CWE-319 · Cleartext Transmission of Sensitive Information (page 8)
Page 8 of 10 — CVEs classified under CWE-319, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-5399 | High | 7.4 | 2020-02-12 | Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS. A malicious user with access to the… |
CVE-2019-20061 | High | 7.5 | 2020-02-10 | The user-introduction email in MFScripts YetiShare v3.5.2 through v4.5.4 may leak the (system-picked) password if this email is sent in cleartext. In other wor… |
CVE-2020-8507 | High | 7.5 | 2020-02-05 | The Citytv Video application 4.08.0 for Android and 3.35 for iOS sends Unencrypted Analytics. |
CVE-2020-8506 | Medium | 5.3 | 2020-02-05 | The Global TV application 2.3.2 for Android and 4.7.5 for iOS sends Unencrypted Analytics. |
CVE-2020-7984 | High | 7.5 | 2020-01-26 | SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain admin credentials from the Agent & Probe… |
CVE-2019-19898 | High | 7.5 | 2020-01-23 | In IXP EasyInstall 6.2.13723, there are cleartext credentials in network communication on TCP port 20050 when using the Administrator console remotely. |
CVE-2019-12399 | High | 7.5 | 2020-01-14 | When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is cr… |
CVE-2014-5380 | High | 7.5 | 2020-01-13 | Grand MA 300 allows retrieval of the access PIN from sniffed data. |
CVE-2019-16274 | High | 7.5 | 2020-01-06 | DTEN D5 before 1.3 and D7 before 1.3 devices transfer customer data files via unencrypted HTTP. |
CVE-2019-19967 | High | 7.5 | 2019-12-25 | The Administration page on Connect Box EuroDOCSIS 3.0 Voice Gateway CH7465LG-NCIP-6.12.18.25-2p6-NOSH devices accepts a cleartext password in a POST request on… |
CVE-2019-4743 | Medium | 4.3 | 2019-12-20 | IBM Financial Transaction Manager 3.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie val… |
CVE-2019-15911 | Critical | 9.8 | 2019-12-20 | An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Because of insecure key transport in ZigBee comm… |
CVE-2019-19890 | High | 7.5 | 2019-12-18 | An issue was discovered on Humax Wireless Voice Gateway HGB10R-2 20160817_1855 devices. Admin credentials are sent over cleartext HTTP. |
CVE-2019-19889 | High | 7.5 | 2019-12-18 | An issue was discovered on Humax Wireless Voice Gateway HGB10R-2 20160817_1855 devices. The attacker can discover admin credentials in the backup file, aka bac… |
CVE-2019-8632 | Medium | 6.5 | 2019-12-18 | Some analytics data was sent using HTTP rather than HTTPS. This was addressed by no longer sending this analytics data. This issue is fixed in Texture 5.11.10… |
CVE-2019-3993 | High | 7.5 | 2019-12-17 | ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can recover a user's password hash by se… |
CVE-2019-3992 | High | 7.5 | 2019-12-17 | ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can access the server's configuration fi… |
CVE-2019-16568 | Medium | 5.3 | 2019-12-17 | Jenkins SCTMExecutor Plugin 2.2 and earlier transmits previously configured service credentials in plain text as part of the global configuration, as well as i… |
CVE-2019-16732 | High | 8.1 | 2019-12-13 | Unencrypted HTTP communications for firmware upgrades in Petalk AI and PF-103 allow man-in-the-middle attackers to run arbitrary code as the root user. |
CVE-2019-18285 | Medium | 5.9 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The RMI communication between the client and the A… |
CVE-2019-19251 | Medium | 5.3 | 2019-12-10 | The Last.fm desktop app (Last.fm Scrobbler) through 2.1.39 on macOS makes HTTP requests that include an API key without the use of SSL/TLS. Although there is a… |
CVE-2019-16672 | Critical | 9.8 | 2019-12-06 | An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Sens… |
CVE-2015-7542 | Medium | 5.3 | 2019-12-03 | A vulnerability exists in libgwenhywfar through 4.12.0 due to the usage of outdated bundled CA certificates. |
CVE-2019-19316 | High | 7.5 | 2019-12-02 | When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartex… |
CVE-2012-5562 | High | 8.6 | 2019-12-02 | A flaw was found in rhn-proxy. This vulnerability may allow the rhn-proxy to transmit user credentials in clear-text when it accesses RHN Satellite. This could… |
CVE-2019-12503 | Critical | 9.8 | 2019-12-02 | Due to unencrypted and unauthenticated data communication, the wireless barcode scanner Inateck BCST-60 is prone to keystroke injection attacks. Thus, an attac… |
CVE-2019-12388 | High | 7.5 | 2019-12-02 | Anviz access control devices perform cleartext transmission of sensitive information (passwords/pins and names) when replying to query on port tcp/5010. |
CVE-2019-19463 | Medium | 5.3 | 2019-11-30 | The Anhui Huami Mi Fit application before 4.0.11 for Android has an Unencrypted Update Check. |
CVE-2019-16545 | Medium | 6.5 | 2019-11-21 | Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration forms, potentially resul… |
CVE-2012-1257 | Medium | 5.5 | 2019-11-20 | Pidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain sensitive information via a dbus session monitor. |
CVE-2019-3640 | Medium | 4.8 | 2019-11-14 | Unprotected Transport of Credentials in ePO extension in McAfee Data Loss Prevention 11.x prior to 11.4.0 allows remote attackers with access to the network to… |
CVE-2010-4177 | Medium | 5.5 | 2019-11-12 | mysql-gui-tools (mysql-query-browser and mysql-admin) before 5.0r14+openSUSE-2.3 exposes the password of a user connected to the MySQL server in clear text for… |
CVE-2019-18852 | Critical | 9.8 | 2019-11-11 | Certain D-Link devices have a hardcoded Alphanetworks user account with TELNET access because of /etc/config/image_sign or /etc/alpha_config/image_sign. This a… |
CVE-2019-18800 | High | 8.8 | 2019-11-06 | Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber account, because not all Viber protocol traffi… |
CVE-2019-6846 | Medium | 6.5 | 2019-10-29 | A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware… |
CVE-2019-6845 | High | 7.5 | 2019-10-29 | A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (all firmware… |
CVE-2019-18201 | High | 7.5 | 2019-10-24 | An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, an attacker is… |
CVE-2019-18199 | Medium | 6.6 | 2019-10-24 | An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, and because of… |
CVE-2019-12967 | Medium | 6.5 | 2019-10-22 | Stephan Mooltipass Moolticute through 0.42.1 (and possibly earlier versions) has Incorrect Access Control. |
CVE-2019-17393 | Critical | 9.8 | 2019-10-18 | The Customer's Tomedo Server in Version 1.7.3 communicates to the Vendor Tomedo Server via HTTP (in cleartext) that can be sniffed by unauthorized actors. Basi… |
CVE-2019-15626 | High | 7.5 | 2019-10-17 | The Deep Security Manager application (Versions 10.0, 11.0 and 12.0), when configured in a certain way, may transmit initial LDAP communication in clear text… |
CVE-2019-17356 | Medium | 6.5 | 2019-10-15 | The Infinite Design application 3.4.12 for Android sends a username and password via TCP without any encryption during login, as demonstrated by sniffing of a… |
CVE-2019-9532 | High | 7.8 | 2019-10-10 | The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext. This could allow an unauthenticated, local… |
CVE-2019-0069 | Medium | 5.9 | 2019-10-09 | On EX4600, QFX5100 Series, NFX Series, QFX10K Series, QFX5110, QFX5200 Series, QFX5110, QFX5200, QFX10K Series, vSRX, SRX1500, SRX4000 Series, vSRX, SRX1500, S… |
CVE-2019-14808 | Medium | 6.8 | 2019-10-09 | An issue was discovered in the RENPHO application 3.0.0 for iOS. It transmits JSON data unencrypted to a server without an integrity check, if a user changes p… |
CVE-2019-17218 | Critical | 9.1 | 2019-10-06 | An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. By default, the communication to the web service is unencryp… |
CVE-2019-14959 | Medium | 5.9 | 2019-10-02 | JetBrains Toolbox before 1.15.5605 was resolving an internal URL via a cleartext http connection. |
CVE-2019-0231 | High | 7.5 | 2019-10-01 | Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client poten… |
CVE-2019-14954 | Medium | 5.9 | 2019-10-01 | JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http connection. |
CVE-2019-10435 | High | 7.5 | 2019-10-01 | Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure. |
CVE-2019-10434 | High | 7.5 | 2019-10-01 | Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their expos… |
CVE-2019-4280 | Medium | 5.3 | 2019-09-30 | IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 displays sensitive information in HTTP requests which could be used in further attacks against the system. IB… |
CVE-2019-16924 | High | 8.8 | 2019-09-27 | The Nulock application 1.5.0 for mobile devices sends a cleartext password over Bluetooth, which allows remote attackers (after sniffing the network) to take c… |
CVE-2019-11739 | Medium | 6.5 | 2019-09-27 | Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunde… |
CVE-2019-6652 | Medium | 6.5 | 2019-09-25 | In BIG-IQ 6.0.0-6.1.0, services for stats do not require authentication nor do they implement any form of Transport Layer Security (TLS). |
CVE-2019-10428 | High | 7.5 | 2019-09-25 | Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, pote… |
CVE-2019-10427 | Medium | 5.3 | 2019-09-25 | Jenkins Aqua MicroScanner Plugin 1.0.7 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potential… |
CVE-2019-10412 | High | 7.5 | 2019-09-25 | Jenkins Inedo ProGet Plugin 1.2 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resu… |
CVE-2019-10411 | High | 7.5 | 2019-09-25 | Jenkins Inedo BuildMaster Plugin 2.4.0 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potential… |
CVE-2019-5505 | Critical | 9.8 | 2019-09-24 | ONTAP Select Deploy administration utility versions 2.2 through 2.12.1 transmit credentials in plaintext. |
CVE-2019-15635 | Medium | 4.9 | 2019-09-23 | An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana (e.g., MySQL) are not encrypted. An admin user can reveal passwords for an… |
CVE-2019-10397 | Low | 3.1 | 2019-09-12 | Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentiall… |
CVE-2019-5503 | Medium | 5.3 | 2019-09-10 | OnCommand Workflow Automation versions prior to 5.0 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive… |
CVE-2019-14319 | Medium | 6.5 | 2019-09-04 | The TikTok (formerly Musical.ly) application 12.2.0 for Android and iOS performs unencrypted transmission of images, videos, and likes. This allows an attacker… |
CVE-2019-10391 | Medium | 6.5 | 2019-08-28 | Jenkins IBM Application Security on Cloud Plugin 1.2.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potential… |
CVE-2019-5635 | High | 7.5 | 2019-08-22 | A cleartext transmission of sensitive information vulnerability is present in Hickory Smart Ethernet Bridge from Belwith Products, LLC. Captured data reveals t… |
CVE-2019-11276 | Medium | 5.4 | 2019-08-19 | Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.16, 2.4.x prior to 2.4.12, 2.5.x prior to 2.5.8, and 2.6.x prior to 2… |
CVE-2019-15135 | High | 7.5 | 2019-08-18 | The handshake protocol in Object Management Group (OMG) DDS Security 1.1 sends cleartext information about all of the capabilities of a participant (including… |
CVE-2019-0348 | Medium | 6.5 | 2019-08-14 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.1, 4.2, can access database with unencrypted connection, even if the quality… |
CVE-2019-0346 | Medium | 6.5 | 2019-08-14 | Unencrypted communication error in SAP Business Objects Business Intelligence Platform (Central Management Console), version 4.2, leads to disclosure of list o… |
CVE-2019-14664 | Medium | 6.5 | 2019-08-05 | In Enigmail below 2.1, an attacker in possession of PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can… |
CVE-2019-10363 | Medium | 4.9 | 2019-07-31 | Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported in their encrypted form. |
CVE-2019-5448 | High | 8.1 | 2019-07-30 | Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over t… |
CVE-2019-13498 | High | 7.4 | 2019-07-29 | One Identity Cloud Access Manager 8.1.3 does not use HTTP Strict Transport Security (HSTS), which may allow man-in-the-middle (MITM) attacks. This issue is fix… |
CVE-2019-12820 | Medium | 5.6 | 2019-07-19 | A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner. Actions performed on the app such as changing a password, and persona… |
CVE-2019-10102 | High | 8.1 | 2019-07-03 | JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0 were resolving artifacts using an http connection during the build proce… |
CVE-2019-10101 | High | 8.1 | 2019-07-03 | JetBrains Kotlin versions before 1.3.30 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack. |
CVE-2019-6640 | Medium | 5.3 | 2019-07-03 | On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, SNMP exposes sensitive configuration objects ov… |
CVE-2018-11422 | Critical | 9.8 | 2019-07-03 | Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary configuration protocol that does not provide confidentiality, integrity, a… |
CVE-2018-11421 | Critical | 9.8 | 2019-07-03 | Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary monitoring protocol that does not provide confidentiality, integrity, and… |
CVE-2019-3619 | Medium | 6.8 | 2019-07-03 | Information Disclosure vulnerability in the Agent Handler in McAfee ePolicy Orchestrator (ePO) 5.9.x and 5.10.0 prior to 5.10.0 update 4 allows remote unauthen… |
CVE-2019-12781 | Medium | 5.3 | 2019-07-01 | An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROX… |
CVE-2019-4382 | Medium | 5.3 | 2019-06-25 | IBM API Connect 5.0.0.0 through 5.0.8.6 could allow an unauthorized user to obtain sensitive information about the system users using specially crafted HTTP re… |
CVE-2019-12813 | Medium | 5.9 | 2019-06-13 | An issue was discovered in Digital Persona U.are.U 4500 Fingerprint Reader v24. The key and salt used for obfuscating the fingerprint image exhibit cleartext w… |
CVE-2019-10926 | Medium | 5.3 | 2019-06-12 | A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6). Communication with the device is not encrypted. Data transmitted between t… |
CVE-2019-12506 | High | 8.8 | 2019-06-07 | Due to unencrypted and unauthenticated data communication, the wireless presenter Logitech R700 Laser Presentation Remote R-R0010 is prone to keystroke injecti… |
CVE-2019-12505 | High | 8.8 | 2019-06-07 | Due to unencrypted and unauthenticated data communication, the wireless presenter Inateck WP1001 v1.3C is prone to keystroke injection attacks. Thus, an attack… |
CVE-2019-12504 | High | 8.8 | 2019-06-07 | Due to unencrypted and unauthenticated data communication, the wireless presenter Inateck WP2002 is prone to keystroke injection attacks. Thus, an attacker is… |
CVE-2019-4162 | High | 7.5 | 2019-06-06 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 is missing the HTTP Strict Transport Security header. Users can navigate by mistake to the unencr… |
CVE-2019-5496 | High | 7.5 | 2019-05-10 | Oncommand Insight versions prior to 7.3.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive informatio… |
CVE-2019-5494 | High | 7.5 | 2019-05-10 | OnCommand Unified Manager 7-Mode prior to version 5.2.4 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensit… |
CVE-2019-6613 | Medium | 5.3 | 2019-05-03 | On BIG-IP 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, SNMP may expose sensitive configuration objects over insecure transmission channe… |
CVE-2019-11220 | High | 8.1 | 2019-04-26 | An authentication flaw in Shenzhen Yunni Technology iLnkP2P allows remote attackers to actively intercept user-to-device traffic in cleartext, including video… |
CVE-2019-3801 | Critical | 9.8 | 2019-04-25 | Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote… |
CVE-2018-1360 | High | 8.1 | 2019-04-25 | A cleartext transmission of sensitive information vulnerability in Fortinet FortiManager 5.2.0 through 5.2.7, 5.4.0 and 5.4.1 may allow an unauthenticated atta… |
CVE-2019-3793 | Critical | 9.8 | 2019-04-24 | Pivotal Apps Manager Release, versions 665.0.x prior to 665.0.28, versions 666.0.x prior to 666.0.21, versions 667.0.x prior to 667.0.7, contain an invitation… |
CVE-2019-6526 | Critical | 9.8 | 2019-04-15 | Moxa IKS-G6824A series Versions 4.5 and prior, EDS-405A series Version 3.8 and prior, EDS-408A series Version 3.8 and prior, and EDS-510A series Version 3.8 an… |
CVE-2019-10740 | Medium | 4.3 | 2019-04-07 | In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. Th… |
CVE-2019-10735 | Medium | 4.3 | 2019-04-07 | In Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted pa… |
CVE-2019-10734 | Medium | 4.3 | 2019-04-07 | In KDE Trojita 0.7, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part… |