cve.bz

CWE-311: Missing Encryption of Sensitive Data, page 2

Filter

The product does not encrypt sensitive or critical information before storage or transmission.

What the weakness is: CWE-311 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 14
  • CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies Likelihood: High · Severity: High
  • CAPEC-37 Retrieve Embedded Sensitive Data Likelihood: High · Severity: Very High
  • CAPEC-65 Sniff Application Code Likelihood: Low · Severity: High
  • CAPEC-157 Sniffing Attacks Severity: Medium
  • CAPEC-158 Sniffing Network Traffic Severity: Medium
  • CAPEC-204 Lifting Sensitive Data Embedded in Cache Severity: Medium
  • CAPEC-383 Harvesting Information via API Event Monitoring Severity: Low
  • CAPEC-384 Application API Message Manipulation via Man-in-the-Middle Severity: Low
  • CAPEC-385 Transaction or Event Tampering via Application API Manipulation Severity: Medium
  • CAPEC-386 Application API Navigation Remapping Severity: Medium
  • CAPEC-387 Navigation Remapping To Propagate Malicious Content Severity: Medium
  • CAPEC-388 Application API Button Hijacking Severity: Medium
  • CAPEC-477 Signature Spoofing by Mixing Signed and Unsigned Content Likelihood: Low · Severity: High
  • CAPEC-609 Cellular Traffic Intercept Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-311, as MITRE names them. Credits.

Ask an AI about CWE-311

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-311: Missing Encryption of Sensitive Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/311.html and https://cve.bz/cve/cwe/311?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2025-36062EPSS 0.3%

    IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 could be vulnerable to information exposure due to the use of unencrypted network traffic.

  2. 6.5CVE-2025-53678EPSS 0.2%

    Jenkins User1st uTester Plugin 1.1 and earlier stores the uTester JWT token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.

  3. 6.5CVE-2025-53676EPSS 0.2%

    Jenkins Xooa Plugin 0.0.7 and earlier stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.

  4. 6.5CVE-2025-53673EPSS 0.2%

    Jenkins Sensedia Api Platform tools Plugin 1.0 stores the Sensedia API Manager integration token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller …

  5. 6.5CVE-2025-53668EPSS 0.2%

    Jenkins VAddy Plugin 1.2.8 and earlier stores Vaddy API Auth Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file …

  6. 6.5CVE-2025-53666EPSS 0.2%

    Jenkins Dead Man's Snitch Plugin 0.1 stores Dead Man's Snitch tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller fi…

  7. 6.5CVE-2025-53663EPSS 0.2%

    Jenkins IBM Cloud DevOps Plugin 2.0.16 and earlier stores SonarQube authentication tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the …

  8. 6.5CVE-2025-53659EPSS 0.2%

    Jenkins QMetry Test Management Plugin 1.13 and earlier stores Qmetry Automation API Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the J…

  9. 4.3CVE-2025-53653EPSS 0.2%

    Jenkins Aqua Security Scanner Plugin 3.2.8 and earlier stores Scanner Tokens for Aqua API unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the …

  10. 7.5CVE-2014-6274EPSS 0.2%

    git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote used encryption=pubkey or encryption=hybrid, the embedded AWS credentials were stored in the git repository in (effectively) plaintext, not e…

  11. 5.7CVE-2025-32875EPSS 0.2%

    An issue was discovered in the COROS application through 3.8.12 for Android. Bluetooth pairing and bonding is neither initiated nor enforced by the application itself. Also, the watch does not enforce pairing and bonding. As a result, any …

  12. 8.7CVE-2025-24008EPSS 0.3%

    A vulnerability has been identified in SIRIUS 3RK3 Modular Safety System (MSS) (All versions), SIRIUS Safety Relays 3SK2 (All versions). The affected devices do not encrypt data in transit. An attacker with network access could eavesdrop t…

  13. 2.4CVE-2025-47274EPSS 0.1%

    ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Due to the ordering of code used to start an MCP server container, versions of ToolHive prior to 0.0.33 inadvertently store s…

  14. 6.5CVE-2023-37405EPSS 0.2%

    IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, and 2.3.4.1 stores sensitive data in memory, that could be obtained by an unauthorized user.

  15. 8.1CVE-2025-29314EPSS 0.2%

    Insecure Shiro cookie configurations in OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allow attackers to access sensitive information via a man-in-the-middle attack.

  16. 2.0CVE-2025-1243EPSS 0.09%

    The Temporal api-go library prior to version 1.44.1 did not send `update response` information to Data Converter when the proxy package within the api-go module was used in a gRPC proxy prior to transmission. This resulted in information c…

  17. 7.5CVE-2024-38325EPSS 0.3%

    IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI could allow a remote attacker to obtain sensitive information, caused by sending network requests over an insecure channel. An attacker could exploit this vulnerabi…

  18. 5.9CVE-2024-41757EPSS 0.3%

    IBM Concert Software 1.0.0 and 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive i…

  19. 4.6CVE-2024-7142EPSS 0.10%

    On Arista CloudVision Appliance (CVA) affected releases running on appliances that support hardware disk encryption (DCA-350E-CV only), the disk encryption might not be successfully performed. This results in the disks remaining unsecured …

  20. 7.5CVE-2024-56439EPSS 0.1%

    Access control vulnerability in the identity authentication module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

  21. 8.2CVE-2024-47871EPSS 0.2%

    Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves **insecure communication** between the FRP (Fast Reverse Proxy) client and server when Gradio's `share=True` option is used. HTTPS is not e…

  22. 6.5CVE-2024-20515EPSS 0.3%

    A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to a lack of …

  23. 5.3CVE-2023-52950EPSS 0.08%

    Missing encryption of sensitive data vulnerability in login component in Synology Active Backup for Business Agent before 2.7.0-3221 allows adjacent man-in-the-middle attackers to obtain user credential via unspecified vectors.

  24. 5.0CVE-2023-52948EPSS 0.08%

    Missing encryption of sensitive data vulnerability in settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 allows local users to obtain user credential via unspecified vectors.

  25. 7.1CVE-2024-42495EPSS 0.3%

    Credentials to access device configuration were transmitted using an unencrypted protocol. These credentials would allow read-only access to network configuration information and terminal configuration data.

  26. 5.5CVE-2024-20503EPSS 0.1%

    A vulnerability in Cisco Duo Epic for Hyperdrive could allow an authenticated, local attacker to view sensitive information in cleartext on an affected system. This vulnerability is due to improper storage of an unencrypted registry key…

  27. 7.5CVE-2024-42657EPSS 0.5%

    An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the lack of encryption during login process

  28. 5.3CVE-2024-40620EPSS 0.2%

    CVE-2024-40620 IMPACT A vulnerability exists in the affected product due to lack of encryption of sensitive information. The vulnerability results in data being sent between the Console and the Dashboard without encryption, which can be s…

  29. 7.1CVE-2024-7396EPSS 0.3%

    Missing encryption of sensitive data in Korenix JetPort 5601v3 allows Eavesdropping.This issue affects JetPort 5601v3: through 1.2.

  30. 7.5CVE-2024-23444EPSS 0.2%

    It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypte…

  31. 6.3CVE-2024-41124EPSS 0.3%

    Puncia is the Official CLI utility for Subdomain Center & Exploit Observer. `API_URLS` is utilizing HTTP instead of HTTPS for communication that can lead to issues like Eavesdropping, Data Tampering, Unauthorized Data Access & MITM Attacks…

  32. 5.7CVE-2024-38302EPSS 0.10%

    Dell Data Lakehouse, version(s) 1.0.0.0, contain(s) a Missing Encryption of Sensitive Data vulnerability in the DDAE (Starburst). A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading …

  33. 6.8CVE-2024-5731EPSS 0.3%

    A vulnerability in the IPS Manager, Central Manager, and Local Manager communication workflow allows an attacker to control the destination of a request by manipulating the parameter, thereby leveraging sensitive information.

  34. 5.1CVE-2024-38283EPSS 0.10%

    Sensitive customer information is stored in the device without encryption.

  35. 5.3CVE-2023-49927EPSS 0.1%

    An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 9110, Exynos W920, Exynos Modem 512…

  36. 7.3CVE-2024-35061EPSS 0.6%

    NASA AIT-Core v2.5.2 was discovered to use unencrypted channels to exchange data over the network, allowing attackers to execute a man-in-the-middle attack. When chained with CVE-2024-35059, the CVE in subject leads to an unauthenticated, …

  37. 5.7CVE-2024-27106EPSS 0.2%

    Vulnerable data in transit in GE HealthCare EchoPAC products

  38. 5.5CVE-2024-25027EPSS 0.1%

    IBM Security Verify Access 10.0.6 could disclose sensitive snapshot information due to missing encryption. IBM X-Force ID: 281607.

  39. 5.9CVE-2023-35888EPSS 0.3%

    IBM Security Verify Governance 10.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive …

  40. 6.1CVE-2024-28250EPSS 0.2%

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.8 and 1.15.2, In Cilium clusters with WireGuard enabled and traffic matching Layer 7 policies …

  41. 6.1CVE-2024-28249EPSS 0.3%

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, IPsec-eligible traffic b…

  42. 9.1CVE-2024-29151EPSS 0.3%

    Rocket.Chat.Audit through 5ad78e8 depends on filecachetools, which does not exist in PyPI.

  43. 5.9CVE-2021-39090EPSS 0.4%

    IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerabilit…

  44. 5.3CVE-2024-25631EPSS 0.2%

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who have enabled an external kvstore and Wireguard transparent encryption, traffic between pods in the affected cluster is not encr…

  45. 5.3CVE-2024-25630EPSS 0.2%

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cilium state (the default configuration) and Wireguard transparent encryption, traffic to/from the Ingr…

  46. 7.5CVE-2024-24768EPSS 0.3%

    1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This…

  47. 6.5CVE-2023-50129EPSS 0.1%

    Missing encryption in the NFC tags of the Flient Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity to the original tags, which results in an attacker gaining access to the perimeter.

  48. 6.5CVE-2023-50126EPSS 0.10%

    Missing encryption in the RFID tags of the Hozard alarm system (Alarmsysteem) v1.0 allow attackers to create a cloned tag via brief physical proximity to one of the original tags, which results in an attacker being able to bring the alarm …

  49. 5.5CVE-2023-38267EPSS 0.1%

    IBM Security Access Manager Appliance (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could allow a local user to possibly elevate their privileges due to sensitive configurat…

  50. 9.8CVE-2023-6339EPSS 0.2%

    Google Nest WiFi Pro root code-execution & user-data compromise