CWE-319 · Cleartext Transmission of Sensitive Information (page 7)
Page 7 of 10 — CVEs classified under CWE-319, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-27185 | High | 7.5 | 2021-05-14 | Cleartext transmission of sensitive information via Moxa Service in NPort IA5000A series serial devices. Successfully exploiting the vulnerability could enable… |
CVE-2020-27184 | Medium | 5.9 | 2021-05-14 | The NPort IA5000A Series devices use Telnet as one of the network device management services. Telnet does not support the encryption of client-server communica… |
CVE-2021-31898 | High | 7.5 | 2021-05-11 | In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS. |
CVE-2021-3003 | Medium | 5.3 | 2021-05-10 | Agenzia delle Entrate Desktop Telematico 1.0.0 contacts the jws.agenziaentrate.it server over cleartext HTTP, which allows man-in-the-middle attackers to spoof… |
CVE-2021-27574 | High | 8.1 | 2021-05-07 | An issue was discovered in Emote Remote Mouse through 4.0.0.0. It uses cleartext HTTP to check, and request, updates. Thus, attackers can machine-in-the-middle… |
CVE-2021-27569 | Medium | 5.3 | 2021-05-07 | An issue was discovered in Emote Remote Mouse through 4.0.0.0. Attackers can maximize or minimize the window of a running process by sending the process name i… |
CVE-2021-31815 | Low | 3.3 | 2021-04-28 | GAEN (aka Google/Apple Exposure Notifications) through 2021-04-27 on Android allows attackers to obtain sensitive information, such as a user's location histor… |
CVE-2021-31671 | High | 7.5 | 2021-04-27 | pgsync before 0.6.7 is affected by Information Disclosure of sensitive information. Syncing the schema with the --schema-first and --schema-only options is mis… |
CVE-2021-3494 | Medium | 5.9 | 2021-04-26 | A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA… |
CVE-2020-26197 | High | 7.5 | 2021-04-20 | Dell PowerScale OneFS 8.1.0 - 9.1.0 contains an LDAP Provider inability to connect over TLSv1.2 vulnerability. It may make it easier to eavesdrop and decrypt s… |
CVE-2021-20992 | High | 8.1 | 2021-04-19 | In Fibaro Home Center 2 and Lite devices in all versions provide a web based management interface over unencrypted HTTP protocol. Communication between the use… |
CVE-2021-23884 | Medium | 4.3 | 2021-04-15 | Cleartext Transmission of Sensitive Information vulnerability in the ePO Extension of McAfee Content Security Reporter (CSR) prior to 2.8.0 allows an ePO admin… |
CVE-2020-7308 | Medium | 4.8 | 2021-04-15 | Cleartext Transmission of Sensitive Information between McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update and McAfee Global Threa… |
CVE-2021-27251 | High | 8.8 | 2021-04-14 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nighthawk R7800. Authentication is not requ… |
CVE-2021-3473 | Medium | 4.5 | 2021-04-13 | An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be written to an inter… |
CVE-2021-27194 | High | 8.8 | 2021-03-25 | Cleartext transmission of sensitive information in Netop Vision Pro up to and including 9.7.1 allows a remote unauthenticated attacker to gather credentials in… |
CVE-2021-21387 | High | 8.1 | 2021-03-19 | Wrongthink peer-to-peer, end-to-end encrypted messenger with PeerJS and Axolotl ratchet. In wrongthink from version 2.0.0 and before 2.3.0 there was a set of v… |
CVE-2019-18231 | High | 7.5 | 2021-03-17 | Advantech Spectre RT ERT351 Versions 5.1.3 and prior logins and passwords are transmitted in clear text form, which may allow an attacker to intercept the requ… |
CVE-2020-35456 | Medium | 5.5 | 2021-03-17 | The Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to view private chat messages and media files via logcat because of excess… |
CVE-2021-3417 | Medium | 4.9 | 2021-03-09 | An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator (LXCA), if added as a Resourc… |
CVE-2020-8356 | Medium | 4.9 | 2021-03-09 | An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and SMTP forwarders are wr… |
CVE-2020-4695 | High | 7.5 | 2021-03-08 | IBM API Connect V10 is impacted by insecure communications during database replication. As the data replication happens over insecure communication channels, a… |
CVE-2021-26565 | High | 8.3 | 2021-02-26 | Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle… |
CVE-2021-26564 | High | 8.3 | 2021-02-26 | Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle… |
CVE-2021-26560 | Critical | 9.0 | 2021-02-26 | Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-th… |
CVE-2021-22703 | High | 7.5 | 2021-02-19 | A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION90… |
CVE-2021-22702 | High | 7.5 | 2021-02-19 | A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION7700/73xx, ION83xx/84xx/85xx/8600, ION8650… |
CVE-2020-25605 | Medium | 5.9 | 2021-02-17 | Cleartext transmission of sensitive information in Agora Video SDK prior to 3.1 allows a remote attacker to obtain access to audio and video of any ongoing Ago… |
CVE-2021-27209 | High | 7.1 | 2021-02-13 | In the management interface on TP-Link Archer C5v 1.7_181221 devices, credentials are sent in a base64 format over cleartext HTTP. |
CVE-2021-20409 | Medium | 5.9 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable H… |
CVE-2021-20335 | Medium | 6.7 | 2021-02-11 | For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the u… |
CVE-2020-8355 | Medium | 4.9 | 2021-02-10 | An internal product security audit of Lenovo XClarity Administrator (LXCA) prior to version 3.1.0 discovered the Windows OS credentials provided by the LXCA us… |
CVE-2021-20623 | Critical | 9.8 | 2021-02-05 | Video Insight VMS versions prior to 7.8 allows a remote attacker to execute arbitrary code with the system user privilege by sending a specially crafted reques… |
CVE-2020-29662 | Medium | 5.3 | 2021-02-02 | In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path. |
CVE-2020-29005 | High | 7.5 | 2021-01-29 | The API in the Push extension for MediaWiki through 1.35 used cleartext for ApiPush credentials, allowing for potential information disclosure. |
CVE-2020-25169 | High | 7.5 | 2021-01-26 | The affected Reolink P2P products do not sufficiently protect data transferred between the local device and Reolink servers. This can allow an attacker to acce… |
CVE-2021-21270 | Medium | 6.2 | 2021-01-22 | OctopusDSC is a PowerShell module with DSC resources that can be used to install and configure an Octopus Deploy Server and Tentacle agent. In OctopusDSC versi… |
CVE-2020-4969 | Medium | 5.9 | 2021-01-21 | IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable… |
CVE-2020-4597 | Medium | 4.3 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie valu… |
CVE-2020-4893 | Medium | 5.9 | 2021-01-07 | IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 transmits sensitive information in HTTP GET request parameters. This may lead to informatio… |
CVE-2020-4899 | Critical | 9.1 | 2021-01-05 | IBM API Connect 5.0.0.0 through 5.0.8.10 could potentially leak sensitive information or allow for data corruption due to plain text transmission of sensitive… |
CVE-2018-19944 | High | 7.5 | 2020-12-31 | A cleartext transmission of sensitive information vulnerability has been reported to affect certain QTS devices. If exploited, this vulnerability allows a remo… |
CVE-2020-11718 | High | 7.4 | 2020-12-23 | An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and below. Its software-update packages are downloaded via cleartext HTTP. |
CVE-2020-35584 | Medium | 5.9 | 2020-12-23 | In Solstice Pod before 3.0.3, the web services allow users to connect to them over unencrypted channels via the Browser Look-in feature. An attacker suitably p… |
CVE-2020-25190 | High | 7.5 | 2020-12-23 | The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower stores and transmits the credentials of third-party services in cleartext. |
CVE-2020-13528 | Medium | 5.3 | 2020-12-18 | An information disclosure vulnerability exists in the Web Manager and telnet CLI functionality of Lantronix XPort EDGE 3.0.0.0R11, 3.1.0.0R9, 3.4.0.0R12 and 4… |
CVE-2020-14248 | Medium | 5.3 | 2020-12-16 | BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests… |
CVE-2020-27586 | Medium | 5.9 | 2020-11-30 | Quick Heal Total Security before version 19.0 transmits quarantine and sysinfo files via clear text. |
CVE-2020-29380 | Medium | 5.9 | 2020-11-29 | An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devic… |
CVE-2020-29055 | Medium | 5.9 | 2020-11-24 | An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S… |
CVE-2020-25988 | Medium | 6.5 | 2020-11-17 | UPNP Service listening on port 5555 in Genexis Platinum 4410 Router V2.1 (P4410-V2–1.34H) has an action 'X_GetAccess' which leaks the credentials of 'admin', p… |
CVE-2020-27554 | High | 7.5 | 2020-11-17 | Cleartext Transmission of Sensitive Information vulnerability in BASETech GE-131 BT-1837836 firmware 20180921 exists which could leak sensitive information tra… |
CVE-2020-25155 | High | 7.5 | 2020-11-13 | The affected product transmits unencrypted sensitive information, which may allow an attacker to access this information on the NIO 50 (all versions). |
CVE-2020-5426 | Critical | 9.8 | 2020-11-11 | Scheduler for TAS prior to version 1.4.0 was permitting plaintext transmission of UAA client token by sending it over a non-TLS connection. This also depended… |
CVE-2020-27657 | Medium | 6.5 | 2020-10-29 | Cleartext transmission of sensitive information vulnerability in DDNS in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to… |
CVE-2020-27656 | Medium | 6.5 | 2020-10-29 | Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attac… |
CVE-2020-7744 | Medium | 4.7 | 2020-10-15 | This affects all versions of package com.mintegral.msdk:alphab. The Android SDK distributed by the company contains malicious functionality in this module that… |
CVE-2020-25645 | High | 7.5 | 2020-10-13 | A flaw was found in the Linux kernel in versions before 5.9-rc7. Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt tr… |
CVE-2020-1902 | High | 7.5 | 2020-10-06 | A user running a quick search on a highly forwarded message on WhatsApp for Android from v2.20.108 to v2.20.140 or WhatsApp Business for Android from v2.20.35… |
CVE-2020-25748 | High | 8.1 | 2020-09-25 | A Cleartext Transmission issue was discovered on Rubetek RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339). Someone in the middle can interc… |
CVE-2020-15785 | Medium | 5.3 | 2020-09-09 | A vulnerability has been identified in Siveillance Video Client (All versions). In environments where Windows NTLM authentication is enabled the affected clien… |
CVE-2020-1749 | High | 7.5 | 2020-09-09 | A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted tunn… |
CVE-2020-3702 | Medium | 6.5 | 2020-09-08 | u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possib… |
CVE-2020-2251 | Medium | 4.3 | 2020-09-01 | Jenkins SoapUI Pro Functional Testing Plugin 1.5 and earlier transmits project passwords in its configuration in plain text as part of job configuration forms… |
CVE-2019-4689 | High | 7.5 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTT… |
CVE-2020-15482 | High | 7.8 | 2020-08-26 | An issue was discovered on Nescomed Multipara Monitor M1000 devices. The device enables an unencrypted TELNET service by default, with a blank password for the… |
CVE-2020-10124 | High | 7.1 | 2020-08-21 | NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the integrity of messages between the BNA and the host computer, which cou… |
CVE-2020-2232 | High | 7.5 | 2020-08-12 | Jenkins Email Extension Plugin 2.72 and 2.73 transmits and displays the SMTP password in plain text as part of the global Jenkins configuration form, potential… |
CVE-2020-9526 | Medium | 5.9 | 2020-08-10 | CS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an information exposure flaw that exposes user session data to sup… |
CVE-2020-15062 | High | 8.8 | 2020-08-07 | DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to elevate privileges because the administrative pass… |
CVE-2020-15058 | High | 8.8 | 2020-08-07 | Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to elevate privileges because the administrative pass… |
CVE-2020-15054 | High | 8.8 | 2020-08-07 | TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to elevate privileges because the administrative pass… |
CVE-2020-15954 | Medium | 6.5 | 2020-07-27 | KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use. |
CVE-2020-12638 | Medium | 6.8 | 2020-07-23 | An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.0.3, and ESP8266_RTOS_SDK devices throu… |
CVE-2020-4397 | Medium | 5.9 | 2020-07-22 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 transmits sensitive information in plain text which could be obtained by an attacker using man in the middle technique… |
CVE-2020-3442 | Medium | 4.8 | 2020-07-20 | The DuoConnect client enables users to establish SSH connections to hosts protected by a DNG instance. When a user initiates an SSH connection to a DNG-protect… |
CVE-2020-7592 | Medium | 6.5 | 2020-07-14 | A vulnerability has been identified in SIMATIC HMI Basic Panels 1st Generation (incl. SIPLUS variants) (All versions), SIMATIC HMI Basic Panels 2nd Generation… |
CVE-2020-14171 | Medium | 6.5 | 2020-07-09 | Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted repository import requests via a Man-in-the… |
CVE-2020-12398 | High | 7.5 | 2020-07-09 | If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unencrypted co… |
CVE-2020-15509 | Medium | 6.5 | 2020-07-07 | Nordic Semiconductor Android BLE Library through 2.2.1 and DFU Library through 1.10.4 for Android (as used by nRF Connect and other applications) can engage in… |
CVE-2020-10281 | High | 7.5 | 2020-07-03 | This vulnerability applies to the Micro Air Vehicle Link (MAVLink) protocol and allows a remote attacker to gain access to sensitive information provided it ha… |
CVE-2020-2210 | Medium | 4.3 | 2020-07-02 | Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentia… |
CVE-2020-5899 | High | 7.8 | 2020-07-01 | In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an at… |
CVE-2020-12048 | High | 7.5 | 2020-06-29 | Phoenix Hemodialysis Delivery System SW 3.36 and 3.40, The Phoenix Hemodialysis device does not support data-in-transit encryption (e.g., TLS/SSL) when transmi… |
CVE-2020-12040 | Critical | 9.8 | 2020-06-29 | Sigma Spectrum Infusion System v's6.x (model 35700BAX) and Baxter Spectrum Infusion System Version(s) 8.x (model 35700BAX2) at the application layer uses an un… |
CVE-2020-12037 | High | 7.5 | 2020-06-29 | Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The affected devices do not implement data-in-transit encryption (e.g., TLS/SSL) when config… |
CVE-2020-12036 | High | 7.5 | 2020-06-29 | Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The affected devices do not implement data-in-transit encryption (e.g., TLS/SSL) when config… |
CVE-2020-12008 | High | 7.5 | 2020-06-29 | Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems use cleartext messages to communicate order information with an ord… |
CVE-2019-18248 | Medium | 4.3 | 2020-06-29 | BIOTRONIK CardioMessenger II, The affected products transmit credentials in clear-text prior to switching to an encrypted communication channel. An attacker ca… |
CVE-2020-10628 | High | 7.5 | 2020-06-26 | ControlEdge PLC (R130.2, R140, R150, and R151) and RTU (R101, R110, R140, R150, and R151) exposes unencrypted passwords on the network. |
CVE-2020-10624 | High | 7.5 | 2020-06-26 | ControlEdge PLC (R130.2, R140, R150, and R151) and RTU (R101, R110, R140, R150, and R151) exposes a session token on the network. |
CVE-2020-5594 | Critical | 9.8 | 2020-06-23 | Mitsubishi Electric MELSEC iQ-R, iQ-F, Q, L, and FX series CPU modules all versions contain a vulnerability that allows cleartext transmission of sensitive inf… |
CVE-2020-14930 | High | 8.1 | 2020-06-19 | An issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur because the password-reset feature discloses the verification t… |
CVE-2020-14157 | High | 8.1 | 2020-06-17 | The wireless-communication feature of the ABUS Secvest FUBE50001 device does not encrypt sensitive data such as PIN codes or IDs of used proximity chip keys (R… |
CVE-2020-14093 | Medium | 5.9 | 2020-06-15 | Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response. |
CVE-2020-11614 | High | 8.1 | 2020-06-11 | Mids' Reborn Hero Designer 2.6.0.7 downloads the update manifest, as well as update files, over cleartext HTTP. Additionally, the application does not perform… |
CVE-2020-1343 | Medium | 5.9 | 2020-06-09 | An information disclosure vulnerability exists in Visual Studio Code Live Share Extension when it exposes tokens in plain text, aka 'Visual Studio Code Live Sh… |
CVE-2020-13787 | High | 7.5 | 2020-06-03 | D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Transmission of Sensitive Information. |
CVE-2020-2013 | High | 8.3 | 2020-05-13 | A cleartext transmission of sensitive information vulnerability in Palo Alto Networks PAN-OS Panorama that discloses an authenticated PAN-OS administrator's PA… |
CVE-2019-4667 | Medium | 5.9 | 2020-05-11 | IBM UrbanCode Deploy (UCD) 7.0.5.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transpor… |