CWE-319 · Cleartext Transmission of Sensitive Information (page 6)
Page 6 of 10 — CVEs classified under CWE-319, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-25180 | Medium | 4.3 | 2022-02-15 | Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds, allowing attackers with… |
CVE-2022-0162 | High | 8.4 | 2022-02-09 | The vulnerability exists in TP-Link TL-WR841N V11 3.16.9 Build 160325 Rel.62500n wireless router due to transmission of authentication information in cleartext… |
CVE-2021-29397 | High | 7.5 | 2022-02-04 | Cleartext Transmission of Sensitive Information in /northstar/Admin/login.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote local u… |
CVE-2021-45735 | High | 7.5 | 2022-02-04 | TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to use the HTTP protocol for authentication into the admin interface, allowing attackers to intercept use… |
CVE-2021-41835 | High | 7.3 | 2022-01-21 | Fresenius Kabi Agilia Link + version 3.0 does not enforce transport layer encryption. Therefore, transmitted data may be sent in cleartext. Transport layer enc… |
CVE-2022-23105 | Medium | 6.5 | 2022-01-12 | Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most… |
CVE-2021-40148 | High | 7.5 | 2022-01-04 | In Modem EMM, there is a possible information disclosure due to a missing data encryption. This could lead to remote information disclosure with no additional… |
CVE-2021-20175 | High | 7.5 | 2021-12-30 | Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the SOAP interface. By default, all communication to/from the device… |
CVE-2021-20174 | High | 7.5 | 2021-12-30 | Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the web interface. By default, all communication to/from the device'… |
CVE-2021-20169 | Medium | 6.8 | 2021-12-30 | Netgear RAX43 version 1.0.3.96 does not utilize secure communications to the web interface. By default, all communication to/from the device is sent via HTTP… |
CVE-2021-20154 | High | 7.5 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 contains an security flaw in the web interface. HTTPS is not enabled on the device by default. This results in clear… |
CVE-2021-4161 | Critical | 9.8 | 2021-12-27 | The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details. This could give an… |
CVE-2021-45100 | High | 7.5 | 2021-12-16 | The ksmbd server through 3.4.2, as used in the Linux kernel through 5.15.8, sometimes communicates in cleartext even though encryption has been enabled. This o… |
CVE-2021-44518 | Medium | 6.8 | 2021-12-02 | An issue was discovered in the eGeeTouch 3rd Generation Travel Padlock application for Android. The lock sends a pairing code before each operation (lock or un… |
CVE-2021-44480 | High | 8.1 | 2021-12-01 | Wokka Lokka Q50 devices through 2021-11-30 allow remote attackers (who know the SIM phone number and password) to listen to a device's surroundings via a callb… |
CVE-2021-37939 | Low | 2.7 | 2021-11-18 | It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentional… |
CVE-2021-38978 | Medium | 5.9 | 2021-11-15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enab… |
CVE-2021-3792 | Medium | 5.3 | 2021-11-12 | Some device communications in some Motorola-branded Binatone Hubble Cameras with backend Hubble services are not encrypted which could lead to the communicatio… |
CVE-2021-40366 | High | 7.4 | 2021-11-09 | A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.42), Climatix POL909 (AWM module) (All versions < V11.34). The web serv… |
CVE-2020-4152 | Medium | 5.9 | 2021-11-08 | IBM QRadar Network Security 5.4.0 and 5.5.0 transmits sensitive or security-critical data in cleartext in a communication channel that can be obtained using ma… |
CVE-2021-3774 | High | 7.4 | 2021-11-05 | Meross Smart Wi-Fi 2 Way Wall Switch (MSS550X), on its 3.1.3 version and before, creates an open Wi-Fi Access Point without the required security measures in i… |
CVE-2021-29753 | Medium | 5.9 | 2021-11-05 | IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores authentication credentials, but it uses an i… |
CVE-2021-42699 | Medium | 5.7 | 2021-11-05 | The affected product is vulnerable to cookie information being transmitted as cleartext over HTTP. An attacker can capture network traffic, obtain the user’s c… |
CVE-2021-38418 | High | 8.8 | 2021-11-03 | Delta Electronics DIALink versions 1.2.4.0 and prior runs by default on HTTP, which may allow an attacker to be positioned between the traffic and perform a ma… |
CVE-2021-43270 | High | 7.5 | 2021-11-02 | Datalust Seq.App.EmailPlus (aka seq-app-htmlemail) 3.1.0-dev-00148, 3.1.0-dev-00170, and 3.1.0-dev-00176 can use cleartext SMTP on port 25 in some cases where… |
CVE-2021-39341 | High | 8.2 | 2021-11-01 | The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validati… |
CVE-2021-0296 | High | 7.4 | 2021-10-19 | The Juniper Networks CTPView server is not enforcing HTTP Strict Transport Security (HSTS). HSTS is an optional response header which allows servers to indicat… |
CVE-2021-20599 | Critical | 9.1 | 2021-10-14 | Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCP… |
CVE-2021-39882 | Medium | 5.3 | 2021-10-05 | In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information about any GitLab user. |
CVE-2020-20128 | High | 7.5 | 2021-09-29 | LaraCMS v1.0.1 transmits sensitive information in cleartext which can be intercepted by attackers. |
CVE-2021-39342 | Medium | 5.3 | 2021-09-29 | The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX action whenever a site… |
CVE-2021-22946 | High | 7.5 | 2021-09-29 | A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command l… |
CVE-2021-36165 | Medium | 5.3 | 2021-09-28 | RICON Industrial Cellular Router S9922L 16.10.3(3794) is affected by cleartext storage of sensitive information and sends username and password as base64. |
CVE-2021-40847 | High | 8.1 | 2021-09-21 | The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a Mit… |
CVE-2021-38142 | High | 8.8 | 2021-09-07 | Barco MirrorOp Windows Sender before 2.5.3.65 uses cleartext HTTP and thus allows rogue software upgrades. An attacker on the local network can achieve remote… |
CVE-2021-39272 | Medium | 5.9 | 2021-08-30 | Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH. |
CVE-2021-33883 | Medium | 5.9 | 2021-08-25 | A Cleartext Transmission of Sensitive Information vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to obtain sensitive informat… |
CVE-2021-38373 | Medium | 5.3 | 2021-08-10 | In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authentication" is checked. |
CVE-2021-22923 | Medium | 5.3 | 2021-08-05 | When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credenti… |
CVE-2021-29769 | Medium | 4.3 | 2021-07-26 | IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) does not set the secure attribute on authorization tokens or session cookies. Attack… |
CVE-2021-33900 | High | 7.5 | 2021-07-26 | While investigating DIRSTUDIO-1219 it was noticed that configured StartTLS encryption was not applied when any SASL authentication mechanism (DIGEST-MD5, GSSAP… |
CVE-2020-36423 | High | 7.5 | 2021-07-19 | An issue was discovered in Arm Mbed TLS before 2.23.0. A remote attacker can recover plaintext because a certain Lucky 13 countermeasure doesn't properly consi… |
CVE-2020-4980 | Medium | 6.5 | 2021-07-16 | IBM QRadar SIEM 7.3 and 7.4 uses less secure methods for protecting data in transit between hosts when encrypt host connections is not enabled as well as data… |
CVE-2020-12730 | Medium | 5.3 | 2021-07-15 | MagicMotion Flamingo 2 lacks BLE encryption, enabling data sniffing and packet forgery. |
CVE-2021-1896 | Medium | 4.3 | 2021-07-13 | Weak configuration in WLAN could cause forwarding of unencrypted packets from one client to another in Snapdragon Compute, Snapdragon Connectivity |
CVE-2021-36382 | Low | 2.6 | 2021-07-12 | Devolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept private keys via a man-in-the-middle attack against the connection… |
CVE-2021-22380 | Critical | 9.1 | 2021-06-30 | There is a Cleartext Transmission of Sensitive Information Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect service… |
CVE-2021-23846 | High | 8.8 | 2021-06-18 | When using http protocol, the user password is transmitted as a clear text parameter for which it is possible to be obtained by an attacker through a MITM atta… |
CVE-2021-34825 | High | 7.5 | 2021-06-17 | Quassel through 0.13.1, when --require-ssl is enabled, launches without SSL or TLS support if a usable X.509 certificate is not found on the local system. |
CVE-2021-32612 | High | 8.1 | 2021-06-16 | The VeryFitPro (com.veryfit2hr.second) application 3.2.8 for Android does all communication with the backend API over cleartext HTTP. This includes logins, reg… |
CVE-2021-22325 | Medium | 5.3 | 2021-06-03 | There is an Information Disclosure vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may result in video streams being intercep… |
CVE-2021-23896 | Low | 3.2 | 2021-06-02 | Cleartext Transmission of Sensitive Information vulnerability in the administrator interface of McAfee Database Security (DBSec) prior to 4.8.2 allows an admin… |
CVE-2021-23018 | High | 7.4 | 2021-06-01 | Intra-cluster communication does not use TLS. The services within the NGINX Controller 3.x before 3.4.0 namespace are using cleartext protocols inside the clus… |
CVE-2021-33408 | Medium | 6.5 | 2021-05-27 | Local File Inclusion vulnerability in Ab Initio Control>Center before 4.0.2.6 allows remote attackers to retrieve arbitrary files. Fixed in v4.0.2.6 and v4.0.3… |
CVE-2021-25643 | Medium | 4.9 | 2021-05-26 | An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2. Internal users with administrator privileges, @cbq-engine-cbauth a… |
CVE-2021-27924 | Medium | 5.9 | 2021-05-19 | An issue was discovered in Couchbase Server 6.x through 6.6.1. The Couchbase Server UI is insecurely logging session cookies in the logs. This allows for the i… |
CVE-2021-32456 | Medium | 6.5 | 2021-05-17 | SITEL CAP/PRX firmware version 5.2.01 allows an attacker with access to the local network of the device to obtain the authentication passwords by analysing the… |
CVE-2021-20564 | Medium | 5.9 | 2021-05-14 | IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could allow a remote attacker to obtain sensitive information, caused by the… |
CVE-2020-27185 | High | 7.5 | 2021-05-14 | Cleartext transmission of sensitive information via Moxa Service in NPort IA5000A series serial devices. Successfully exploiting the vulnerability could enable… |
CVE-2020-27184 | Medium | 5.9 | 2021-05-14 | The NPort IA5000A Series devices use Telnet as one of the network device management services. Telnet does not support the encryption of client-server communica… |
CVE-2021-31898 | High | 7.5 | 2021-05-11 | In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS. |
CVE-2021-3003 | Medium | 5.3 | 2021-05-10 | Agenzia delle Entrate Desktop Telematico 1.0.0 contacts the jws.agenziaentrate.it server over cleartext HTTP, which allows man-in-the-middle attackers to spoof… |
CVE-2021-27574 | High | 8.1 | 2021-05-07 | An issue was discovered in Emote Remote Mouse through 4.0.0.0. It uses cleartext HTTP to check, and request, updates. Thus, attackers can machine-in-the-middle… |
CVE-2021-27569 | Medium | 5.3 | 2021-05-07 | An issue was discovered in Emote Remote Mouse through 4.0.0.0. Attackers can maximize or minimize the window of a running process by sending the process name i… |
CVE-2021-31815 | Low | 3.3 | 2021-04-28 | GAEN (aka Google/Apple Exposure Notifications) through 2021-04-27 on Android allows attackers to obtain sensitive information, such as a user's location histor… |
CVE-2021-31671 | High | 7.5 | 2021-04-27 | pgsync before 0.6.7 is affected by Information Disclosure of sensitive information. Syncing the schema with the --schema-first and --schema-only options is mis… |
CVE-2021-3494 | Medium | 5.9 | 2021-04-26 | A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA… |
CVE-2020-26197 | High | 7.5 | 2021-04-20 | Dell PowerScale OneFS 8.1.0 - 9.1.0 contains an LDAP Provider inability to connect over TLSv1.2 vulnerability. It may make it easier to eavesdrop and decrypt s… |
CVE-2021-20992 | High | 8.1 | 2021-04-19 | In Fibaro Home Center 2 and Lite devices in all versions provide a web based management interface over unencrypted HTTP protocol. Communication between the use… |
CVE-2021-23884 | Medium | 4.3 | 2021-04-15 | Cleartext Transmission of Sensitive Information vulnerability in the ePO Extension of McAfee Content Security Reporter (CSR) prior to 2.8.0 allows an ePO admin… |
CVE-2020-7308 | Medium | 4.8 | 2021-04-15 | Cleartext Transmission of Sensitive Information between McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update and McAfee Global Threa… |
CVE-2021-27251 | High | 8.8 | 2021-04-14 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nighthawk R7800. Authentication is not requ… |
CVE-2021-3473 | Medium | 4.5 | 2021-04-13 | An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be written to an inter… |
CVE-2021-27194 | High | 8.8 | 2021-03-25 | Cleartext transmission of sensitive information in Netop Vision Pro up to and including 9.7.1 allows a remote unauthenticated attacker to gather credentials in… |
CVE-2021-21387 | High | 8.1 | 2021-03-19 | Wrongthink peer-to-peer, end-to-end encrypted messenger with PeerJS and Axolotl ratchet. In wrongthink from version 2.0.0 and before 2.3.0 there was a set of v… |
CVE-2019-18231 | High | 7.5 | 2021-03-17 | Advantech Spectre RT ERT351 Versions 5.1.3 and prior logins and passwords are transmitted in clear text form, which may allow an attacker to intercept the requ… |
CVE-2020-35456 | Medium | 5.5 | 2021-03-17 | The Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to view private chat messages and media files via logcat because of excess… |
CVE-2021-3417 | Medium | 4.9 | 2021-03-09 | An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator (LXCA), if added as a Resourc… |
CVE-2020-8356 | Medium | 4.9 | 2021-03-09 | An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and SMTP forwarders are wr… |
CVE-2020-4695 | High | 7.5 | 2021-03-08 | IBM API Connect V10 is impacted by insecure communications during database replication. As the data replication happens over insecure communication channels, a… |
CVE-2021-26565 | High | 8.3 | 2021-02-26 | Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle… |
CVE-2021-26564 | High | 8.3 | 2021-02-26 | Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle… |
CVE-2021-26560 | Critical | 9.0 | 2021-02-26 | Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-th… |
CVE-2021-22703 | High | 7.5 | 2021-02-19 | A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION90… |
CVE-2021-22702 | High | 7.5 | 2021-02-19 | A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION7700/73xx, ION83xx/84xx/85xx/8600, ION8650… |
CVE-2020-25605 | Medium | 5.9 | 2021-02-17 | Cleartext transmission of sensitive information in Agora Video SDK prior to 3.1 allows a remote attacker to obtain access to audio and video of any ongoing Ago… |
CVE-2021-27209 | High | 7.1 | 2021-02-13 | In the management interface on TP-Link Archer C5v 1.7_181221 devices, credentials are sent in a base64 format over cleartext HTTP. |
CVE-2021-20409 | Medium | 5.9 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable H… |
CVE-2021-20335 | Medium | 6.7 | 2021-02-11 | For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the u… |
CVE-2020-8355 | Medium | 4.9 | 2021-02-10 | An internal product security audit of Lenovo XClarity Administrator (LXCA) prior to version 3.1.0 discovered the Windows OS credentials provided by the LXCA us… |
CVE-2021-20623 | Critical | 9.8 | 2021-02-05 | Video Insight VMS versions prior to 7.8 allows a remote attacker to execute arbitrary code with the system user privilege by sending a specially crafted reques… |
CVE-2020-29662 | Medium | 5.3 | 2021-02-02 | In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path. |
CVE-2020-29005 | High | 7.5 | 2021-01-29 | The API in the Push extension for MediaWiki through 1.35 used cleartext for ApiPush credentials, allowing for potential information disclosure. |
CVE-2020-25169 | High | 7.5 | 2021-01-26 | The affected Reolink P2P products do not sufficiently protect data transferred between the local device and Reolink servers. This can allow an attacker to acce… |
CVE-2021-21270 | Medium | 6.2 | 2021-01-22 | OctopusDSC is a PowerShell module with DSC resources that can be used to install and configure an Octopus Deploy Server and Tentacle agent. In OctopusDSC versi… |
CVE-2020-4969 | Medium | 5.9 | 2021-01-21 | IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable… |
CVE-2020-4597 | Medium | 4.3 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie valu… |
CVE-2020-4893 | Medium | 5.9 | 2021-01-07 | IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 transmits sensitive information in HTTP GET request parameters. This may lead to informatio… |
CVE-2020-4899 | Critical | 9.1 | 2021-01-05 | IBM API Connect 5.0.0.0 through 5.0.8.10 could potentially leak sensitive information or allow for data corruption due to plain text transmission of sensitive… |
CVE-2018-19944 | High | 7.5 | 2020-12-31 | A cleartext transmission of sensitive information vulnerability has been reported to affect certain QTS devices. If exploited, this vulnerability allows a remo… |