CWE-319 · Cleartext Transmission of Sensitive Information (page 6)
Page 6 of 10 — CVEs classified under CWE-319, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-33724 | Low | 3.3 | 2022-08-05 | Exposure of Sensitive Information in Samsung Dialer application?prior to SMR Aug-2022 Release 1 allows local attackers to access ICCID via log. |
CVE-2022-27619 | Medium | 6.8 | 2022-08-03 | Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Client before 2.2.2-609 allows man-in-the-m… |
CVE-2022-31204 | High | 7.5 | 2022-07-26 | Omron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords. They feature a UM Protection setting that allows users or system int… |
CVE-2022-28861 | Medium | 5.9 | 2022-07-21 | The server in Citilog 8.0 allows an attacker (in a man in the middle position between the server and its smart camera Axis M1125) to see FTP credentials in a c… |
CVE-2022-34804 | Medium | 4.3 | 2022-06-30 | Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configuration forms, potentia… |
CVE-2022-34801 | Medium | 4.3 | 2022-06-30 | Jenkins Build Notifications Plugin 1.5.0 and earlier transmits tokens in plain text as part of the global Jenkins configuration form, potentially resulting in… |
CVE-2017-20109 | Medium | 4.3 | 2022-06-29 | A vulnerability classified as problematic was found in Teleopti WFM up to 7.1.0. Affected by this vulnerability is an unknown functionality of the file /Teleop… |
CVE-2022-29519 | High | 7.5 | 2022-06-28 | Cleartext transmission of sensitive information vulnerability exists in STARDOM FCN Controller and FCJ Controller R1.01 to R4.31, which may allow an adjacent a… |
CVE-2022-21829 | Critical | 9.8 | 2022-06-24 | Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE… |
CVE-2022-1524 | High | 7.4 | 2022-06-24 | LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credentials. |
CVE-2022-21184 | Medium | 5.9 | 2022-06-17 | An information disclosure vulnerability exists in the License registration functionality of Bachmann Visutec GmbH Atvise 3.5.4, 3.6 and 3.7. A plaintext HTTP r… |
CVE-2022-31046 | Medium | 4.3 | 2022-06-14 | TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the export functionality… |
CVE-2022-25805 | Medium | 6.5 | 2022-06-09 | An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. The transmission of cleartext LDAP bind credentials by the cmd_mgt_load_mgt_tree… |
CVE-2022-30115 | Medium | 4.3 | 2022-06-02 | Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. Thi… |
CVE-2022-29733 | Medium | 5.9 | 2022-06-02 | Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 was discovered to transmit and store sensitive information in cleartext. This vulnerability allo… |
CVE-2021-28509 | Medium | 6.1 | 2022-05-26 | This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConfig transport proto… |
CVE-2021-28508 | Medium | 6.8 | 2022-05-26 | This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConfig transport proto… |
CVE-2022-26077 | High | 7.5 | 2022-05-25 | A cleartext transmission of sensitive information vulnerability exists in the OAS Engine configuration communications functionality of Open Automation Software… |
CVE-2021-32966 | Low | 3.7 | 2022-05-25 | Philips Interoperability Solution XDS versions 2.5 through 3.11 and 2018-1 through 2021-1 are vulnerable to clear text transmission of sensitive information wh… |
CVE-2022-21951 | Medium | 6.8 | 2022-05-25 | A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network to read and change network data due to… |
CVE-2022-29874 | High | 8.8 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not encrypt web traffic with clients but communicate in cleartext via… |
CVE-2021-32934 | Critical | 9.1 | 2022-05-19 | The affected ThroughTek P2P products (SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, fir… |
CVE-2020-4970 | Medium | 5.9 | 2022-05-19 | IBM Security Identity Governance and Intelligence 5.2.4, 5.2.5, and 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure… |
CVE-2022-30994 | High | 7.5 | 2022-05-18 | Cleartext transmission of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 29240 |
CVE-2022-30993 | High | 7.5 | 2022-05-18 | Cleartext transmission of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240 |
CVE-2022-0005 | Low | 2.4 | 2022-05-12 | Sensitive information accessible by physical probing of JTAG interface for some Intel(R) Processors with SGX may allow an unprivileged user to potentially enab… |
CVE-2022-29945 | Medium | 4.0 | 2022-04-29 | DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope protocol. |
CVE-2021-40392 | High | 7.5 | 2022-04-14 | An information disclosure vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. Network sniffing can lead to a disclosure of s… |
CVE-2021-45104 | High | 7.4 | 2022-04-06 | An issue was discovered in HTCondor 9.0.x before 9.0.10 and 9.1.x before 9.5.1. An attacker who can capture HTCondor network data can interfere with users' job… |
CVE-2022-24978 | High | 8.8 | 2022-04-05 | Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in… |
CVE-2021-45894 | Medium | 5.9 | 2022-04-05 | An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. There is Cleartext Transmission of Sensitive Information. |
CVE-2021-32982 | High | 7.5 | 2022-04-04 | Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 passwords are sent as plaintext during unlocking and project transfers. An att… |
CVE-2021-33022 | High | 7.5 | 2022-04-01 | Philips Vue PACS versions 12.2.x.x and prior transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unaut… |
CVE-2003-5002 | Low | 3.7 | 2022-03-28 | A vulnerability was found in ISS BlackICE PC Protection. It has been declared as problematic. Affected by this vulnerability is the component Update Handler wh… |
CVE-2022-0988 | High | 7.1 | 2022-03-25 | Delta Electronics DIAEnergie (Version 1.7.5 and prior) is vulnerable to cleartext transmission as the web application runs by default on HTTP. This could allow… |
CVE-2021-27422 | High | 7.5 | 2022-03-23 | GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol. It allows sensitive information exposure without auth… |
CVE-2020-25178 | High | 7.5 | 2022-03-18 | ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provides various file sy… |
CVE-2021-41849 | Medium | 5.5 | 2022-03-11 | An issue was discovered in Luna Simo PPR1.180610.011/202001031830. It sends the following Personally Identifiable Information (PII) in plaintext using HTTP to… |
CVE-2021-40846 | High | 7.5 | 2022-03-04 | An issue was discovered in Rhinode Trading Paints through 2.0.36. TP Updater.exe uses cleartext HTTP to check, and request, updates. Thus, attackers can man-in… |
CVE-2022-21798 | High | 7.5 | 2022-02-25 | The affected product is vulnerable due to cleartext transmission of credentials seen in the CIMPLICITY network, which can be easily spoofed and used to log in… |
CVE-2021-45081 | Medium | 5.9 | 2022-02-20 | An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS. |
CVE-2021-39026 | Medium | 5.9 | 2022-02-18 | IBM Guardium Data Encryption (GDE) 5.0.0.2 and 5.0.0.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable… |
CVE-2022-25180 | Medium | 4.3 | 2022-02-15 | Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds, allowing attackers with… |
CVE-2022-0162 | High | 8.4 | 2022-02-09 | The vulnerability exists in TP-Link TL-WR841N V11 3.16.9 Build 160325 Rel.62500n wireless router due to transmission of authentication information in cleartext… |
CVE-2021-29397 | High | 7.5 | 2022-02-04 | Cleartext Transmission of Sensitive Information in /northstar/Admin/login.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote local u… |
CVE-2021-45735 | High | 7.5 | 2022-02-04 | TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to use the HTTP protocol for authentication into the admin interface, allowing attackers to intercept use… |
CVE-2021-41835 | High | 7.3 | 2022-01-21 | Fresenius Kabi Agilia Link + version 3.0 does not enforce transport layer encryption. Therefore, transmitted data may be sent in cleartext. Transport layer enc… |
CVE-2022-23105 | Medium | 6.5 | 2022-01-12 | Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most… |
CVE-2021-40148 | High | 7.5 | 2022-01-04 | In Modem EMM, there is a possible information disclosure due to a missing data encryption. This could lead to remote information disclosure with no additional… |
CVE-2021-20175 | High | 7.5 | 2021-12-30 | Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the SOAP interface. By default, all communication to/from the device… |
CVE-2021-20174 | High | 7.5 | 2021-12-30 | Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the web interface. By default, all communication to/from the device'… |
CVE-2021-20169 | Medium | 6.8 | 2021-12-30 | Netgear RAX43 version 1.0.3.96 does not utilize secure communications to the web interface. By default, all communication to/from the device is sent via HTTP… |
CVE-2021-20154 | High | 7.5 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 contains an security flaw in the web interface. HTTPS is not enabled on the device by default. This results in clear… |
CVE-2021-4161 | Critical | 9.8 | 2021-12-27 | The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details. This could give an… |
CVE-2021-45100 | High | 7.5 | 2021-12-16 | The ksmbd server through 3.4.2, as used in the Linux kernel through 5.15.8, sometimes communicates in cleartext even though encryption has been enabled. This o… |
CVE-2021-44518 | Medium | 6.8 | 2021-12-02 | An issue was discovered in the eGeeTouch 3rd Generation Travel Padlock application for Android. The lock sends a pairing code before each operation (lock or un… |
CVE-2021-44480 | High | 8.1 | 2021-12-01 | Wokka Lokka Q50 devices through 2021-11-30 allow remote attackers (who know the SIM phone number and password) to listen to a device's surroundings via a callb… |
CVE-2021-37939 | Low | 2.7 | 2021-11-18 | It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentional… |
CVE-2021-38978 | Medium | 5.9 | 2021-11-15 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enab… |
CVE-2021-3792 | Medium | 5.3 | 2021-11-12 | Some device communications in some Motorola-branded Binatone Hubble Cameras with backend Hubble services are not encrypted which could lead to the communicatio… |
CVE-2021-40366 | High | 7.4 | 2021-11-09 | A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.42), Climatix POL909 (AWM module) (All versions < V11.34). The web serv… |
CVE-2020-4152 | Medium | 5.9 | 2021-11-08 | IBM QRadar Network Security 5.4.0 and 5.5.0 transmits sensitive or security-critical data in cleartext in a communication channel that can be obtained using ma… |
CVE-2021-3774 | High | 7.4 | 2021-11-05 | Meross Smart Wi-Fi 2 Way Wall Switch (MSS550X), on its 3.1.3 version and before, creates an open Wi-Fi Access Point without the required security measures in i… |
CVE-2021-29753 | Medium | 5.9 | 2021-11-05 | IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores authentication credentials, but it uses an i… |
CVE-2021-42699 | Medium | 5.7 | 2021-11-05 | The affected product is vulnerable to cookie information being transmitted as cleartext over HTTP. An attacker can capture network traffic, obtain the user’s c… |
CVE-2021-38418 | High | 8.8 | 2021-11-03 | Delta Electronics DIALink versions 1.2.4.0 and prior runs by default on HTTP, which may allow an attacker to be positioned between the traffic and perform a ma… |
CVE-2021-43270 | High | 7.5 | 2021-11-02 | Datalust Seq.App.EmailPlus (aka seq-app-htmlemail) 3.1.0-dev-00148, 3.1.0-dev-00170, and 3.1.0-dev-00176 can use cleartext SMTP on port 25 in some cases where… |
CVE-2021-39341 | High | 8.2 | 2021-11-01 | The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validati… |
CVE-2021-0296 | High | 7.4 | 2021-10-19 | The Juniper Networks CTPView server is not enforcing HTTP Strict Transport Security (HSTS). HSTS is an optional response header which allows servers to indicat… |
CVE-2021-20599 | Critical | 9.1 | 2021-10-14 | Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCP… |
CVE-2021-39882 | Medium | 5.3 | 2021-10-05 | In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information about any GitLab user. |
CVE-2020-20128 | High | 7.5 | 2021-09-29 | LaraCMS v1.0.1 transmits sensitive information in cleartext which can be intercepted by attackers. |
CVE-2021-39342 | Medium | 5.3 | 2021-09-29 | The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX action whenever a site… |
CVE-2021-22946 | High | 7.5 | 2021-09-29 | A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command l… |
CVE-2021-36165 | Medium | 5.3 | 2021-09-28 | RICON Industrial Cellular Router S9922L 16.10.3(3794) is affected by cleartext storage of sensitive information and sends username and password as base64. |
CVE-2021-40847 | High | 8.1 | 2021-09-21 | The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a Mit… |
CVE-2021-38142 | High | 8.8 | 2021-09-07 | Barco MirrorOp Windows Sender before 2.5.3.65 uses cleartext HTTP and thus allows rogue software upgrades. An attacker on the local network can achieve remote… |
CVE-2021-39272 | Medium | 5.9 | 2021-08-30 | Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH. |
CVE-2021-33883 | Medium | 5.9 | 2021-08-25 | A Cleartext Transmission of Sensitive Information vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to obtain sensitive informat… |
CVE-2021-38373 | Medium | 5.3 | 2021-08-10 | In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authentication" is checked. |
CVE-2021-22923 | Medium | 5.3 | 2021-08-05 | When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credenti… |
CVE-2021-29769 | Medium | 4.3 | 2021-07-26 | IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) does not set the secure attribute on authorization tokens or session cookies. Attack… |
CVE-2021-33900 | High | 7.5 | 2021-07-26 | While investigating DIRSTUDIO-1219 it was noticed that configured StartTLS encryption was not applied when any SASL authentication mechanism (DIGEST-MD5, GSSAP… |
CVE-2020-36423 | High | 7.5 | 2021-07-19 | An issue was discovered in Arm Mbed TLS before 2.23.0. A remote attacker can recover plaintext because a certain Lucky 13 countermeasure doesn't properly consi… |
CVE-2020-4980 | Medium | 6.5 | 2021-07-16 | IBM QRadar SIEM 7.3 and 7.4 uses less secure methods for protecting data in transit between hosts when encrypt host connections is not enabled as well as data… |
CVE-2020-12730 | Medium | 5.3 | 2021-07-15 | MagicMotion Flamingo 2 lacks BLE encryption, enabling data sniffing and packet forgery. |
CVE-2021-1896 | Medium | 4.3 | 2021-07-13 | Weak configuration in WLAN could cause forwarding of unencrypted packets from one client to another in Snapdragon Compute, Snapdragon Connectivity |
CVE-2021-36382 | Low | 2.6 | 2021-07-12 | Devolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept private keys via a man-in-the-middle attack against the connection… |
CVE-2021-22380 | Critical | 9.1 | 2021-06-30 | There is a Cleartext Transmission of Sensitive Information Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect service… |
CVE-2021-23846 | High | 8.8 | 2021-06-18 | When using http protocol, the user password is transmitted as a clear text parameter for which it is possible to be obtained by an attacker through a MITM atta… |
CVE-2021-34825 | High | 7.5 | 2021-06-17 | Quassel through 0.13.1, when --require-ssl is enabled, launches without SSL or TLS support if a usable X.509 certificate is not found on the local system. |
CVE-2021-32612 | High | 8.1 | 2021-06-16 | The VeryFitPro (com.veryfit2hr.second) application 3.2.8 for Android does all communication with the backend API over cleartext HTTP. This includes logins, reg… |
CVE-2021-22325 | Medium | 5.3 | 2021-06-03 | There is an Information Disclosure vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may result in video streams being intercep… |
CVE-2021-23896 | Low | 3.2 | 2021-06-02 | Cleartext Transmission of Sensitive Information vulnerability in the administrator interface of McAfee Database Security (DBSec) prior to 4.8.2 allows an admin… |
CVE-2021-23018 | High | 7.4 | 2021-06-01 | Intra-cluster communication does not use TLS. The services within the NGINX Controller 3.x before 3.4.0 namespace are using cleartext protocols inside the clus… |
CVE-2021-33408 | Medium | 6.5 | 2021-05-27 | Local File Inclusion vulnerability in Ab Initio Control>Center before 4.0.2.6 allows remote attackers to retrieve arbitrary files. Fixed in v4.0.2.6 and v4.0.3… |
CVE-2021-25643 | Medium | 4.9 | 2021-05-26 | An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2. Internal users with administrator privileges, @cbq-engine-cbauth a… |
CVE-2021-27924 | Medium | 5.9 | 2021-05-19 | An issue was discovered in Couchbase Server 6.x through 6.6.1. The Couchbase Server UI is insecurely logging session cookies in the logs. This allows for the i… |
CVE-2021-32456 | Medium | 6.5 | 2021-05-17 | SITEL CAP/PRX firmware version 5.2.01 allows an attacker with access to the local network of the device to obtain the authentication passwords by analysing the… |
CVE-2021-20564 | Medium | 5.9 | 2021-05-14 | IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could allow a remote attacker to obtain sensitive information, caused by the… |