CWE-319 · Cleartext Transmission of Sensitive Information (page 5)
Page 5 of 10 — CVEs classified under CWE-319, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-35833 | Medium | 6.5 | 2023-07-13 | An issue was discovered in YSoft SAFEQ 6 Server before 6.0.82. When modifying the URL of the LDAP server configuration from LDAPS to LDAP, the system does not… |
CVE-2023-31823 | High | 7.5 | 2023-07-13 | An issue found in Marui Co Marui Official app v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the min… |
CVE-2023-3272 | High | 7.5 | 2023-07-10 | Cleartext Transmission of Sensitive Information in the SICK ICR890-4 could allow a remote attacker to gather sensitive information by intercepting network traf… |
CVE-2023-21220 | High | 7.5 | 2023-06-28 | there is a possible use of unencrypted transport over cellular networks due to an insecure default value. This could lead to remote information disclosure with… |
CVE-2023-21219 | High | 7.5 | 2023-06-28 | there is a possible use of unencrypted transport over cellular networks due to an insecure default value. This could lead to remote information disclosure with… |
CVE-2023-31410 | Critical | 9.8 | 2023-06-19 | A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security (TLS) in the SICK Eve… |
CVE-2023-23841 | High | 7.5 | 2023-06-15 | SolarWinds Serv-U is submitting an HTTP request when changing or updating the attributes for File Share or File request. Part of the URL of the request disclo… |
CVE-2023-31195 | Medium | 5.3 | 2023-06-13 | ASUS Router RT-AX3000 Firmware versions prior to 3.0.0.4.388.23403 uses sensitive cookies without 'Secure' attribute. When an attacker is in a position to be a… |
CVE-2022-41327 | High | 7.8 | 2023-06-13 | A cleartext transmission of sensitive information vulnerability [CWE-319] in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.8, FortiProxy vers… |
CVE-2023-27861 | Medium | 5.9 | 2023-06-05 | IBM Maximo Application Suite - Manage Component 8.8.0 and 8.9.0 transmits sensitive information in cleartext that could be intercepted by an attacker using man… |
CVE-2023-30602 | High | 7.5 | 2023-06-02 | Hitron Technologies CODA-5310’s Telnet function transfers sensitive data in plaintext. An unauthenticated remote attacker can exploit this vulnerability to acc… |
CVE-2023-33960 | High | 7.5 | 2023-06-01 | OpenProject is web-based project management software. For any OpenProject installation, a `robots.txt` file is generated through the server to denote which rou… |
CVE-2023-3028 | High | 8.6 | 2023-06-01 | Insufficient authentication in the MQTT backend (broker) allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles us… |
CVE-2023-33730 | Critical | 9.8 | 2023-05-31 | Privilege Escalation in the "GetUserCurrentPwd" function in Microworld Technologies eScan Management Console 14.0.1400.2281 allows any remote attacker to retri… |
CVE-2023-28348 | High | 7.4 | 2023-05-31 | An issue was discovered in Faronics Insight 10.0.19045 on Windows. A suitably positioned attacker could perform a man-in-the-middle attack on either a connecte… |
CVE-2023-33187 | Medium | 5.4 | 2023-05-26 | Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `… |
CVE-2023-31193 | High | 7.5 | 2023-05-22 | Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers. Because they do not use HTTPS, OvrC Pr… |
CVE-2022-46680 | High | 8.8 | 2023-05-22 | A CWE-319: Cleartext transmission of sensitive information vulnerability exists that could cause disclosure of sensitive information, denial of service, or mo… |
CVE-2023-0864 | High | 7.1 | 2023-05-17 | Cleartext Transmission of Sensitive Information vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (CE) (Terr… |
CVE-2023-32784 | High | 7.5 | 2023-05-15 | In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. T… |
CVE-2023-30354 | Critical | 9.8 | 2023-05-10 | Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 does not defend against physical access to U-Boot via the UART: the Wi-Fi password is shown, and th… |
CVE-2023-25070 | Medium | 6.5 | 2023-05-10 | Cleartext transmission of sensitive information exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier. If the telnet connection is enabled, a remote… |
CVE-2023-32290 | High | 7.5 | 2023-05-07 | The myMail app through 14.30 for iOS sends cleartext credentials in a situation where STARTTLS is expected by a server. |
CVE-2023-29681 | Medium | 5.7 | 2023-05-01 | Cleartext Transmission in cookie:ecos_pw: in Tenda N301 v6.0, firmware v12.03.01.06_pt allows an authenticated attacker on the LAN or WLAN to intercept communi… |
CVE-2023-29680 | Medium | 5.7 | 2023-05-01 | Cleartext Transmission in set-cookie:ecos_pw: Tenda N301 v6.0, Firmware v12.02.01.61_multi allows an authenticated attacker on the LAN or WLAN to intercept com… |
CVE-2023-25437 | High | 8.8 | 2023-04-27 | An issue was discovered in vTech VCS754 version 1.1.1.A before 1.1.1.H, allows attackers to gain escalated privileges and gain sensitive information due to cle… |
CVE-2023-30841 | Medium | 6.0 | 2023-04-26 | Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Bare… |
CVE-2023-1831 | High | 7.2 | 2023-04-17 | Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logg… |
CVE-2019-14942 | Medium | 5.9 | 2023-04-16 | An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Cookies for GitLab Pages (which ha… |
CVE-2023-30515 | High | 7.5 | 2023-04-12 | Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mod… |
CVE-2023-30514 | High | 7.5 | 2023-04-12 | Jenkins Azure Key Vault Plugin 187.va_cd5fecd198a_ and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mod… |
CVE-2023-30513 | High | 7.5 | 2023-04-12 | Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for… |
CVE-2023-1802 | Medium | 5.9 | 2023-04-06 | In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targete… |
CVE-2023-0922 | Medium | 5.9 | 2023-04-03 | The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection. |
CVE-2023-1656 | High | 7.5 | 2023-03-29 | Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc. OpenIDM and Java Remote Connector Server (RCS) LDAP Connector on Windows, MacOS… |
CVE-2023-27927 | Medium | 6.5 | 2023-03-27 | An authenticated malicious user could acquire the simple mail transfer protocol (SMTP) Password in cleartext format, despite it being protected and hidden behi… |
CVE-2022-38458 | Medium | 6.5 | 2023-03-21 | A cleartext transmission vulnerability exists in the Remote Management functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted man-in-the-midd… |
CVE-2023-0053 | High | 7.5 | 2023-03-02 | SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior have only FTP and Telnet available for dev… |
CVE-2022-32906 | Medium | 5.3 | 2023-02-27 | This issue was addressed with using HTTPS when sending information over the network. This issue is fixed in Apple Music 3.9.10 for Android. A user in a privile… |
CVE-2023-23915 | Medium | 6.5 | 2023-02-23 | A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple… |
CVE-2023-23914 | Critical | 9.1 | 2023-02-23 | A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are request… |
CVE-2022-45546 | High | 7.5 | 2023-02-15 | Information Disclosure in Authentication Component of ScreenCheck BadgeMaker 2.6.2.0 application allows internal attacker to obtain credentials for authenticat… |
CVE-2023-22806 | High | 7.5 | 2023-02-15 | LS ELECTRIC XBC-DN32U with operating system version 01.80 transmits sensitive information in cleartext when communicating over its XGT protocol. This could all… |
CVE-2023-0001 | Medium | 6.0 | 2023-02-08 | An information exposure vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local system administrator to disclose the admin p… |
CVE-2022-40693 | High | 7.5 | 2023-02-07 | A cleartext transmission vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted… |
CVE-2023-25016 | High | 7.5 | 2023-02-06 | Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Information to an Unauthorized Actor. |
CVE-2023-23130 | Medium | 5.9 | 2023-02-01 | Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP (cleartext) with SSL disabled. OTE: the vendor's… |
CVE-2022-47714 | Critical | 9.8 | 2023-02-01 | Last Yard 22.09.8-1 does not enforce HSTS headers |
CVE-2023-24440 | Medium | 5.5 | 2023-01-26 | Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins configuration form… |
CVE-2023-22863 | Medium | 5.9 | 2023-01-18 | IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could… |
CVE-2023-22597 | Medium | 6.5 | 2023-01-12 | InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-319: Cl… |
CVE-2022-0553 | Medium | 6.5 | 2023-01-11 | There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted firmware can be retrie… |
CVE-2022-23509 | High | 7.3 | 2023-01-09 | Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. GitOps run has a l… |
CVE-2022-3929 | High | 8.3 | 2023-01-05 | Communication between the client and the server application of the affected products is partially done using CORBA (Common Object Request Broker Architecture)… |
CVE-2023-0055 | Medium | 5.3 | 2023-01-04 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32. |
CVE-2022-43551 | High | 7.5 | 2022-12-23 | A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use… |
CVE-2022-22457 | Medium | 5.3 | 2022-12-22 | IBM Security Verify Governance, Identity Manager 10.0.1 stores sensitive information including user credentials in plain clear text which can be read by a loca… |
CVE-2022-22758 | High | 8.8 | 2022-12-22 | When clicking on a tel: link, USSD codes, specified after a <code>\*</code> character, would be included in the phone number. On certain phones, or on certain… |
CVE-2022-47895 | Medium | 4.7 | 2022-12-22 | In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required JAR files. |
CVE-2022-42454 | Medium | 6.4 | 2022-12-21 | Insights for Vulnerability Remediation (IVR) is vulnerable to man-in-the-middle attacks that may lead to information disclosure. This requires privileged netw… |
CVE-2021-4258 | Low | 3.7 | 2022-12-19 | A vulnerability was found in whohas. It has been rated as problematic. This issue affects some unknown processing of the component Package Information Handler… |
CVE-2020-4497 | Medium | 6.8 | 2022-12-14 | IBM Spectrum Protect Plus 10.1.0 through 10.1.12 discloses sensitive information due to unencrypted data being used in the communication flow between Spectrum… |
CVE-2020-9420 | Medium | 6.5 | 2022-12-14 | The login password of the web administrative dashboard in Arcadyan Wifi routers VRV9506JAC23 is sent in cleartext, allowing an attacker to sniff and intercept… |
CVE-2022-43724 | Critical | 9.8 | 2022-12-13 | A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software transmits the database credentials for the inbuilt SQL server in… |
CVE-2022-46685 | Medium | 4.3 | 2022-12-12 | In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them th… |
CVE-2022-40939 | Medium | 4.9 | 2022-12-08 | In certain Secustation products the administrator account password can be read. This affects V2.5.5.3116-S50-SMA-B20171107A, V2.3.4.1301-M20-TSA-B20150617A, V2… |
CVE-2022-45877 | High | 8.3 | 2022-12-08 | OpenHarmony-v3.1.4 and prior versions had an vulnerability. PIN code is transmitted to the peer device in plain text during cross-device authentication, which… |
CVE-2022-45478 | Medium | 5.9 | 2022-12-05 | Telepad allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data (including keypresses) in cleartext. CVS… |
CVE-2022-45483 | Medium | 5.9 | 2022-12-02 | Lazy Mouse allows an attacker (in a man in the middle position between the server and a connected device) to see all data (including keypresses) in cleartext… |
CVE-2022-45480 | Medium | 5.9 | 2022-12-02 | PC Keyboard WiFi & Bluetooth allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data (including keypress… |
CVE-2022-39339 | Medium | 4.3 | 2022-11-25 | user_oidc is an OpenID Connect user backend for Nextcloud. In versions prior to 1.2.1 sensitive information such as the OIDC client credentials and tokens are… |
CVE-2022-44411 | High | 7.5 | 2022-11-25 | Web Based Quiz System v1.0 transmits user passwords in plaintext during the authentication process, allowing attackers to obtain users' passwords via a brutefo… |
CVE-2021-35246 | Medium | 5.3 | 2022-11-23 | The application fails to prevent users from connecting to it over unencrypted connections. An attacker able to modify a legitimate user's network traffic could… |
CVE-2022-43691 | Medium | 5.3 | 2022-11-14 | Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 inadvertently disclose server-side sensitive information (secrets in environment var… |
CVE-2021-38828 | Medium | 5.3 | 2022-11-14 | Xiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to plain-text traffic sniffing. |
CVE-2022-38122 | High | 7.5 | 2022-11-10 | UPSMON PRO transmits sensitive data in cleartext over HTTP protocol. An unauthenticated remote attacker can exploit this vulnerability to access sensitive data. |
CVE-2022-33321 | Critical | 9.8 | 2022-11-08 | Cleartext Transmission of Sensitive Information vulnerability due to the use of Basic Authentication for HTTP connections in Mitsubishi Electric consumer elect… |
CVE-2021-39077 | Medium | 4.4 | 2022-11-03 | IBM Security Guardium 10.5, 10.6, 11.0, 11.1, 11.2, 11.3, and 11.4 stores user credentials in plain clear text which can be read by a local privileged user. IB… |
CVE-2021-45447 | High | 7.7 | 2022-11-02 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.2 and 8.3.0.25 with the Data Lineage feature enabled transmits database pass… |
CVE-2022-42916 | High | 7.5 | 2022-10-29 | In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directl… |
CVE-2022-41636 | Critical | 9.1 | 2022-10-28 | Communication traffic involving "Ethernet Q Commands" service of Haas Controller version 100.20.000.1110 is transmitted in cleartext. This allows an attacker t… |
CVE-2022-41627 | Medium | 4.8 | 2022-10-27 | The physical IoT device of the AliveCor's KardiaMobile, a smartphone-based personal electrocardiogram (EKG) has no encryption for its data-over-sound protocol… |
CVE-2022-41983 | Low | 3.7 | 2022-10-19 | On specific hardware platforms, on BIG-IP versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, while Inte… |
CVE-2022-3206 | Medium | 5.9 | 2022-10-17 | The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is easy to decode. This… |
CVE-2022-39287 | High | 8.1 | 2022-10-07 | tiny-csrf is a Node.js cross site request forgery (CSRF) protection middleware. In versions prior to 1.1.0 cookies were not encrypted and thus CSRF tokens were… |
CVE-2022-39269 | Critical | 9.1 | 2022-10-06 | PJSIP is a free and open source multimedia communication library written in C. When processing certain packets, PJSIP may incorrectly switch from using SRTP me… |
CVE-2022-32227 | Medium | 6.5 | 2022-09-23 | A cleartext transmission of sensitive information exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 relating to Oauth tokens by having the permission "view-full-o… |
CVE-2021-42948 | Low | 3.7 | 2022-09-16 | HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, allowing attackers to… |
CVE-2022-38846 | Medium | 5.9 | 2022-09-16 | EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP). An attacker may cap… |
CVE-2022-30312 | Medium | 6.5 | 2022-09-07 | The Trend Controls IC protocol through 2022-05-06 allows Cleartext Transmission of Sensitive Information. According to FSCT-2022-0050, there is a Trend Control… |
CVE-2022-2083 | High | 7.5 | 2022-09-05 | The Simple Single Sign On WordPress plugin through 4.1.0 leaks its OAuth client_secret, which could be used by attackers to gain unauthorized access to the sit… |
CVE-2022-2485 | Critical | 9.6 | 2022-08-31 | Any attempt (good or bad) to log into AutomationDirect Stride Field I/O with a web browser may result in the device responding with its password in the communi… |
CVE-2022-2005 | High | 7.5 | 2022-08-31 | AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow an attacker to obtain… |
CVE-2022-2003 | High | 7.7 | 2022-08-31 | AutomationDirect DirectLOGIC is vulnerable to a specifically crafted serial message to the CPU serial port that will cause the PLC to respond with the PLC pass… |
CVE-2022-36200 | High | 7.5 | 2022-08-29 | In FiberHome VDSL2 Modem HG150-Ub_V3.0, Credentials of Admin are submitted in URL, which can be logged/sniffed. |
CVE-2022-32857 | Medium | 4.3 | 2022-08-24 | This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security U… |
CVE-2021-3590 | High | 8.8 | 2022-08-22 | A flaw was found in Foreman project. A credential leak was identified which will expose Azure Compute Profile password through JSON of the API output. The high… |
CVE-2022-2338 | Medium | 5.7 | 2022-08-17 | Softing Secure Integration Server V1.22 is vulnerable to authentication bypass via a machine-in-the-middle attack. The default the administration interface is… |
CVE-2022-20243 | Medium | 4.4 | 2022-08-11 | In Core Utilities, there is a possible log information disclosure. This could lead to local information disclosure of sensitive browsing data with System execu… |
CVE-2022-32245 | High | 8.2 | 2022-08-10 | SAP BusinessObjects Business Intelligence Platform (Open Document) - versions 420, 430, allows an unauthenticated attacker to retrieve sensitive information pl… |