CWE-319 · Cleartext Transmission of Sensitive Information (page 4)
Page 4 of 10 — CVEs classified under CWE-319, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-5631 | | 2024-07-09 | Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, are transmitting user's login and password to a remote contro… | |
CVE-2024-6388 | Medium | 5.9 | 2024-06-27 | Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an a… |
CVE-2024-37183 | Medium | 5.7 | 2024-06-20 | Plain text credentials and session ID can be captured with a network sniffer. |
CVE-2024-0066 | Medium | 5.3 | 2024-06-18 | Johan Fagerström, member of the AXIS OS Bug Bounty Program, has found that a O3C feature may expose sensitive traffic between the client (Axis device) and (O3C… |
CVE-2024-27166 | High | 7.4 | 2024-06-14 | Coredump binaries in Toshiba printers have incorrect permissions. A local attacker can steal confidential information. As for the affected products/models/vers… |
CVE-2024-27163 | Medium | 6.5 | 2024-06-14 | Toshiba printers will display the password of the admin user in clear-text and additional passwords when sending 2 specific HTTP requests to the internal API… |
CVE-2024-35210 | Medium | 5.1 | 2024-06-11 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server is not enforcing HSTS. This c… |
CVE-2024-37393 | High | 7.5 | 2024-06-10 | Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote at… |
CVE-2024-37163 | Medium | 6.4 | 2024-06-07 | SkyScrape is a GUI Dashboard for AWS Infrastructure and Managing Resources and Usage Costs. SkyScrape's API requests are currently unsecured HTTP requests, le… |
CVE-2024-36426 | High | 7.5 | 2024-05-27 | In TARGIT Decision Suite 23.2.15007.0 before Autumn 2023, the session token is part of the URL and may be sent in a cleartext HTTP session. |
CVE-2024-35060 | High | 7.5 | 2024-05-21 | An issue in the YAML Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands via supplying a crafted YAML file. |
CVE-2024-35059 | High | 7.5 | 2024-05-21 | An issue in the Pickle Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands. |
CVE-2024-35058 | High | 7.5 | 2024-05-21 | An issue in the API wait function of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via supplying a crafted string. |
CVE-2024-35057 | High | 7.5 | 2024-05-21 | An issue in NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via a crafted packet. |
CVE-2024-31840 | Medium | 6.5 | 2024-05-21 | An issue was discovered in Italtel Embrace 1.6.4. The web application inserts cleartext passwords in the HTML source code. An authenticated user is able to edi… |
CVE-2024-30209 | Critical | 9.6 | 2024-05-14 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (… |
CVE-2024-28134 | High | 7.0 | 2024-05-14 | An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-b… |
CVE-2024-0098 | Medium | 5.5 | 2024-05-14 | NVIDIA ChatRTX for Windows contains a vulnerability in the ChatRTX UI and backend, where a user can cause a clear-text transmission of sensitive information is… |
CVE-2022-32510 | High | 7.1 | 2024-05-14 | An issue was discovered on certain Nuki Home Solutions devices. The HTTP API exposed by a Bridge used an unencrypted channel to provide an administrative inter… |
CVE-2024-1657 | High | 8.1 | 2024-04-25 | A flaw was found in the ansible automation platform. An insecure WebSocket connection was being used in installation from the Ansible rulebook EDA server. An a… |
CVE-2024-4161 | High | 8.6 | 2024-04-25 | In Brocade SANnav, before Brocade SANnav v2.3.0, syslog traffic received clear text. This could allow an unauthenticated, remote attacker to capture sensitiv… |
CVE-2023-4509 | Medium | 4.3 | 2024-04-18 | It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt. |
CVE-2024-31206 | High | 8.2 | 2024-04-04 | dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `dectalk-tts@1.0.0`, network requests to the third-party API are sent over HTTP, w… |
CVE-2024-28275 | Medium | 6.5 | 2024-04-03 | Puwell Cloud Tech Co, Ltd 360Eyes Pro v3.9.5.16(3090516) was discovered to transmit sensitive information in cleartext. This vulnerability allows attackers to… |
CVE-2024-25960 | High | 7.3 | 2024-03-28 | Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains a cleartext transmission of sensitive information vulnerability. A local low privileged attacke… |
CVE-2024-25735 | Critical | 9.1 | 2024-03-27 | An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext passwords via a SoftAP /device/config GET reque… |
CVE-2024-28250 | Medium | 6.1 | 2024-03-18 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.8 and 1.15.2… |
CVE-2024-28249 | Medium | 6.1 | 2024-03-18 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters wi… |
CVE-2024-0860 | High | 8.0 | 2024-03-14 | The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker to capture packets to craft… |
CVE-2024-25650 | Medium | 5.9 | 2024-03-14 | Insecure key exchange between Delinea PAM Secret Server 11.4 and the Distributed Engine 8.4.3 allows a PAM administrator to obtain the Symmetric Key (used to e… |
CVE-2024-26288 | High | 8.7 | 2024-03-12 | An unauthenticated remote attacker can influence the communication due to the lack of encryption of sensitive data via a MITM. Charging is not affected. |
CVE-2023-27291 | Medium | 4.5 | 2024-03-03 | IBM Watson CP4D Data Stores 4.6.0, 4.6.1, 4.6.2, and 4.6.3 does not encrypt sensitive or critical information before storage or transmission which could allow… |
CVE-2023-47745 | Medium | 6.2 | 2024-03-03 | IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 stores or tra… |
CVE-2021-39090 | Medium | 5.9 | 2024-02-29 | IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly en… |
CVE-2024-0220 | High | 8.3 | 2024-02-22 | B&R Automation Studio Upgrade Service and B&R Technology Guarding use insufficient cryptography for communication to the upgrade and the licensing servers. A n… |
CVE-2024-25631 | Medium | 6.1 | 2024-02-20 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who have enabled an external kvstore and Wireguard… |
CVE-2024-25630 | Medium | 6.1 | 2024-02-20 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cilium state (the defau… |
CVE-2023-39245 | Critical | 9.8 | 2024-02-15 | DELL ESI (Enterprise Storage Integrator) for SAP LAMA, version 10.0, contains an information disclosure vulnerability in EHAC component. An remote unauthentic… |
CVE-2024-21406 | High | 7.5 | 2024-02-13 | Windows Printing Service Spoofing Vulnerability |
CVE-2023-45716 | Low | 1.7 | 2024-02-09 | Sametime is impacted by sensitive information passed in URL. |
CVE-2023-42016 | Medium | 4.3 | 2024-02-09 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 does not set the secure attribute on authorization tokens or s… |
CVE-2023-32328 | High | 7.5 | 2024-02-07 | IBM Security Verify Access 10.0.0.0 through 10.0.6.1 uses insecure protocols in some instances that could allow an attacker on the network to take control of t… |
CVE-2023-40544 | Medium | 5.7 | 2024-02-06 | An attacker with access to the network where the affected devices are located could maliciously actions to obtain, via a sniffer, sensitive informat… |
CVE-2023-50962 | Medium | 5.9 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 MFA does not implement the "HTTP Strict Transport Security" (HSTS) web security policy mechanism. IBM X-Force ID: 276004. |
CVE-2023-46889 | Medium | 5.7 | 2024-01-23 | Meross MSH30Q 4.5.23 is vulnerable to Cleartext Transmission of Sensitive Information. During the device setup phase, the MSH30Q creates an unprotected Wi-Fi a… |
CVE-2023-42144 | Medium | 5.5 | 2024-01-23 | Cleartext Transmission during initial setup in Shelly TRV 20220811-15234 v.2.1.8 allows a local attacker to obtain the Wi-Fi password. |
CVE-2023-46447 | Medium | 4.3 | 2024-01-20 | The POPS! Rebel application 5.0 for Android, in POPS! Rebel Bluetooth Glucose Monitoring System, sends unencrypted glucose measurements over BLE. |
CVE-2023-50614 | High | 7.5 | 2024-01-18 | An issue discovereed in EBYTE E880-IR01-V1.1 allows an attacker to obtain sensitive information via crafted POST request to /cgi-bin/luci. |
CVE-2023-51741 | High | 7.5 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to transmission of authentication credentials in plaintext over the network. A remote… |
CVE-2023-51740 | High | 7.5 | 2024-01-17 | This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to transmission of authentication credentials in plaintext over the network. A remote… |
CVE-2024-0056 | High | 8.7 | 2024-01-09 | Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability |
CVE-2023-6094 | Medium | 5.3 | 2023-12-31 | A vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior. The vulnerability results from lack of protection for sensiti… |
CVE-2023-31300 | High | 7.5 | 2023-12-29 | An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via t… |
CVE-2023-34829 | Medium | 6.5 | 2023-12-28 | Incorrect access control in TP-Link Tapo before v3.1.315 allows attackers to access user credentials in plaintext. |
CVE-2023-28616 | High | 7.5 | 2023-12-26 | An issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1. It affects user accounts… |
CVE-2023-51390 | Medium | 6.5 | 2023-12-21 | journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out… |
CVE-2023-50703 | Medium | 6.3 | 2023-12-20 | An attacker with network access could perform a man-in-the-middle (MitM) attack and capture sensitive information to gain unauthorized access to the applicati… |
CVE-2023-39172 | Critical | 9.1 | 2023-12-07 | The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic. |
CVE-2023-24547 | Medium | 5.9 | 2023-12-06 | On affected platforms running Arista MOS, the configuration of a BGP password will cause the password to be logged in clear text that can be revealed in local… |
CVE-2023-42579 | Medium | 6.5 | 2023-12-05 | Improper usage of insecure protocol (i.e. HTTP) in SogouSDK of Chinese Samsung Keyboard prior to versions 5.3.70.1 in Android 11, 5.4.60.49, 5.4.85.5, 5.5.00.5… |
CVE-2023-46385 | High | 7.5 | 2023-11-30 | LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. An admin credential is passed as a value of URL parameters with… |
CVE-2023-46383 | High | 7.5 | 2023-11-30 | LOYTEC electronics GmbH LINX Configurator (all versions) uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext an… |
CVE-2023-6248 | Critical | 10.0 | 2023-11-21 | The Syrus4 IoT gateway utilizes an unsecured MQTT server to download and execute arbitrary commands, allowing a remote unauthenticated attacker to execute code… |
CVE-2023-43503 | Low | 3.5 | 2023-11-14 | A vulnerability has been identified in COMOS (All versions < V10.4.4). Caching system in the affected application leaks sensitive information such as user and… |
CVE-2023-46382 | High | 7.5 | 2023-11-04 | LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) use cleartext HTTP for login. |
CVE-2023-46380 | High | 7.5 | 2023-11-04 | LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) send password-change requests via cleartex… |
CVE-2017-7252 | High | 7.5 | 2023-11-03 | bcrypt password hashing in Botan before 2.1.0 does not correctly handle passwords with a length between 57 and 72 characters, which makes it easier for attacke… |
CVE-2023-5035 | Low | 3.1 | 2023-11-02 | A vulnerability has been identified in PT-G503 Series firmware versions prior to v5.2, where the Secure attribute for sensitive cookies in HTTPS sessions is no… |
CVE-2023-45321 | High | 8.3 | 2023-10-25 | The Android Client application, when enrolled with the define method 1 (the user manually inserts the server ip address), use HTTP protocol to retrieve sensit… |
CVE-2023-33837 | Medium | 4.1 | 2023-10-23 | IBM Security Verify Governance 10.0 does not encrypt sensitive or critical information before storage or transmission. IBM X-Force ID: 256020. |
CVE-2023-38276 | Medium | 5.9 | 2023-10-22 | IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 exposes sensitive information in environment variables which could aid in further attacks against the system… |
CVE-2023-38275 | Medium | 5.9 | 2023-10-22 | IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 exposes sensitive information in container images which could lead to further attacks against the system. IB… |
CVE-2023-41088 | Medium | 6.3 | 2023-10-19 | The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker with access to th… |
CVE-2023-34441 | Medium | 6.8 | 2023-10-19 | Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to stea… |
CVE-2022-22385 | Medium | 5.9 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information to an attacked due to the transmission of data in clear text. IBM X-Force… |
CVE-2023-5461 | Low | 3.7 | 2023-10-09 | A vulnerability was found in Delta Electronics WPLSoft 2.51. It has been classified as problematic. Affected is an unknown function of the component Modbus Han… |
CVE-2023-5100 | Medium | 5.9 | 2023-10-09 | Cleartext Transmission of Sensitive Information in RDT400 in SICK APU allows an unprivileged remote attacker to retrieve potentially sensitive information via… |
CVE-2023-23371 | Medium | 5.2 | 2023-10-06 | A cleartext transmission of sensitive information vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow loc… |
CVE-2023-3361 | High | 7.7 | 2023-10-04 | A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 creden… |
CVE-2022-47892 | Medium | 5.3 | 2023-10-03 | All versions of NetMan 204 could allow an unauthenticated remote attacker to read a file (config.cgi) containing sensitive information, like credentials. |
CVE-2023-43125 | Medium | 6.8 | 2023-09-27 | BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated |
CVE-2023-43124 | Medium | 5.3 | 2023-09-27 | BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated |
CVE-2023-42147 | High | 7.5 | 2023-09-20 | An issue in CloudExplorer Lite 1.3.1 allows an attacker to obtain sensitive information via the login key component. |
CVE-2022-47560 | Medium | 5.7 | 2023-09-20 | The lack of web request control on ekorCCP and ekorRCI devices allows a potential attacker to create custom requests to execute malicious actions when a user i… |
CVE-2022-3261 | Medium | 4.4 | 2023-09-15 | A flaw was found in OpenStack. Multiple components show plain-text passwords in /var/log/messages during the OpenStack overcloud update run, leading to a discl… |
CVE-2023-4918 | High | 8.8 | 2023-09-12 | A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" an… |
CVE-2023-40729 | High | 7.3 | 2023-09-12 | A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application lacks security control to prevent unencrypted communica… |
CVE-2023-34998 | High | 8.1 | 2023-09-05 | An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series… |
CVE-2023-22870 | Medium | 5.9 | 2023-09-05 | IBM Aspera Faspex 5.0.5 transmits sensitive information in cleartext which could be obtained by an attacker using man in the middle techniques. IBM X-Force ID… |
CVE-2023-25848 | Medium | 5.3 | 2023-08-25 | ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query… |
CVE-2023-34972 | Low | 3.5 | 2023-08-24 | A cleartext transmission of sensitive information vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly al… |
CVE-2023-36673 | High | 7.3 | 2023-08-09 | An issue was discovered in Avira Phantom VPN through 2.23.1 for macOS. The VPN client insecurely configures the operating system such that all IP traffic to th… |
CVE-2023-36672 | Medium | 5.7 | 2023-08-09 | An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS. The VPN client insecurely configures the operating system such that traffic to t… |
CVE-2023-36671 | Medium | 6.3 | 2023-08-09 | An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS. The VPN client insecurely configures the operating system such that all IP traff… |
CVE-2023-39086 | High | 7.5 | 2023-08-08 | ASUS RT-AC66U B1 3.0.0.4.286_51665 was discovered to transmit sensitive information in cleartext. |
CVE-2023-2754 | High | 7.4 | 2023-08-03 | The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local DNS server that performs DNS queries in a… |
CVE-2023-3763 | Low | 3.7 | 2023-07-19 | A vulnerability was found in Intergard SGS 8.7.0. It has been declared as problematic. This vulnerability affects unknown code of the component SQL Query Handl… |
CVE-2023-3761 | Low | 3.7 | 2023-07-19 | A vulnerability was found in Intergard SGS 8.7.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Password… |
CVE-2023-34142 | Critical | 9.0 | 2023-07-18 | Cleartext Transmission of Sensitive Information vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Server, Device Manager Agent, Host Da… |
CVE-2023-30565 | Low | 3.5 | 2023-07-13 | An insecure connection between Systems Manager and CQI Reporter application could expose infusion data to an attacker. |