CWE-319 · Cleartext Transmission of Sensitive Information (page 9)
Page 9 of 10 — CVEs classified under CWE-319, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10411 | High | 7.5 | 2019-09-25 | Jenkins Inedo BuildMaster Plugin 2.4.0 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potential… |
CVE-2019-5505 | Critical | 9.8 | 2019-09-24 | ONTAP Select Deploy administration utility versions 2.2 through 2.12.1 transmit credentials in plaintext. |
CVE-2019-15635 | Medium | 4.9 | 2019-09-23 | An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana (e.g., MySQL) are not encrypted. An admin user can reveal passwords for an… |
CVE-2019-10397 | Low | 3.1 | 2019-09-12 | Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentiall… |
CVE-2019-5503 | Medium | 5.3 | 2019-09-10 | OnCommand Workflow Automation versions prior to 5.0 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive… |
CVE-2019-14319 | Medium | 6.5 | 2019-09-04 | The TikTok (formerly Musical.ly) application 12.2.0 for Android and iOS performs unencrypted transmission of images, videos, and likes. This allows an attacker… |
CVE-2019-10391 | Medium | 6.5 | 2019-08-28 | Jenkins IBM Application Security on Cloud Plugin 1.2.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potential… |
CVE-2019-5635 | High | 7.5 | 2019-08-22 | A cleartext transmission of sensitive information vulnerability is present in Hickory Smart Ethernet Bridge from Belwith Products, LLC. Captured data reveals t… |
CVE-2019-11276 | Medium | 5.4 | 2019-08-19 | Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.16, 2.4.x prior to 2.4.12, 2.5.x prior to 2.5.8, and 2.6.x prior to 2… |
CVE-2019-15135 | High | 7.5 | 2019-08-18 | The handshake protocol in Object Management Group (OMG) DDS Security 1.1 sends cleartext information about all of the capabilities of a participant (including… |
CVE-2019-0348 | Medium | 6.5 | 2019-08-14 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.1, 4.2, can access database with unencrypted connection, even if the quality… |
CVE-2019-0346 | Medium | 6.5 | 2019-08-14 | Unencrypted communication error in SAP Business Objects Business Intelligence Platform (Central Management Console), version 4.2, leads to disclosure of list o… |
CVE-2019-14664 | Medium | 6.5 | 2019-08-05 | In Enigmail below 2.1, an attacker in possession of PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can… |
CVE-2019-10363 | Medium | 4.9 | 2019-07-31 | Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported in their encrypted form. |
CVE-2019-5448 | High | 8.1 | 2019-07-30 | Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over t… |
CVE-2019-13498 | High | 7.4 | 2019-07-29 | One Identity Cloud Access Manager 8.1.3 does not use HTTP Strict Transport Security (HSTS), which may allow man-in-the-middle (MITM) attacks. This issue is fix… |
CVE-2019-12820 | Medium | 5.6 | 2019-07-19 | A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner. Actions performed on the app such as changing a password, and persona… |
CVE-2019-10102 | High | 8.1 | 2019-07-03 | JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0 were resolving artifacts using an http connection during the build proce… |
CVE-2019-10101 | High | 8.1 | 2019-07-03 | JetBrains Kotlin versions before 1.3.30 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack. |
CVE-2019-6640 | Medium | 5.3 | 2019-07-03 | On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, SNMP exposes sensitive configuration objects ov… |
CVE-2018-11422 | Critical | 9.8 | 2019-07-03 | Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary configuration protocol that does not provide confidentiality, integrity, a… |
CVE-2018-11421 | Critical | 9.8 | 2019-07-03 | Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary monitoring protocol that does not provide confidentiality, integrity, and… |
CVE-2019-3619 | Medium | 6.8 | 2019-07-03 | Information Disclosure vulnerability in the Agent Handler in McAfee ePolicy Orchestrator (ePO) 5.9.x and 5.10.0 prior to 5.10.0 update 4 allows remote unauthen… |
CVE-2019-12781 | Medium | 5.3 | 2019-07-01 | An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROX… |
CVE-2019-4382 | Medium | 5.3 | 2019-06-25 | IBM API Connect 5.0.0.0 through 5.0.8.6 could allow an unauthorized user to obtain sensitive information about the system users using specially crafted HTTP re… |
CVE-2019-12813 | Medium | 5.9 | 2019-06-13 | An issue was discovered in Digital Persona U.are.U 4500 Fingerprint Reader v24. The key and salt used for obfuscating the fingerprint image exhibit cleartext w… |
CVE-2019-10926 | Medium | 5.3 | 2019-06-12 | A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6). Communication with the device is not encrypted. Data transmitted between t… |
CVE-2019-12506 | High | 8.8 | 2019-06-07 | Due to unencrypted and unauthenticated data communication, the wireless presenter Logitech R700 Laser Presentation Remote R-R0010 is prone to keystroke injecti… |
CVE-2019-12505 | High | 8.8 | 2019-06-07 | Due to unencrypted and unauthenticated data communication, the wireless presenter Inateck WP1001 v1.3C is prone to keystroke injection attacks. Thus, an attack… |
CVE-2019-12504 | High | 8.8 | 2019-06-07 | Due to unencrypted and unauthenticated data communication, the wireless presenter Inateck WP2002 is prone to keystroke injection attacks. Thus, an attacker is… |
CVE-2019-4162 | High | 7.5 | 2019-06-06 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 is missing the HTTP Strict Transport Security header. Users can navigate by mistake to the unencr… |
CVE-2019-5496 | High | 7.5 | 2019-05-10 | Oncommand Insight versions prior to 7.3.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive informatio… |
CVE-2019-5494 | High | 7.5 | 2019-05-10 | OnCommand Unified Manager 7-Mode prior to version 5.2.4 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensit… |
CVE-2019-6613 | Medium | 5.3 | 2019-05-03 | On BIG-IP 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, SNMP may expose sensitive configuration objects over insecure transmission channe… |
CVE-2019-11220 | High | 8.1 | 2019-04-26 | An authentication flaw in Shenzhen Yunni Technology iLnkP2P allows remote attackers to actively intercept user-to-device traffic in cleartext, including video… |
CVE-2019-3801 | Critical | 9.8 | 2019-04-25 | Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote… |
CVE-2018-1360 | High | 8.1 | 2019-04-25 | A cleartext transmission of sensitive information vulnerability in Fortinet FortiManager 5.2.0 through 5.2.7, 5.4.0 and 5.4.1 may allow an unauthenticated atta… |
CVE-2019-3793 | Critical | 9.8 | 2019-04-24 | Pivotal Apps Manager Release, versions 665.0.x prior to 665.0.28, versions 666.0.x prior to 666.0.21, versions 667.0.x prior to 667.0.7, contain an invitation… |
CVE-2019-6526 | Critical | 9.8 | 2019-04-15 | Moxa IKS-G6824A series Versions 4.5 and prior, EDS-405A series Version 3.8 and prior, EDS-408A series Version 3.8 and prior, and EDS-510A series Version 3.8 an… |
CVE-2019-10740 | Medium | 4.3 | 2019-04-07 | In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. Th… |
CVE-2019-10735 | Medium | 4.3 | 2019-04-07 | In Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted pa… |
CVE-2019-10734 | Medium | 4.3 | 2019-04-07 | In KDE Trojita 0.7, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part… |
CVE-2019-10732 | Medium | 4.3 | 2019-04-07 | In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part… |
CVE-2019-10240 | High | 8.1 | 2019-04-03 | Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts c… |
CVE-2019-1010260 | High | 8.1 | 2019-04-02 | Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exp… |
CVE-2019-10251 | Medium | 5.9 | 2019-03-28 | The UCWeb UC Browser application through 2019-03-26 for Android uses HTTP to download certain modules associated with PDF and Microsoft Office files (related t… |
CVE-2019-10250 | Medium | 5.9 | 2019-03-28 | UCWeb UC Browser 7.0.185.1002 on Windows uses HTTP for downloading certain PDF modules, which allows MITM attacks. |
CVE-2019-9860 | High | 7.5 | 2019-03-27 | Due to unencrypted signal communication and predictability of rolling codes, an attacker can "desynchronize" an ABUS Secvest wireless remote control (FUBE50014… |
CVE-2019-6540 | Medium | 6.5 | 2019-03-26 | The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer… |
CVE-2019-4063 | Medium | 5.9 | 2019-03-05 | IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 Standard Edition could allow highly sensitive information to be transmitted in plain text. An attacker coul… |
CVE-2019-8345 | Medium | 4.2 | 2019-02-15 | The Help feature in the ES File Explorer File Manager application 4.1.9.7.4 for Android allows session hijacking by a Man-in-the-middle attacker on the local n… |
CVE-2019-7675 | High | 7.5 | 2019-02-09 | An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. The default management application is delivered over cleartext HTTP with Basic Authentication, as… |
CVE-2018-18908 | Medium | 5.9 | 2019-01-20 | The Sky Go Desktop application 1.0.19-1 through 1.0.23-1 for Windows performs several requests over cleartext HTTP. This makes the data submitted in these requ… |
CVE-2019-5489 | Medium | 5.5 | 2019-01-07 | The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe page cache access patterns of other process… |
CVE-2018-17195 | High | 7.5 | 2018-12-19 | The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle (MiTM) attack, resultin… |
CVE-2018-1525 | Medium | 5.9 | 2018-12-06 | IBM i2 Enterprise Insight Analysis 2.1.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Tr… |
CVE-2018-7960 | High | 7.4 | 2018-11-27 | There is a SRTP icon display vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack to intercept the pac… |
CVE-2018-19111 | Medium | 5.3 | 2018-11-08 | The Google Cardboard application 1.8 for Android and 1.2 for iOS sends potentially private cleartext information to the Unity 3D Stats web site, as demonstrate… |
CVE-2018-12674 | Medium | 5.7 | 2018-10-19 | The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) stores the username and password within the cookies of a sessio… |
CVE-2018-18071 | High | 7.5 | 2018-10-09 | An issue was discovered in the Daimler Mercedes-Benz Me app 2.11.0-846 for iOS. The encrypted Connected Vehicle API data exchange between the app and a server… |
CVE-2018-5402 | Critical | 9.1 | 2018-10-08 | The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App use an embedded webserver that uses unencrypted plaintext for the transmission of the ad… |
CVE-2018-5401 | Critical | 9.1 | 2018-10-08 | The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App transmit sensitive or security-critical data in cleartext in a communication channel tha… |
CVE-2018-15752 | High | 8.1 | 2018-10-02 | An issue was discovered in the MensaMax (aka com.breustedt.mensamax) application 4.3 for Android. Cleartext Transmission of Sensitive Information allows man-in… |
CVE-2018-8842 | High | 8.8 | 2018-09-26 | Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software transmits sensitive or security-critical data in cleartext in a communication c… |
CVE-2018-13140 | High | 8.1 | 2018-09-24 | Druide Antidote through 9.5.1 on Windows and Linux allows remote code execution through the update mechanism by leveraging use of HTTP to download installation… |
CVE-2018-16225 | Medium | 6.5 | 2018-09-18 | The QBee MultiSensor Camera through 4.16.4 accepts unencrypted network traffic from clients (such as the QBee Cam application through 1.0.5 for Android and the… |
CVE-2018-14627 | Medium | 5.3 | 2018-09-04 | The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is required. Servers before this version that are… |
CVE-2018-12710 | High | 8.0 | 2018-08-29 | An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account (which is a low privilege account) access… |
CVE-2018-11749 | Critical | 9.8 | 2018-08-24 | When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. This affects Puppet… |
CVE-2018-10634 | Medium | 4.8 | 2018-08-13 | Communications between Medtronic MiniMed MMT pumps and wireless accessories are transmitted in cleartext. A sufficiently skilled attacker could capture these t… |
CVE-2018-11050 | High | 8.8 | 2018-08-01 | Dell EMC NetWorker versions between 9.0 and 9.1.1.8 through 9.2.1.3, and the version 18.1.0.1 contain a Clear-Text authentication over network vulnerability in… |
CVE-2018-11338 | High | 7.5 | 2018-07-31 | Intuit Lacerte 2017 for Windows in a client/server environment transfers the entire customer list in cleartext over SMB, which allows attackers to (1) obtain s… |
CVE-2018-8855 | Critical | 9.8 | 2018-07-24 | Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. The devices allow… |
CVE-2016-5649 | Critical | 9.8 | 2018-07-24 | A vulnerability is in the 'BSW_cxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.50_7.0.50, and DGND3700, version DGND3700-V1.0.0.17_1.0.17, wh… |
CVE-2016-5638 | High | 7.5 | 2018-07-24 | There are few web pages associated with the genie app on the Netgear WNDR4500 running firmware version V1.0.1.40_1.0.6877. Genie app adds some capabilities ove… |
CVE-2018-0025 | Medium | 6.1 | 2018-07-11 | When an SRX Series device is configured to use HTTP/HTTPS pass-through authentication services, a client sending authentication credentials in the initial HTTP… |
CVE-2018-8929 | High | 7.3 | 2018-07-06 | Improper restriction of communication channel to intended endpoints vulnerability in HTTP daemon in Synology SSL VPN Client before 1.2.4-0224 allows remote att… |
CVE-2018-4227 | High | 7.5 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. The issue involves the "Mail" component. It a… |
CVE-2018-1454 | Medium | 5.9 | 2018-06-05 | IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable… |
CVE-2017-16041 | Medium | 5.9 | 2018-06-04 | ikst versions before 1.1.2 download resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2017-16040 | High | 8.1 | 2018-06-04 | gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be poss… |
CVE-2017-16035 | High | 8.1 | 2018-06-04 | The hubl-server module is a wrapper for the HubL Development Server. During installation hubl-server downloads a set of dependencies from api.hubapi.com. It ap… |
CVE-2018-1600 | High | 8.6 | 2018-06-04 | IBM BigFix Platform 9.2 and 9.5 transmits sensitive or security-critical data in clear text in a communication channel that can be sniffed by unauthorized acto… |
CVE-2018-11477 | Medium | 6.5 | 2018-05-30 | An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The data packets that are sent between the iOS or Android application and the OBD dongle are… |
CVE-2018-11402 | Medium | 6.6 | 2018-05-24 | SimpliSafe Original has Unencrypted Keypad Transmissions, which allows physically proximate attackers to discover the PIN. |
CVE-2018-11399 | Medium | 4.3 | 2018-05-24 | SimpliSafe Original has Unencrypted Sensor Transmissions, which allows physically proximate attackers to obtain potentially sensitive information about the spe… |
CVE-2017-9637 | Medium | 4.1 | 2018-05-18 | Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases. When connectivity to those databases is configured to us… |
CVE-2018-0283 | Medium | 5.8 | 2018-05-02 | A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to restart an instance of the Snort… |
CVE-2018-0281 | Medium | 5.8 | 2018-05-02 | A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to restart an instance of the Snort… |
CVE-2017-12716 | Medium | 6.5 | 2018-04-25 | Abbott Laboratories Accent and Anthem pacemakers manufactured prior to Aug 28, 2017 transmit unencrypted patient information via RF communications to programme… |
CVE-2018-7246 | Critical | 9.8 | 2018-04-18 | A cleartext transmission of sensitive information vulnerability exists in Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UP… |
CVE-2017-8154 | Medium | 5.3 | 2018-04-11 | The Themes App Honor 8 Lite Huawei mobile phones with software of versions before Prague-L31C576B172, versions before Prague-L31C530B160, versions before Pragu… |
CVE-2017-12310 | High | 7.5 | 2018-03-27 | A vulnerability in the auto discovery phase of Cisco Spark Hybrid Calendar Service could allow an unauthenticated, remote attacker to view sensitive informatio… |
CVE-2017-0925 | High | 7.2 | 2018-03-21 | Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resultin… |
CVE-2018-6295 | Critical | 9.8 | 2018-03-13 | Unencrypted way of remote control and communications in Hanwha Techwin Smartcams |
CVE-2018-5471 | Medium | 5.9 | 2018-03-06 | A Cleartext Transmission of Sensitive Information issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic… |
CVE-2018-6019 | Medium | 5.9 | 2018-03-06 | Samsung Display Solutions App before 3.02 for Android allows man-in-the-middle attackers to spoof B2B content by leveraging failure to use encryption during in… |
CVE-2018-7298 | High | 8.1 | 2018-02-22 | In /usr/local/etc/config/addons/mh/loopupd.sh on eQ-3 AG HomeMatic CCU2 2.29.22 devices, software update packages are downloaded via the HTTP protocol, which d… |
CVE-2018-7259 | Critical | 9.8 | 2018-02-20 | The FSX / P3Dv4 installer 2.0.1.231 for Flight Sim Labs A320-X sends a user's Google account credentials to http://installLog.flightsimlabs.com/LogHandler3.ash… |
CVE-2018-1297 | Critical | 9.8 | 2018-02-13 | When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterE… |