3.1 allows an attacker to obtain sensitive information via the login key component. |
CVE-2022-47560 | Medium | 5.7 | 2023-09-20 | The lack of web request control on ekorCCP and ekorRCI devices allows a potential attacker to create custom requests to execute malicious actions when a user i… |
CVE-2022-3261 | Medium | 4.4 | 2023-09-15 | A flaw was found in OpenStack. Multiple components show plain-text passwords in /var/log/messages during the OpenStack overcloud update run, leading to a discl… |
CVE-2023-4918 | High | 8.8 | 2023-09-12 | A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" an… |
CVE-2023-40729 | High | 7.3 | 2023-09-12 | A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application lacks security control to prevent unencrypted communica… |
CVE-2023-34998 | High | 8.1 | 2023-09-05 | An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series… |
CVE-2023-22870 | Medium | 5.9 | 2023-09-05 | IBM Aspera Faspex 5.0.5 transmits sensitive information in cleartext which could be obtained by an attacker using man in the middle techniques. IBM X-Force ID… |
CVE-2023-25848 | Medium | 5.3 | 2023-08-25 | ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query… |
CVE-2023-34972 | Low | 3.5 | 2023-08-24 | A cleartext transmission of sensitive information vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly al… |
CVE-2023-36673 | High | 7.3 | 2023-08-09 | An issue was discovered in Avira Phantom VPN through 2.23.1 for macOS. The VPN client insecurely configures the operating system such that all IP traffic to th… |
CVE-2023-36672 | Medium | 5.7 | 2023-08-09 | An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS. The VPN client insecurely configures the operating system such that traffic to t… |
CVE-2023-36671 | Medium | 6.3 | 2023-08-09 | An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS. The VPN client insecurely configures the operating system such that all IP traff… |
CVE-2023-39086 | High | 7.5 | 2023-08-08 | ASUS RT-AC66U B1 3.0.0.4.286_51665 was discovered to transmit sensitive information in cleartext. |
CVE-2023-2754 | High | 7.4 | 2023-08-03 | The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local DNS server that performs DNS queries in a… |
CVE-2023-3763 | Low | 3.7 | 2023-07-19 | A vulnerability was found in Intergard SGS 8.7.0. It has been declared as problematic. This vulnerability affects unknown code of the component SQL Query Handl… |
CVE-2023-3761 | Low | 3.7 | 2023-07-19 | A vulnerability was found in Intergard SGS 8.7.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Password… |
CVE-2023-34142 | Critical | 9.0 | 2023-07-18 | Cleartext Transmission of Sensitive Information vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Server, Device Manager Agent, Host Da… |
CVE-2023-30565 | Low | 3.5 | 2023-07-13 | An insecure connection between Systems Manager and CQI Reporter application could expose infusion data to an attacker. |
CVE-2023-35833 | Medium | 6.5 | 2023-07-13 | An issue was discovered in YSoft SAFEQ 6 Server before 6.0.82. When modifying the URL of the LDAP server configuration from LDAPS to LDAP, the system does not… |
CVE-2023-31823 | High | 7.5 | 2023-07-13 | An issue found in Marui Co Marui Official app v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the min… |
CVE-2023-3272 | High | 7.5 | 2023-07-10 | Cleartext Transmission of Sensitive Information in the SICK ICR890-4 could allow a remote attacker to gather sensitive information by intercepting network traf… |
CVE-2023-21220 | High | 7.5 | 2023-06-28 | there is a possible use of unencrypted transport over cellular networks due to an insecure default value. This could lead to remote information disclosure with… |
CVE-2023-21219 | High | 7.5 | 2023-06-28 | there is a possible use of unencrypted transport over cellular networks due to an insecure default value. This could lead to remote information disclosure with… |
CVE-2023-31410 | Critical | 9.8 | 2023-06-19 | A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security (TLS) in the SICK Eve… |
CVE-2023-23841 | High | 7.5 | 2023-06-15 | SolarWinds Serv-U is submitting an HTTP request when changing or updating the attributes for File Share or File request. Part of the URL of the request disclo… |
CVE-2023-31195 | Medium | 5.3 | 2023-06-13 | ASUS Router RT-AX3000 Firmware versions prior to 3.0.0.4.388.23403 uses sensitive cookies without 'Secure' attribute. When an attacker is in a position to be a… |
CVE-2022-41327 | High | 7.8 | 2023-06-13 | A cleartext transmission of sensitive information vulnerability [CWE-319] in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.8, FortiProxy vers… |
CVE-2023-27861 | Medium | 5.9 | 2023-06-05 | IBM Maximo Application Suite - Manage Component 8.8.0 and 8.9.0 transmits sensitive information in cleartext that could be intercepted by an attacker using man… |
CVE-2023-30602 | High | 7.5 | 2023-06-02 | Hitron Technologies CODA-5310’s Telnet function transfers sensitive data in plaintext. An unauthenticated remote attacker can exploit this vulnerability to acc… |
CVE-2023-33960 | High | 7.5 | 2023-06-01 | OpenProject is web-based project management software. For any OpenProject installation, a `robots.txt` file is generated through the server to denote which rou… |
CVE-2023-3028 | High | 8.6 | 2023-06-01 | Insufficient authentication in the MQTT backend (broker) allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles us… |
CVE-2023-33730 | Critical | 9.8 | 2023-05-31 | Privilege Escalation in the "GetUserCurrentPwd" function in Microworld Technologies eScan Management Console 14.0.1400.2281 allows any remote attacker to retri… |
CVE-2023-28348 | High | 7.4 | 2023-05-31 | An issue was discovered in Faronics Insight 10.0.19045 on Windows. A suitably positioned attacker could perform a man-in-the-middle attack on either a connecte… |
CVE-2023-33187 | Medium | 5.4 | 2023-05-26 | Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `… |
CVE-2023-31193 | High | 7.5 | 2023-05-22 | Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers. Because they do not use HTTPS, OvrC Pr… |
CVE-2022-46680 | High | 8.8 | 2023-05-22 | A CWE-319: Cleartext transmission of sensitive information vulnerability exists that could cause disclosure of sensitive information, denial of service, or mo… |
CVE-2023-0864 | High | 7.1 | 2023-05-17 | Cleartext Transmission of Sensitive Information vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (CE) (Terr… |
CVE-2023-32784 | High | 7.5 | 2023-05-15 | In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. T… |
CVE-2023-30354 | Critical | 9.8 | 2023-05-10 | Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 does not defend against physical access to U-Boot via the UART: the Wi-Fi password is shown, and th… |
CVE-2023-25070 | Medium | 6.5 | 2023-05-10 | Cleartext transmission of sensitive information exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier. If the telnet connection is enabled, a remote… |
CVE-2023-32290 | High | 7.5 | 2023-05-07 | The myMail app through 14.30 for iOS sends cleartext credentials in a situation where STARTTLS is expected by a server. |
CVE-2023-29681 | Medium | 5.7 | 2023-05-01 | Cleartext Transmission in cookie:ecos_pw: in Tenda N301 v6.0, firmware v12.03.01.06_pt allows an authenticated attacker on the LAN or WLAN to intercept communi… |
CVE-2023-29680 | Medium | 5.7 | 2023-05-01 | Cleartext Transmission in set-cookie:ecos_pw: Tenda N301 v6.0, Firmware v12.02.01.61_multi allows an authenticated attacker on the LAN or WLAN to intercept com… |
CVE-2023-25437 | High | 8.8 | 2023-04-27 | An issue was discovered in vTech VCS754 version 1.1.1.A before 1.1.1.H, allows attackers to gain escalated privileges and gain sensitive information due to cle… |
CVE-2023-30841 | Medium | 6.0 | 2023-04-26 | Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Bare… |
CVE-2023-1831 | High | 7.2 | 2023-04-17 | Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logg… |
CVE-2019-14942 | Medium | 5.9 | 2023-04-16 | An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Cookies for GitLab Pages (which ha… |
CVE-2023-30515 | High | 7.5 | 2023-04-12 | Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mod… |
CVE-2023-30514 | High | 7.5 | 2023-04-12 | Jenkins Azure Key Vault Plugin 187.va_cd5fecd198a_ and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mod… |
CVE-2023-30513 | High | 7.5 | 2023-04-12 | Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for… |
CVE-2023-1802 | Medium | 5.9 | 2023-04-06 | In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targete… |
CVE-2023-0922 | Medium | 5.9 | 2023-04-03 | The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection. |
CVE-2023-1656 | High | 7.5 | 2023-03-29 | Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc. OpenIDM and Java Remote Connector Server (RCS) LDAP Connector on Windows, MacOS… |
CVE-2023-27927 | Medium | 6.5 | 2023-03-27 | An authenticated malicious user could acquire the simple mail transfer protocol (SMTP) Password in cleartext format, despite it being protected and hidden behi… |
CVE-2022-38458 | Medium | 6.5 | 2023-03-21 | A cleartext transmission vulnerability exists in the Remote Management functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted man-in-the-midd… |
CVE-2023-0053 | High | 7.5 | 2023-03-02 | SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior have only FTP and Telnet available for dev… |
CVE-2022-32906 | Medium | 5.3 | 2023-02-27 | This issue was addressed with using HTTPS when sending information over the network. This issue is fixed in Apple Music 3.9.10 for Android. A user in a privile… |
CVE-2023-23915 | Medium | 6.5 | 2023-02-23 | A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple… |
CVE-2023-23914 | Critical | 9.1 | 2023-02-23 | A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are request… |
CVE-2022-45546 | High | 7.5 | 2023-02-15 | Information Disclosure in Authentication Component of ScreenCheck BadgeMaker 2.6.2.0 application allows internal attacker to obtain credentials for authenticat… |