CWE-319 · Cleartext Transmission of Sensitive Information (page 8)
Page 8 of 10 — CVEs classified under CWE-319, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-4092 | Medium | 5.3 | 2020-05-06 | "If port encryption is not enabled on the Domino Server, HCL Nomad on Android and iOS Platforms will communicate in clear text and does not currently have a us… |
CVE-2020-5893 | Low | 3.7 | 2020-04-30 | In versions 7.1.5-7.1.8, when a user connects to a VPN using BIG-IP Edge Client over an unsecure network, BIG-IP Edge Client responds to authentication request… |
CVE-2020-5886 | Critical | 9.1 | 2020-04-30 | On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems setup for connection mirroring in a High Availability (HA) p… |
CVE-2020-5885 | Critical | 9.1 | 2020-04-30 | On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems set up for connection mirroring in a high availability (HA)… |
CVE-2020-5879 | High | 7.5 | 2020-04-30 | On BIG-IP ASM 11.6.1-11.6.5.1, under certain configurations, the BIG-IP system sends data plane traffic to back-end servers unencrypted, even when a Server SSL… |
CVE-2020-5876 | High | 8.1 | 2020-04-30 | On BIG-IP 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, a race condition exists where mcpd and other processes may m… |
CVE-2020-5867 | High | 8.1 | 2020-04-23 | In versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP instead of HTTPS to check and install packages |
CVE-2020-5865 | Medium | 4.8 | 2020-04-23 | In versions prior to 3.3.0, the NGINX Controller is configured to communicate with its Postgres database server over unencrypted channels, making the communica… |
CVE-2020-7488 | High | 7.5 | 2020-04-22 | A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could leak sensitive information transmitted between the software and the… |
CVE-2019-19107 | Medium | 6.2 | 2020-04-22 | The Configuration pages in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway for user profiles and services transfer the password in plai… |
CVE-2020-11685 | High | 7.5 | 2020-04-22 | In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS. |
CVE-2020-11539 | High | 8.1 | 2020-04-22 | An issue was discovered on Tata Sonata Smart SF Rush 1.12 devices. It has been identified that the smart band has no pairing (mode 0 Bluetooth LE security leve… |
CVE-2020-7483 | High | 7.5 | 2020-04-16 | **VERSION NOT SUPPORTED WHEN ASSIGNED** A vulnerability could cause certain data to be visible on the network when the 'password' feature is enabled. This vuln… |
CVE-2019-4594 | Medium | 5.9 | 2020-04-15 | IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport… |
CVE-2020-6195 | Critical | 9.8 | 2020-04-14 | SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, leading to Information Disclosure. It in… |
CVE-2020-11557 | High | 7.5 | 2020-04-09 | An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. It includes the username and password values in cleartext within each request's… |
CVE-2020-11542 | Critical | 9.8 | 2020-04-04 | 3xLOGIC Infinias eIDC32 2.213 devices with Web 1.107 allow Authentication Bypass via CMD.HTM?CMD= because authentication depends on the client side's interpret… |
CVE-2020-5860 | High | 8.1 | 2020-03-27 | On BIG-IP 15.0.0-15.1.0.2, 14.1.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5.1, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, in a High Ava… |
CVE-2019-19127 | High | 8.1 | 2020-03-25 | An authentication bypass vulnerability is present in the standalone SITS:Vision 9.7.0 component of Tribal SITS in its default configuration, related to unencry… |
CVE-2020-6997 | High | 7.5 | 2020-03-24 | In Moxa EDS-G516E Series firmware, Version 5.2 or lower, sensitive information is transmitted over some web applications in cleartext. |
CVE-2020-7003 | High | 7.5 | 2020-03-24 | In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower, sensitive information is transmitted ov… |
CVE-2019-16063 | High | 7.5 | 2020-03-19 | NETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data rendered within web pages. It is possible for an attacker to expose unencrypted sensitive da… |
CVE-2019-16067 | High | 7.5 | 2020-03-19 | NETSAS Enigma NMS 65.0.0 and prior utilises basic authentication over HTTP for enforcing access control to the web application. The use of weak authentication… |
CVE-2019-12122 | Medium | 6.5 | 2020-03-18 | An issue was discovered in ONAP Portal through Dublin. By executing a call to ONAPPORTAL/portalApi/loggedinUser, an attacker who possesses a user's cookie may… |
CVE-2019-13394 | Critical | 9.8 | 2020-03-13 | The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses HTTP Basic Authentication over cleartext HTTP. |
CVE-2020-0884 | Low | 3.7 | 2020-03-12 | A spoofing vulnerability exists in Microsoft Visual Studio as it includes a reply URL that is not secured by SSL, aka 'Microsoft Visual Studio Spoofing Vulnera… |
CVE-2019-5107 | High | 7.5 | 2020-03-11 | A cleartext transmission vulnerability exists in the network communication functionality of WAGO e!Cockpit version 1.5.1.1. An attacker with access to network… |
CVE-2019-9101 | High | 7.5 | 2020-03-11 | An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices… |
CVE-2020-10376 | Critical | 9.8 | 2020-03-11 | Technicolor TC7337NET 08.89.17.23.03 devices allow remote attackers to discover passwords by sniffing the network for an "Authorization: Basic" HTTP header. |
CVE-2020-6198 | Critical | 9.8 | 2020-03-10 | SAP Solution Manager (Diagnostics Agent), version 720, allows unencrypted connections from unauthenticated sources. This allows an attacker to control all remo… |
CVE-2020-2157 | Medium | 4.3 | 2020-03-09 | Jenkins Skytap Cloud CI Plugin 2.07 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in the… |
CVE-2020-2156 | Medium | 4.3 | 2020-03-09 | Jenkins DeployHub Plugin 8.0.14 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their e… |
CVE-2020-2155 | Medium | 5.3 | 2020-03-09 | Jenkins OpenShift Deployer Plugin 1.2.0 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentiall… |
CVE-2020-2153 | Medium | 4.3 | 2020-03-09 | Jenkins Backlog Plugin 2.4 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposu… |
CVE-2020-2151 | Medium | 5.3 | 2020-03-09 | Jenkins Quality Gates Plugin 2.5 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resul… |
CVE-2020-2150 | Medium | 5.3 | 2020-03-09 | Jenkins Sonar Quality Gates Plugin 1.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potential… |
CVE-2020-2149 | Medium | 5.3 | 2020-03-09 | Jenkins Repository Connector Plugin 1.2.6 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentia… |
CVE-2020-2143 | Medium | 5.3 | 2020-03-09 | Jenkins Logstash Plugin 2.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resultin… |
CVE-2020-9550 | Critical | 9.8 | 2020-03-04 | Rubetek SmartHome 2020 devices use unencrypted 433 MHz communication between controllers and beacons, allowing an attacker to sniff and spoof beacon requests r… |
CVE-2020-9477 | Critical | 9.8 | 2020-03-04 | An issue was discovered on HUMAX HGA12R-02 BRGCAA 1.1.53 devices. A vulnerability in the authentication functionality in the web-based interface could allow an… |
CVE-2020-3841 | Medium | 6.5 | 2020-02-27 | The issue was addressed with improved UI handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, Safari 13.0.5. A local user may unknowingly send a pass… |
CVE-2020-7907 | High | 7.5 | 2020-02-21 | In the JetBrains Scala plugin before 2019.2.1, some artefact dependencies were resolved over unencrypted connections. |
CVE-2020-5399 | High | 7.4 | 2020-02-12 | Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS. A malicious user with access to the… |
CVE-2019-20061 | High | 7.5 | 2020-02-10 | The user-introduction email in MFScripts YetiShare v3.5.2 through v4.5.4 may leak the (system-picked) password if this email is sent in cleartext. In other wor… |
CVE-2020-8507 | High | 7.5 | 2020-02-05 | The Citytv Video application 4.08.0 for Android and 3.35 for iOS sends Unencrypted Analytics. |
CVE-2020-8506 | Medium | 5.3 | 2020-02-05 | The Global TV application 2.3.2 for Android and 4.7.5 for iOS sends Unencrypted Analytics. |
CVE-2020-7984 | High | 7.5 | 2020-01-26 | SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain admin credentials from the Agent & Probe… |
CVE-2019-19898 | High | 7.5 | 2020-01-23 | In IXP EasyInstall 6.2.13723, there are cleartext credentials in network communication on TCP port 20050 when using the Administrator console remotely. |
CVE-2019-12399 | High | 7.5 | 2020-01-14 | When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is cr… |
CVE-2014-5380 | High | 7.5 | 2020-01-13 | Grand MA 300 allows retrieval of the access PIN from sniffed data. |
CVE-2019-16274 | High | 7.5 | 2020-01-06 | DTEN D5 before 1.3 and D7 before 1.3 devices transfer customer data files via unencrypted HTTP. |
CVE-2019-19967 | High | 7.5 | 2019-12-25 | The Administration page on Connect Box EuroDOCSIS 3.0 Voice Gateway CH7465LG-NCIP-6.12.18.25-2p6-NOSH devices accepts a cleartext password in a POST request on… |
CVE-2019-4743 | Medium | 4.3 | 2019-12-20 | IBM Financial Transaction Manager 3.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie val… |
CVE-2019-15911 | Critical | 9.8 | 2019-12-20 | An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Because of insecure key transport in ZigBee comm… |
CVE-2019-19890 | High | 7.5 | 2019-12-18 | An issue was discovered on Humax Wireless Voice Gateway HGB10R-2 20160817_1855 devices. Admin credentials are sent over cleartext HTTP. |
CVE-2019-19889 | High | 7.5 | 2019-12-18 | An issue was discovered on Humax Wireless Voice Gateway HGB10R-2 20160817_1855 devices. The attacker can discover admin credentials in the backup file, aka bac… |
CVE-2019-8632 | Medium | 6.5 | 2019-12-18 | Some analytics data was sent using HTTP rather than HTTPS. This was addressed by no longer sending this analytics data. This issue is fixed in Texture 5.11.10… |
CVE-2019-3993 | High | 7.5 | 2019-12-17 | ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can recover a user's password hash by se… |
CVE-2019-3992 | High | 7.5 | 2019-12-17 | ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can access the server's configuration fi… |
CVE-2019-16568 | Medium | 5.3 | 2019-12-17 | Jenkins SCTMExecutor Plugin 2.2 and earlier transmits previously configured service credentials in plain text as part of the global configuration, as well as i… |
CVE-2019-16732 | High | 8.1 | 2019-12-13 | Unencrypted HTTP communications for firmware upgrades in Petalk AI and PF-103 allow man-in-the-middle attackers to run arbitrary code as the root user. |
CVE-2019-18285 | Medium | 5.9 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The RMI communication between the client and the A… |
CVE-2019-19251 | Medium | 5.3 | 2019-12-10 | The Last.fm desktop app (Last.fm Scrobbler) through 2.1.39 on macOS makes HTTP requests that include an API key without the use of SSL/TLS. Although there is a… |
CVE-2019-16672 | Critical | 9.8 | 2019-12-06 | An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Sens… |
CVE-2015-7542 | Medium | 5.3 | 2019-12-03 | A vulnerability exists in libgwenhywfar through 4.12.0 due to the usage of outdated bundled CA certificates. |
CVE-2019-19316 | High | 7.5 | 2019-12-02 | When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartex… |
CVE-2012-5562 | High | 8.6 | 2019-12-02 | A flaw was found in rhn-proxy. This vulnerability may allow the rhn-proxy to transmit user credentials in clear-text when it accesses RHN Satellite. This could… |
CVE-2019-12503 | Critical | 9.8 | 2019-12-02 | Due to unencrypted and unauthenticated data communication, the wireless barcode scanner Inateck BCST-60 is prone to keystroke injection attacks. Thus, an attac… |
CVE-2019-12388 | High | 7.5 | 2019-12-02 | Anviz access control devices perform cleartext transmission of sensitive information (passwords/pins and names) when replying to query on port tcp/5010. |
CVE-2019-19463 | Medium | 5.3 | 2019-11-30 | The Anhui Huami Mi Fit application before 4.0.11 for Android has an Unencrypted Update Check. |
CVE-2019-16545 | Medium | 6.5 | 2019-11-21 | Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration forms, potentially resul… |
CVE-2012-1257 | Medium | 5.5 | 2019-11-20 | Pidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain sensitive information via a dbus session monitor. |
CVE-2019-3640 | Medium | 4.8 | 2019-11-14 | Unprotected Transport of Credentials in ePO extension in McAfee Data Loss Prevention 11.x prior to 11.4.0 allows remote attackers with access to the network to… |
CVE-2010-4177 | Medium | 5.5 | 2019-11-12 | mysql-gui-tools (mysql-query-browser and mysql-admin) before 5.0r14+openSUSE-2.3 exposes the password of a user connected to the MySQL server in clear text for… |
CVE-2019-18852 | Critical | 9.8 | 2019-11-11 | Certain D-Link devices have a hardcoded Alphanetworks user account with TELNET access because of /etc/config/image_sign or /etc/alpha_config/image_sign. This a… |
CVE-2019-18800 | High | 8.8 | 2019-11-06 | Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber account, because not all Viber protocol traffi… |
CVE-2019-6846 | Medium | 6.5 | 2019-10-29 | A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware… |
CVE-2019-6845 | High | 7.5 | 2019-10-29 | A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (all firmware… |
CVE-2019-18201 | High | 7.5 | 2019-10-24 | An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, an attacker is… |
CVE-2019-18199 | Medium | 6.6 | 2019-10-24 | An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, and because of… |
CVE-2019-12967 | Medium | 6.5 | 2019-10-22 | Stephan Mooltipass Moolticute through 0.42.1 (and possibly earlier versions) has Incorrect Access Control. |
CVE-2019-17393 | Critical | 9.8 | 2019-10-18 | The Customer's Tomedo Server in Version 1.7.3 communicates to the Vendor Tomedo Server via HTTP (in cleartext) that can be sniffed by unauthorized actors. Basi… |
CVE-2019-15626 | High | 7.5 | 2019-10-17 | The Deep Security Manager application (Versions 10.0, 11.0 and 12.0), when configured in a certain way, may transmit initial LDAP communication in clear text… |
CVE-2019-17356 | Medium | 6.5 | 2019-10-15 | The Infinite Design application 3.4.12 for Android sends a username and password via TCP without any encryption during login, as demonstrated by sniffing of a… |
CVE-2019-9532 | High | 7.8 | 2019-10-10 | The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext. This could allow an unauthenticated, local… |
CVE-2019-0069 | Medium | 5.9 | 2019-10-09 | On EX4600, QFX5100 Series, NFX Series, QFX10K Series, QFX5110, QFX5200 Series, QFX5110, QFX5200, QFX10K Series, vSRX, SRX1500, SRX4000 Series, vSRX, SRX1500, S… |
CVE-2019-14808 | Medium | 6.8 | 2019-10-09 | An issue was discovered in the RENPHO application 3.0.0 for iOS. It transmits JSON data unencrypted to a server without an integrity check, if a user changes p… |
CVE-2019-17218 | Critical | 9.1 | 2019-10-06 | An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. By default, the communication to the web service is unencryp… |
CVE-2019-14959 | Medium | 5.9 | 2019-10-02 | JetBrains Toolbox before 1.15.5605 was resolving an internal URL via a cleartext http connection. |
CVE-2019-0231 | High | 7.5 | 2019-10-01 | Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client poten… |
CVE-2019-14954 | Medium | 5.9 | 2019-10-01 | JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http connection. |
CVE-2019-10435 | High | 7.5 | 2019-10-01 | Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure. |
CVE-2019-10434 | High | 7.5 | 2019-10-01 | Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their expos… |
CVE-2019-4280 | Medium | 5.3 | 2019-09-30 | IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 displays sensitive information in HTTP requests which could be used in further attacks against the system. IB… |
CVE-2019-16924 | High | 8.8 | 2019-09-27 | The Nulock application 1.5.0 for mobile devices sends a cleartext password over Bluetooth, which allows remote attackers (after sniffing the network) to take c… |
CVE-2019-11739 | Medium | 6.5 | 2019-09-27 | Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunde… |
CVE-2019-6652 | Medium | 6.5 | 2019-09-25 | In BIG-IQ 6.0.0-6.1.0, services for stats do not require authentication nor do they implement any form of Transport Layer Security (TLS). |
CVE-2019-10428 | High | 7.5 | 2019-09-25 | Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, pote… |
CVE-2019-10427 | Medium | 5.3 | 2019-09-25 | Jenkins Aqua MicroScanner Plugin 1.0.7 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potential… |
CVE-2019-10412 | High | 7.5 | 2019-09-25 | Jenkins Inedo ProGet Plugin 1.2 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resu… |