CWE-319 · Cleartext Transmission of Sensitive Information (page 9)
Page 9 of 10 — CVEs classified under CWE-319, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10732 | Medium | 4.3 | 2019-04-07 | In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part… |
CVE-2019-10240 | High | 8.1 | 2019-04-03 | Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts c… |
CVE-2019-1010260 | High | 8.1 | 2019-04-02 | Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exp… |
CVE-2019-10251 | Medium | 5.9 | 2019-03-28 | The UCWeb UC Browser application through 2019-03-26 for Android uses HTTP to download certain modules associated with PDF and Microsoft Office files (related t… |
CVE-2019-10250 | Medium | 5.9 | 2019-03-28 | UCWeb UC Browser 7.0.185.1002 on Windows uses HTTP for downloading certain PDF modules, which allows MITM attacks. |
CVE-2019-9860 | High | 7.5 | 2019-03-27 | Due to unencrypted signal communication and predictability of rolling codes, an attacker can "desynchronize" an ABUS Secvest wireless remote control (FUBE50014… |
CVE-2019-6540 | Medium | 6.5 | 2019-03-26 | The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer… |
CVE-2019-4063 | Medium | 5.9 | 2019-03-05 | IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 Standard Edition could allow highly sensitive information to be transmitted in plain text. An attacker coul… |
CVE-2019-8345 | Medium | 4.2 | 2019-02-15 | The Help feature in the ES File Explorer File Manager application 4.1.9.7.4 for Android allows session hijacking by a Man-in-the-middle attacker on the local n… |
CVE-2019-7675 | High | 7.5 | 2019-02-09 | An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. The default management application is delivered over cleartext HTTP with Basic Authentication, as… |
CVE-2018-18908 | Medium | 5.9 | 2019-01-20 | The Sky Go Desktop application 1.0.19-1 through 1.0.23-1 for Windows performs several requests over cleartext HTTP. This makes the data submitted in these requ… |
CVE-2019-5489 | Medium | 5.5 | 2019-01-07 | The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe page cache access patterns of other process… |
CVE-2018-17195 | High | 7.5 | 2018-12-19 | The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle (MiTM) attack, resultin… |
CVE-2018-1525 | Medium | 5.9 | 2018-12-06 | IBM i2 Enterprise Insight Analysis 2.1.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Tr… |
CVE-2018-7960 | High | 7.4 | 2018-11-27 | There is a SRTP icon display vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack to intercept the pac… |
CVE-2018-19111 | Medium | 5.3 | 2018-11-08 | The Google Cardboard application 1.8 for Android and 1.2 for iOS sends potentially private cleartext information to the Unity 3D Stats web site, as demonstrate… |
CVE-2018-12674 | Medium | 5.7 | 2018-10-19 | The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) stores the username and password within the cookies of a sessio… |
CVE-2018-18071 | High | 7.5 | 2018-10-09 | An issue was discovered in the Daimler Mercedes-Benz Me app 2.11.0-846 for iOS. The encrypted Connected Vehicle API data exchange between the app and a server… |
CVE-2018-5402 | Critical | 9.1 | 2018-10-08 | The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App use an embedded webserver that uses unencrypted plaintext for the transmission of the ad… |
CVE-2018-5401 | Critical | 9.1 | 2018-10-08 | The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App transmit sensitive or security-critical data in cleartext in a communication channel tha… |
CVE-2018-15752 | High | 8.1 | 2018-10-02 | An issue was discovered in the MensaMax (aka com.breustedt.mensamax) application 4.3 for Android. Cleartext Transmission of Sensitive Information allows man-in… |
CVE-2018-8842 | High | 8.8 | 2018-09-26 | Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software transmits sensitive or security-critical data in cleartext in a communication c… |
CVE-2018-13140 | High | 8.1 | 2018-09-24 | Druide Antidote through 9.5.1 on Windows and Linux allows remote code execution through the update mechanism by leveraging use of HTTP to download installation… |
CVE-2018-16225 | Medium | 6.5 | 2018-09-18 | The QBee MultiSensor Camera through 4.16.4 accepts unencrypted network traffic from clients (such as the QBee Cam application through 1.0.5 for Android and the… |
CVE-2018-14627 | Medium | 5.3 | 2018-09-04 | The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is required. Servers before this version that are… |
CVE-2018-12710 | High | 8.0 | 2018-08-29 | An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account (which is a low privilege account) access… |
CVE-2018-11749 | Critical | 9.8 | 2018-08-24 | When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. This affects Puppet… |
CVE-2018-10634 | Medium | 4.8 | 2018-08-13 | Communications between Medtronic MiniMed MMT pumps and wireless accessories are transmitted in cleartext. A sufficiently skilled attacker could capture these t… |
CVE-2018-11050 | High | 8.8 | 2018-08-01 | Dell EMC NetWorker versions between 9.0 and 9.1.1.8 through 9.2.1.3, and the version 18.1.0.1 contain a Clear-Text authentication over network vulnerability in… |
CVE-2018-11338 | High | 7.5 | 2018-07-31 | Intuit Lacerte 2017 for Windows in a client/server environment transfers the entire customer list in cleartext over SMB, which allows attackers to (1) obtain s… |
CVE-2018-8855 | Critical | 9.8 | 2018-07-24 | Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. The devices allow… |
CVE-2016-5649 | Critical | 9.8 | 2018-07-24 | A vulnerability is in the 'BSW_cxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.50_7.0.50, and DGND3700, version DGND3700-V1.0.0.17_1.0.17, wh… |
CVE-2016-5638 | High | 7.5 | 2018-07-24 | There are few web pages associated with the genie app on the Netgear WNDR4500 running firmware version V1.0.1.40_1.0.6877. Genie app adds some capabilities ove… |
CVE-2018-0025 | Medium | 6.1 | 2018-07-11 | When an SRX Series device is configured to use HTTP/HTTPS pass-through authentication services, a client sending authentication credentials in the initial HTTP… |
CVE-2018-8929 | High | 7.3 | 2018-07-06 | Improper restriction of communication channel to intended endpoints vulnerability in HTTP daemon in Synology SSL VPN Client before 1.2.4-0224 allows remote att… |
CVE-2018-4227 | High | 7.5 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. The issue involves the "Mail" component. It a… |
CVE-2018-1454 | Medium | 5.9 | 2018-06-05 | IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable… |
CVE-2017-16041 | Medium | 5.9 | 2018-06-04 | ikst versions before 1.1.2 download resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2017-16040 | High | 8.1 | 2018-06-04 | gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be poss… |
CVE-2017-16035 | High | 8.1 | 2018-06-04 | The hubl-server module is a wrapper for the HubL Development Server. During installation hubl-server downloads a set of dependencies from api.hubapi.com. It ap… |
CVE-2018-1600 | High | 8.6 | 2018-06-04 | IBM BigFix Platform 9.2 and 9.5 transmits sensitive or security-critical data in clear text in a communication channel that can be sniffed by unauthorized acto… |
CVE-2018-11477 | Medium | 6.5 | 2018-05-30 | An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The data packets that are sent between the iOS or Android application and the OBD dongle are… |
CVE-2018-11402 | Medium | 6.6 | 2018-05-24 | SimpliSafe Original has Unencrypted Keypad Transmissions, which allows physically proximate attackers to discover the PIN. |
CVE-2018-11399 | Medium | 4.3 | 2018-05-24 | SimpliSafe Original has Unencrypted Sensor Transmissions, which allows physically proximate attackers to obtain potentially sensitive information about the spe… |
CVE-2017-9637 | Medium | 4.1 | 2018-05-18 | Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases. When connectivity to those databases is configured to us… |
CVE-2018-0283 | Medium | 5.8 | 2018-05-02 | A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to restart an instance of the Snort… |
CVE-2018-0281 | Medium | 5.8 | 2018-05-02 | A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to restart an instance of the Snort… |
CVE-2017-12716 | Medium | 6.5 | 2018-04-25 | Abbott Laboratories Accent and Anthem pacemakers manufactured prior to Aug 28, 2017 transmit unencrypted patient information via RF communications to programme… |
CVE-2018-7246 | Critical | 9.8 | 2018-04-18 | A cleartext transmission of sensitive information vulnerability exists in Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UP… |
CVE-2017-8154 | Medium | 5.3 | 2018-04-11 | The Themes App Honor 8 Lite Huawei mobile phones with software of versions before Prague-L31C576B172, versions before Prague-L31C530B160, versions before Pragu… |
CVE-2017-12310 | High | 7.5 | 2018-03-27 | A vulnerability in the auto discovery phase of Cisco Spark Hybrid Calendar Service could allow an unauthenticated, remote attacker to view sensitive informatio… |
CVE-2017-0925 | High | 7.2 | 2018-03-21 | Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resultin… |
CVE-2018-6295 | Critical | 9.8 | 2018-03-13 | Unencrypted way of remote control and communications in Hanwha Techwin Smartcams |
CVE-2018-5471 | Medium | 5.9 | 2018-03-06 | A Cleartext Transmission of Sensitive Information issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic… |
CVE-2018-6019 | Medium | 5.9 | 2018-03-06 | Samsung Display Solutions App before 3.02 for Android allows man-in-the-middle attackers to spoof B2B content by leveraging failure to use encryption during in… |
CVE-2018-7298 | High | 8.1 | 2018-02-22 | In /usr/local/etc/config/addons/mh/loopupd.sh on eQ-3 AG HomeMatic CCU2 2.29.22 devices, software update packages are downloaded via the HTTP protocol, which d… |
CVE-2018-7259 | Critical | 9.8 | 2018-02-20 | The FSX / P3Dv4 installer 2.0.1.231 for Flight Sim Labs A320-X sends a user's Google account credentials to http://installLog.flightsimlabs.com/LogHandler3.ash… |
CVE-2018-1297 | Critical | 9.8 | 2018-02-13 | When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterE… |
CVE-2018-6018 | Critical | 9.1 | 2018-01-24 | Fixed sizes of HTTPS responses in Tinder iOS app and Tinder Android app allow an attacker to extract private sensitive information by sniffing network traffic. |
CVE-2018-6017 | Critical | 9.1 | 2018-01-24 | Unencrypted transmission of images in Tinder iOS app and Tinder Android app allows an attacker to extract private sensitive information by sniffing network tra… |
CVE-2017-17844 | Medium | 6.5 | 2017-12-27 | An issue was discovered in Enigmail before 1.9.9. A remote attacker can obtain cleartext content by sending an encrypted data block (that the attacker cannot d… |
CVE-2017-5259 | High | 8.8 | 2017-12-20 | In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path… |
CVE-2017-1694 | High | 8.1 | 2017-12-20 | IBM Integration Bus 9.0 and 10.0 transmits user credentials in plain in clear text which can be read by an attacker using man in the middle techniques. IBM X-F… |
CVE-2017-14486 | High | 7.5 | 2017-12-01 | The Vibease Wireless Remote Vibrator app for Android and the Vibease Chat app for iOS use cleartext to exchange messages with other apps and the PLAIN SASL mec… |
CVE-2017-15999 | Critical | 9.8 | 2017-10-29 | In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced user data. When logging in, the username… |
CVE-2017-1232 | Medium | 5.9 | 2017-10-26 | IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) transmits sensitive or security-critical data in cleartext in a communication channel that can be… |
CVE-2017-7147 | Medium | 5.3 | 2017-10-23 | An issue was discovered in certain Apple products. The Apple Support app before 1.2 for iOS is affected. The issue involves the "Analytics" component. It allow… |
CVE-2017-7143 | Medium | 5.5 | 2017-10-23 | An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the "Captive Network Assistant" component. It allows remo… |
CVE-2017-7133 | High | 7.5 | 2017-10-23 | An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "MobileBackup" component. It allows remote attackers to ob… |
CVE-2017-7078 | Medium | 5.3 | 2017-10-23 | An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. The issue involves the "Mail Drafts" component. I… |
CVE-2017-14009 | Medium | 6.5 | 2017-10-17 | An Information Exposure issue was discovered in ProMinent MultiFLEX M10a Controller web interface. When an authenticated user uses the Change Password feature… |
CVE-2017-15290 | High | 7.5 | 2017-10-12 | Mirasys Video Management System (VMS) 6.x before 6.4.6, 7.x before 7.5.15, and 8.x before 8.1.1 has a login process in which cleartext data is sent from a serv… |
CVE-2017-15042 | Medium | 5.9 | 2017-10-05 | An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on… |
CVE-2017-8444 | Medium | 5.9 | 2017-09-29 | The client-forwarder in Elastic Cloud Enterprise versions prior to 1.0.2 do not properly encrypt traffic to ZooKeeper. If an attacker is able to man in the mid… |
CVE-2017-6665 | Medium | 6.5 | 2017-08-07 | A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to reset… |
CVE-2017-1181 | High | 7.0 | 2017-07-17 | IBM Tivoli Monitoring Portal V6 client could allow a local attacker to gain elevated privileges for IBM Tivoli Monitoring, caused by the default console connec… |
CVE-2017-1000024 | High | 7.5 | 2017-07-17 | Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential passwo… |
CVE-2017-5652 | High | 7.5 | 2017-07-10 | During a routine security analysis, it was found that one of the ports in Apache Impala (incubating) 2.7.0 to 2.8.0 sent data in plaintext even when the cluste… |
CVE-2017-9035 | High | 7.4 | 2017-05-26 | Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to eavesdrop and tamper with updates by leveraging unencrypted communications with upda… |
CVE-2017-8851 | Medium | 5.9 | 2017-05-11 | An issue was discovered on OnePlus One and X devices. Due to a lenient updater-script on the OnePlus One and X OTA images, the fact that both products use the… |
CVE-2017-8850 | Medium | 5.9 | 2017-05-11 | An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. Due to a lenient updater-script in the OnePlus OTA images, and the fact that both ROMs use the… |
CVE-2017-3305 | Medium | 5.3 | 2017-04-24 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: C API). Supported versions that are affected are 5.5.55 and earlier and 5.6… |
CVE-2017-2412 | Medium | 5.9 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "iTunes Store" component. It allows man-in-the-middle at… |
CVE-2017-3815 | Medium | 5.3 | 2017-03-17 | An API Privilege vulnerability in Cisco TelePresence Server Software could allow an unauthenticated, remote attacker to emulate Cisco TelePresence Server endpo… |
CVE-2017-6370 | Medium | 5.3 | 2017-03-17 | TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartex… |
CVE-2017-6432 | High | 8.1 | 2017-03-09 | An issue was discovered on Dahua DHI-HCVR7216A-S3 3.210.0001.10 build 2016-06-06 devices. The Dahua DVR Protocol, which operates on TCP Port 37777, is an unenc… |
CVE-2017-6410 | Medium | 5.5 | 2017-03-02 | kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Aut… |
CVE-2017-6341 | Medium | 5.9 | 2017-02-27 | Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19… |
CVE-2015-0987 | Critical | 10.0 | 2015-10-06 | Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 rely on cleartext password transmission, which allows remot… |
CVE-2011-3022 | | 2012-02-16 | translate/translate_manager.cc in Google Chrome before 17.0.963.56 and 19.x before 19.0.1036.7 uses an HTTP session to exchange data for translation, which all… | |
CVE-2008-4122 | High | 7.5 | 2008-12-19 | Joomla! 1.5.8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by int… |
CVE-2008-4390 | High | 7.5 | 2008-12-09 | The Cisco Linksys WVC54GC wireless video camera before firmware 1.25 sends cleartext configuration data in response to a Setup Wizard remote-management command… |
CVE-2008-3289 | High | 7.5 | 2008-07-24 | EMC Dantz Retrospect Backup Client 7.5.116 sends the password hash in cleartext at an unspecified point, which allows remote attackers to obtain sensitive info… |
CVE-2008-0374 | High | 7.5 | 2008-01-22 | OKI C5510MFP Printer CU H2.15, PU 01.03.01, System F/W 1.01, and Web Page 1.00 sends the configuration of the printer in cleartext, which allows remote attacke… |
CVE-2007-5626 | Medium | 5.5 | 2007-10-23 | make_catalog_backup in Bacula 2.2.5, and probably earlier, sends a MySQL password as a command line argument, and sometimes transmits cleartext e-mail containi… |
CVE-2007-4786 | Medium | 5.3 | 2007-09-10 | Cisco Adaptive Security Appliance (ASA) running PIX 7.0 before 7.0.7.1, 7.1 before 7.1.2.61, 7.2 before 7.2.2.34, and 8.0 before 8.0.2.11, when AAA is enabled… |
CVE-2005-3140 | High | 7.5 | 2005-10-05 | Procom NetFORCE 800 4.02 M10 Build 20 and possibly other versions sends the NIS password map (passwd.nis) as a file attachment in diagnostic e-mail messages, w… |
CVE-2005-2069 | | 2005-06-30 | pam_ldap and nss_ldap, when used with OpenLDAP and connecting to a slave using TLS, does not use TLS for the subsequent connection if the client is referred to… | |
CVE-2004-1852 | | 2004-03-23 | DameWare Mini Remote Control 3.x before 3.74 and 4.x before 4.2 transmits the Blowfish encryption key in plaintext, which allows remote attackers to gain sensi… | |
CVE-2002-1949 | High | 7.5 | 2002-12-31 | The Network Attached Storage (NAS) Administration Web Page for Iomega NAS A300U transmits passwords in cleartext, which allows remote attackers to sniff the ad… |