CWE-319 · Cleartext Transmission of Sensitive Information (page 5)
Page 5 of 10 — CVEs classified under CWE-319, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-22806 | High | 7.5 | 2023-02-15 | LS ELECTRIC XBC-DN32U with operating system version 01.80 transmits sensitive information in cleartext when communicating over its XGT protocol. This could all… |
CVE-2023-0001 | Medium | 6.0 | 2023-02-08 | An information exposure vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local system administrator to disclose the admin p… |
CVE-2022-40693 | High | 7.5 | 2023-02-07 | A cleartext transmission vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted… |
CVE-2023-25016 | High | 7.5 | 2023-02-06 | Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Information to an Unauthorized Actor. |
CVE-2023-23130 | Medium | 5.9 | 2023-02-01 | Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP (cleartext) with SSL disabled. OTE: the vendor's… |
CVE-2022-47714 | Critical | 9.8 | 2023-02-01 | Last Yard 22.09.8-1 does not enforce HSTS headers |
CVE-2023-24440 | Medium | 5.5 | 2023-01-26 | Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins configuration form… |
CVE-2023-22863 | Medium | 5.9 | 2023-01-18 | IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could… |
CVE-2023-22597 | Medium | 6.5 | 2023-01-12 | InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-319: Cl… |
CVE-2022-0553 | Medium | 6.5 | 2023-01-11 | There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted firmware can be retrie… |
CVE-2022-23509 | High | 7.3 | 2023-01-09 | Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. GitOps run has a l… |
CVE-2022-3929 | High | 8.3 | 2023-01-05 | Communication between the client and the server application of the affected products is partially done using CORBA (Common Object Request Broker Architecture)… |
CVE-2023-0055 | Medium | 5.3 | 2023-01-04 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32. |
CVE-2022-43551 | High | 7.5 | 2022-12-23 | A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use… |
CVE-2022-22457 | Medium | 5.3 | 2022-12-22 | IBM Security Verify Governance, Identity Manager 10.0.1 stores sensitive information including user credentials in plain clear text which can be read by a loca… |
CVE-2022-22758 | High | 8.8 | 2022-12-22 | When clicking on a tel: link, USSD codes, specified after a <code>\*</code> character, would be included in the phone number. On certain phones, or on certain… |
CVE-2022-47895 | Medium | 4.7 | 2022-12-22 | In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required JAR files. |
CVE-2022-42454 | Medium | 6.4 | 2022-12-21 | Insights for Vulnerability Remediation (IVR) is vulnerable to man-in-the-middle attacks that may lead to information disclosure. This requires privileged netw… |
CVE-2021-4258 | Low | 3.7 | 2022-12-19 | A vulnerability was found in whohas. It has been rated as problematic. This issue affects some unknown processing of the component Package Information Handler… |
CVE-2020-4497 | Medium | 6.8 | 2022-12-14 | IBM Spectrum Protect Plus 10.1.0 through 10.1.12 discloses sensitive information due to unencrypted data being used in the communication flow between Spectrum… |
CVE-2020-9420 | Medium | 6.5 | 2022-12-14 | The login password of the web administrative dashboard in Arcadyan Wifi routers VRV9506JAC23 is sent in cleartext, allowing an attacker to sniff and intercept… |
CVE-2022-43724 | Critical | 9.8 | 2022-12-13 | A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software transmits the database credentials for the inbuilt SQL server in… |
CVE-2022-46685 | Medium | 4.3 | 2022-12-12 | In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them th… |
CVE-2022-40939 | Medium | 4.9 | 2022-12-08 | In certain Secustation products the administrator account password can be read. This affects V2.5.5.3116-S50-SMA-B20171107A, V2.3.4.1301-M20-TSA-B20150617A, V2… |
CVE-2022-45877 | High | 8.3 | 2022-12-08 | OpenHarmony-v3.1.4 and prior versions had an vulnerability. PIN code is transmitted to the peer device in plain text during cross-device authentication, which… |
CVE-2022-45478 | Medium | 5.9 | 2022-12-05 | Telepad allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data (including keypresses) in cleartext. CVS… |
CVE-2022-45483 | Medium | 5.9 | 2022-12-02 | Lazy Mouse allows an attacker (in a man in the middle position between the server and a connected device) to see all data (including keypresses) in cleartext… |
CVE-2022-45480 | Medium | 5.9 | 2022-12-02 | PC Keyboard WiFi & Bluetooth allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data (including keypress… |
CVE-2022-39339 | Medium | 4.3 | 2022-11-25 | user_oidc is an OpenID Connect user backend for Nextcloud. In versions prior to 1.2.1 sensitive information such as the OIDC client credentials and tokens are… |
CVE-2022-44411 | High | 7.5 | 2022-11-25 | Web Based Quiz System v1.0 transmits user passwords in plaintext during the authentication process, allowing attackers to obtain users' passwords via a brutefo… |
CVE-2021-35246 | Medium | 5.3 | 2022-11-23 | The application fails to prevent users from connecting to it over unencrypted connections. An attacker able to modify a legitimate user's network traffic could… |
CVE-2022-43691 | Medium | 5.3 | 2022-11-14 | Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 inadvertently disclose server-side sensitive information (secrets in environment var… |
CVE-2021-38828 | Medium | 5.3 | 2022-11-14 | Xiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to plain-text traffic sniffing. |
CVE-2022-38122 | High | 7.5 | 2022-11-10 | UPSMON PRO transmits sensitive data in cleartext over HTTP protocol. An unauthenticated remote attacker can exploit this vulnerability to access sensitive data. |
CVE-2022-33321 | Critical | 9.8 | 2022-11-08 | Cleartext Transmission of Sensitive Information vulnerability due to the use of Basic Authentication for HTTP connections in Mitsubishi Electric consumer elect… |
CVE-2021-39077 | Medium | 4.4 | 2022-11-03 | IBM Security Guardium 10.5, 10.6, 11.0, 11.1, 11.2, 11.3, and 11.4 stores user credentials in plain clear text which can be read by a local privileged user. IB… |
CVE-2021-45447 | High | 7.7 | 2022-11-02 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.2 and 8.3.0.25 with the Data Lineage feature enabled transmits database pass… |
CVE-2022-42916 | High | 7.5 | 2022-10-29 | In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directl… |
CVE-2022-41636 | Critical | 9.1 | 2022-10-28 | Communication traffic involving "Ethernet Q Commands" service of Haas Controller version 100.20.000.1110 is transmitted in cleartext. This allows an attacker t… |
CVE-2022-41627 | Medium | 4.8 | 2022-10-27 | The physical IoT device of the AliveCor's KardiaMobile, a smartphone-based personal electrocardiogram (EKG) has no encryption for its data-over-sound protocol… |
CVE-2022-41983 | Low | 3.7 | 2022-10-19 | On specific hardware platforms, on BIG-IP versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, while Inte… |
CVE-2022-3206 | Medium | 5.9 | 2022-10-17 | The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is easy to decode. This… |
CVE-2022-39287 | High | 8.1 | 2022-10-07 | tiny-csrf is a Node.js cross site request forgery (CSRF) protection middleware. In versions prior to 1.1.0 cookies were not encrypted and thus CSRF tokens were… |
CVE-2022-39269 | Critical | 9.1 | 2022-10-06 | PJSIP is a free and open source multimedia communication library written in C. When processing certain packets, PJSIP may incorrectly switch from using SRTP me… |
CVE-2022-32227 | Medium | 6.5 | 2022-09-23 | A cleartext transmission of sensitive information exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 relating to Oauth tokens by having the permission "view-full-o… |
CVE-2021-42948 | Low | 3.7 | 2022-09-16 | HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, allowing attackers to… |
CVE-2022-38846 | Medium | 5.9 | 2022-09-16 | EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP). An attacker may cap… |
CVE-2022-30312 | Medium | 6.5 | 2022-09-07 | The Trend Controls IC protocol through 2022-05-06 allows Cleartext Transmission of Sensitive Information. According to FSCT-2022-0050, there is a Trend Control… |
CVE-2022-2083 | High | 7.5 | 2022-09-05 | The Simple Single Sign On WordPress plugin through 4.1.0 leaks its OAuth client_secret, which could be used by attackers to gain unauthorized access to the sit… |
CVE-2022-2485 | Critical | 9.6 | 2022-08-31 | Any attempt (good or bad) to log into AutomationDirect Stride Field I/O with a web browser may result in the device responding with its password in the communi… |
CVE-2022-2005 | High | 7.5 | 2022-08-31 | AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow an attacker to obtain… |
CVE-2022-2003 | High | 7.7 | 2022-08-31 | AutomationDirect DirectLOGIC is vulnerable to a specifically crafted serial message to the CPU serial port that will cause the PLC to respond with the PLC pass… |
CVE-2022-36200 | High | 7.5 | 2022-08-29 | In FiberHome VDSL2 Modem HG150-Ub_V3.0, Credentials of Admin are submitted in URL, which can be logged/sniffed. |
CVE-2022-32857 | Medium | 4.3 | 2022-08-24 | This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security U… |
CVE-2021-3590 | High | 8.8 | 2022-08-22 | A flaw was found in Foreman project. A credential leak was identified which will expose Azure Compute Profile password through JSON of the API output. The high… |
CVE-2022-2338 | Medium | 5.7 | 2022-08-17 | Softing Secure Integration Server V1.22 is vulnerable to authentication bypass via a machine-in-the-middle attack. The default the administration interface is… |
CVE-2022-20243 | Medium | 4.4 | 2022-08-11 | In Core Utilities, there is a possible log information disclosure. This could lead to local information disclosure of sensitive browsing data with System execu… |
CVE-2022-32245 | High | 8.2 | 2022-08-10 | SAP BusinessObjects Business Intelligence Platform (Open Document) - versions 420, 430, allows an unauthenticated attacker to retrieve sensitive information pl… |
CVE-2022-33724 | Low | 3.3 | 2022-08-05 | Exposure of Sensitive Information in Samsung Dialer application?prior to SMR Aug-2022 Release 1 allows local attackers to access ICCID via log. |
CVE-2022-27619 | Medium | 6.8 | 2022-08-03 | Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Client before 2.2.2-609 allows man-in-the-m… |
CVE-2022-31204 | High | 7.5 | 2022-07-26 | Omron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords. They feature a UM Protection setting that allows users or system int… |
CVE-2022-28861 | Medium | 5.9 | 2022-07-21 | The server in Citilog 8.0 allows an attacker (in a man in the middle position between the server and its smart camera Axis M1125) to see FTP credentials in a c… |
CVE-2022-34804 | Medium | 4.3 | 2022-06-30 | Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configuration forms, potentia… |
CVE-2022-34801 | Medium | 4.3 | 2022-06-30 | Jenkins Build Notifications Plugin 1.5.0 and earlier transmits tokens in plain text as part of the global Jenkins configuration form, potentially resulting in… |
CVE-2017-20109 | Medium | 4.3 | 2022-06-29 | A vulnerability classified as problematic was found in Teleopti WFM up to 7.1.0. Affected by this vulnerability is an unknown functionality of the file /Teleop… |
CVE-2022-29519 | High | 7.5 | 2022-06-28 | Cleartext transmission of sensitive information vulnerability exists in STARDOM FCN Controller and FCJ Controller R1.01 to R4.31, which may allow an adjacent a… |
CVE-2022-21829 | Critical | 9.8 | 2022-06-24 | Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE… |
CVE-2022-1524 | High | 7.4 | 2022-06-24 | LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credentials. |
CVE-2022-21184 | Medium | 5.9 | 2022-06-17 | An information disclosure vulnerability exists in the License registration functionality of Bachmann Visutec GmbH Atvise 3.5.4, 3.6 and 3.7. A plaintext HTTP r… |
CVE-2022-31046 | Medium | 4.3 | 2022-06-14 | TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the export functionality… |
CVE-2022-25805 | Medium | 6.5 | 2022-06-09 | An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. The transmission of cleartext LDAP bind credentials by the cmd_mgt_load_mgt_tree… |
CVE-2022-30115 | Medium | 4.3 | 2022-06-02 | Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. Thi… |
CVE-2022-29733 | Medium | 5.9 | 2022-06-02 | Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 was discovered to transmit and store sensitive information in cleartext. This vulnerability allo… |
CVE-2021-28509 | Medium | 6.1 | 2022-05-26 | This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConfig transport proto… |
CVE-2021-28508 | Medium | 6.8 | 2022-05-26 | This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConfig transport proto… |
CVE-2022-26077 | High | 7.5 | 2022-05-25 | A cleartext transmission of sensitive information vulnerability exists in the OAS Engine configuration communications functionality of Open Automation Software… |
CVE-2021-32966 | Low | 3.7 | 2022-05-25 | Philips Interoperability Solution XDS versions 2.5 through 3.11 and 2018-1 through 2021-1 are vulnerable to clear text transmission of sensitive information wh… |
CVE-2022-21951 | Medium | 6.8 | 2022-05-25 | A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network to read and change network data due to… |
CVE-2022-29874 | High | 8.8 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not encrypt web traffic with clients but communicate in cleartext via… |
CVE-2021-32934 | Critical | 9.1 | 2022-05-19 | The affected ThroughTek P2P products (SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, fir… |
CVE-2020-4970 | Medium | 5.9 | 2022-05-19 | IBM Security Identity Governance and Intelligence 5.2.4, 5.2.5, and 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure… |
CVE-2022-30994 | High | 7.5 | 2022-05-18 | Cleartext transmission of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 29240 |
CVE-2022-30993 | High | 7.5 | 2022-05-18 | Cleartext transmission of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240 |
CVE-2022-0005 | Low | 2.4 | 2022-05-12 | Sensitive information accessible by physical probing of JTAG interface for some Intel(R) Processors with SGX may allow an unprivileged user to potentially enab… |
CVE-2022-29945 | Medium | 4.0 | 2022-04-29 | DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope protocol. |
CVE-2021-40392 | High | 7.5 | 2022-04-14 | An information disclosure vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. Network sniffing can lead to a disclosure of s… |
CVE-2021-45104 | High | 7.4 | 2022-04-06 | An issue was discovered in HTCondor 9.0.x before 9.0.10 and 9.1.x before 9.5.1. An attacker who can capture HTCondor network data can interfere with users' job… |
CVE-2022-24978 | High | 8.8 | 2022-04-05 | Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in… |
CVE-2021-45894 | Medium | 5.9 | 2022-04-05 | An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. There is Cleartext Transmission of Sensitive Information. |
CVE-2021-32982 | High | 7.5 | 2022-04-04 | Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 passwords are sent as plaintext during unlocking and project transfers. An att… |
CVE-2021-33022 | High | 7.5 | 2022-04-01 | Philips Vue PACS versions 12.2.x.x and prior transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unaut… |
CVE-2003-5002 | Low | 3.7 | 2022-03-28 | A vulnerability was found in ISS BlackICE PC Protection. It has been declared as problematic. Affected by this vulnerability is the component Update Handler wh… |
CVE-2022-0988 | High | 7.1 | 2022-03-25 | Delta Electronics DIAEnergie (Version 1.7.5 and prior) is vulnerable to cleartext transmission as the web application runs by default on HTTP. This could allow… |
CVE-2021-27422 | High | 7.5 | 2022-03-23 | GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol. It allows sensitive information exposure without auth… |
CVE-2020-25178 | High | 7.5 | 2022-03-18 | ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provides various file sy… |
CVE-2021-41849 | Medium | 5.5 | 2022-03-11 | An issue was discovered in Luna Simo PPR1.180610.011/202001031830. It sends the following Personally Identifiable Information (PII) in plaintext using HTTP to… |
CVE-2021-40846 | High | 7.5 | 2022-03-04 | An issue was discovered in Rhinode Trading Paints through 2.0.36. TP Updater.exe uses cleartext HTTP to check, and request, updates. Thus, attackers can man-in… |
CVE-2022-21798 | High | 7.5 | 2022-02-25 | The affected product is vulnerable due to cleartext transmission of credentials seen in the CIMPLICITY network, which can be easily spoofed and used to log in… |
CVE-2021-45081 | Medium | 5.9 | 2022-02-20 | An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS. |
CVE-2021-39026 | Medium | 5.9 | 2022-02-18 | IBM Guardium Data Encryption (GDE) 5.0.0.2 and 5.0.0.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable… |