cve.bz

CWE-311: Missing Encryption of Sensitive Data, page 11

Filter

The product does not encrypt sensitive or critical information before storage or transmission.

What the weakness is: CWE-311 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 14
  • CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies Likelihood: High · Severity: High
  • CAPEC-37 Retrieve Embedded Sensitive Data Likelihood: High · Severity: Very High
  • CAPEC-65 Sniff Application Code Likelihood: Low · Severity: High
  • CAPEC-157 Sniffing Attacks Severity: Medium
  • CAPEC-158 Sniffing Network Traffic Severity: Medium
  • CAPEC-204 Lifting Sensitive Data Embedded in Cache Severity: Medium
  • CAPEC-383 Harvesting Information via API Event Monitoring Severity: Low
  • CAPEC-384 Application API Message Manipulation via Man-in-the-Middle Severity: Low
  • CAPEC-385 Transaction or Event Tampering via Application API Manipulation Severity: Medium
  • CAPEC-386 Application API Navigation Remapping Severity: Medium
  • CAPEC-387 Navigation Remapping To Propagate Malicious Content Severity: Medium
  • CAPEC-388 Application API Button Hijacking Severity: Medium
  • CAPEC-477 Signature Spoofing by Mixing Signed and Unsigned Content Likelihood: Low · Severity: High
  • CAPEC-609 Cellular Traffic Intercept Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-311, as MITRE names them. Credits.

Ask an AI about CWE-311

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-311: Missing Encryption of Sensitive Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/311.html and https://cve.bz/cve/cwe/311?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2018-7498EPSS 0.6%

    In Philips Alice 6 System version R8.0.2 or prior, the lack of proper data encryption passes up the guarantees of confidentiality, integrity, and accountability that properly implemented encryption conveys.

  2. 8.1CVE-2017-5251EPSS 0.5%

    In version 1012 and prior of Insteon's Insteon Hub, the radio transmissions used for communication between the hub and connected devices are not encrypted.

  3. 7.4CVE-2017-15397EPSS 0.4%

    Inappropriate implementation in ChromeVox in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker in a privileged network position to observe or tamper with certain cleartext HTTP requests by leveraging that position.

  4. 8.1CVE-2018-5261EPSS 0.5%

    An issue was discovered in Flexense DiskBoss 8.8.16 and earlier. Due to the usage of plaintext information from the handshake as input for the encryption key used for the encryption of the rest of the session, the server and client disclos…

  5. 7.5CVE-2017-17763EPSS 1.1%

    SuperBeam through 4.1.3, when using the LAN or WiFi Direct Share feature, does not use HTTPS or any integrity-protection mechanism for file transfer, which makes it easier for remote attackers to send crafted files, as demonstrated by APK …

  6. 6.5CVE-2017-14953EPSS 0.5%

    HikVision Wi-Fi IP cameras, when used in a wired configuration, allow physically proximate attackers to trigger association with an arbitrary access point by leveraging a default SSID with no WiFi encryption or authentication. NOTE: Vendor…

  7. 4.3CVE-2017-8168EPSS 0.3%

    FusionSphere OpenStack with software V100R006C00SPC102(NFV) and V100R006C10 have an information leak vulnerability. Due to an incorrect configuration item, the information transmitted by a transmission channel is not encrypted. An attacker…

  8. 7.5CVE-2017-15581EPSS 0.9%

    In the "Diary with lock" (aka WriteDiary) application 4.72 for Android, neither HTTPS nor other encryption is used for transmitting data, despite the documentation that the product is intended for "a personal journal of ... secrets and fee…

  9. 7.5CVE-2017-15609EPSS 0.8%

    Octopus before 3.17.7 allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets.

  10. 7.5CVE-2017-12817EPSS 0.9%

    In Kaspersky Internet Security for Android 11.12.4.1622, some of the application trace files were not encrypted.

  11. 9.8CVE-2017-9632EPSS 0.5%

    A Missing Encryption of Sensitive Data issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWash M5, all versions, LaserWash 360 and 360 Plus, all versions, LaserWash AutoXpress and AutoExpress Plus, al…

  12. 9.8CVE-2017-9854EPSS 1.1%

    An issue was discovered in SMA Solar Technology products. By sniffing for specific packets on the localhost, plaintext passwords can be obtained as they are typed into Sunny Explorer by the user. These passwords can then be used to comprom…

  13. 7.5CVE-2017-7729EPSS 0.7%

    On iSmartAlarm cube devices, there is Incorrect Access Control because a "new key" is transmitted in cleartext.

  14. 9.8CVE-2017-7406EPSS 0.7%

    The D-Link DIR-615 device before v20.12PTb04 doesn't use SSL for any of the authenticated pages. Also, it doesn't allow the user to generate his own SSL Certificate. An attacker can simply monitor network traffic to steal a user's credenti…

  15. 8.8CVE-2017-3219EPSS 0.5%

    Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provided MD5 hash.

  16. 8.8CVE-2017-3218EPSS 0.3%

    Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician uses HTTP for software updates.

  17. 7.5CVE-2017-9604EPSS 1.3%

    KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature, which allows remote attackers to obtain s…

  18. 5.9CVE-2017-9045EPSS 0.3%

    The Google I/O 2017 application before 5.1.4 for Android downloads multiple .json files from http://storage.googleapis.com without SSL, which makes it easier for man-in-the-middle attackers to spoof Feed and Schedule data by creating a mod…

  19. 4.6CVE-2017-8769EPSS 0.2%

    Facebook WhatsApp Messenger before 2.16.323 for Android uses the SD card for cleartext storage of files (Audio, Documents, Images, Video, and Voice Notes) associated with a chat, even after that chat is deleted. There may be users who expe…

  20. 5.9CVE-2017-7485EPSS 2.0%

    In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-…

  21. 7.5CVE-2017-8221ExploitEPSS 2.7%

    Wireless IP Camera (P2P) WIFICAM devices rely on a cleartext UDP tunnel protocol (aka the Cloud feature) for communication between an Android application and a camera device, which allows remote attackers to obtain sensitive information by…

  22. 5.7CVE-2017-5042EPSS 0.4%

    Cast in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android sent cookies to sites discovered via SSDP, which allowed an attacker on the local network segment to initiate connections to arbitrary UR…

  23. 8.1CVE-2017-6445EPSS 1.0%

    The auto-update feature of Open Embedded Linux Entertainment Center (OpenELEC) 6.0.3, 7.0.1, and 8.0.4 uses neither encrypted connections nor signed updates. A man-in-the-middle attacker could manipulate the update packages to gain root ac…

  24. 5.9CVE-2017-6297EPSS 0.7%

    The L2TP Client in MikroTik RouterOS versions 6.38.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-middle attackers to view transmitted data unencrypted and gain access to networks on the L2TP server b…

  25. –CVE-2014-2379EPSS 0.3%

    Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not use encryption, which allows remote attackers to interfere with traffic control by replaying transmissions on a wireless network.

  26. –CVE-2012-1977EPSS 0.8%

    WellinTech KingSCADA 3.0 uses a cleartext base64 format for storage of passwords in user.db, which allows context-dependent attackers to obtain sensitive information by reading this file.

  27. 7.5CVE-2007-4961EPSS 1.3%

    The login_to_simulator method in Linden Lab Second Life, as used by the secondlife:// protocol handler and possibly other Second Life login mechanisms, sends an MD5 hash in cleartext in the passwd field, which allows remote attackers to lo…