cve.bz

CWE-311: Missing Encryption of Sensitive Data, page 6

Filter

The product does not encrypt sensitive or critical information before storage or transmission.

What the weakness is: CWE-311 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 14
  • CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies Likelihood: High · Severity: High
  • CAPEC-37 Retrieve Embedded Sensitive Data Likelihood: High · Severity: Very High
  • CAPEC-65 Sniff Application Code Likelihood: Low · Severity: High
  • CAPEC-157 Sniffing Attacks Severity: Medium
  • CAPEC-158 Sniffing Network Traffic Severity: Medium
  • CAPEC-204 Lifting Sensitive Data Embedded in Cache Severity: Medium
  • CAPEC-383 Harvesting Information via API Event Monitoring Severity: Low
  • CAPEC-384 Application API Message Manipulation via Man-in-the-Middle Severity: Low
  • CAPEC-385 Transaction or Event Tampering via Application API Manipulation Severity: Medium
  • CAPEC-386 Application API Navigation Remapping Severity: Medium
  • CAPEC-387 Navigation Remapping To Propagate Malicious Content Severity: Medium
  • CAPEC-388 Application API Button Hijacking Severity: Medium
  • CAPEC-477 Signature Spoofing by Mixing Signed and Unsigned Content Likelihood: Low · Severity: High
  • CAPEC-609 Cellular Traffic Intercept Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-311, as MITRE names them. Credits.

Ask an AI about CWE-311

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-311: Missing Encryption of Sensitive Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/311.html and https://cve.bz/cve/cwe/311?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.5CVE-2012-5474EPSS 0.3%

    The file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release (python-django-horizon package before 2012.1.1) is world readable and exposes the secret key value.

  2. 7.5CVE-2019-19739EPSS 0.7%

    MFScripts YetiShare 3.5.2 through 4.5.3 does not set the Secure flag on session cookies, allowing the cookie to be sent over cleartext channels.

  3. 9.8CVE-2019-3431EPSS 0.4%

    All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have encryption problems vulnerability. Attackers could sniff unencrypted account and password through the network for front-end system access.

  4. 5.9CVE-2019-18833EPSS 0.4%

    Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information exposure (issue 2 of 2).. The encryption key of the media content which is shared between a ClickShare Button and a ClickShare Base Unit is randomly generated for e…

  5. 4.4CVE-2019-2231EPSS 0.10%

    In Blob::Blob of blob.cpp, there is a possible unencrypted master key due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitatio…

  6. 5.3CVE-2019-19464EPSS 0.5%

    The CBC Gem application before 9.24.1 for Android and before 9.26.0 for iOS has Unencrypted Analytics.

  7. 7.3CVE-2011-3355EPSS 0.8%

    evolution-data-server3 3.0.3 through 3.2.1 used insecure (non-SSL) connection when attempting to store sent email messages into the Sent folder, when the Sent folder was located on the remote server. An attacker could use this flaw to obta…

  8. 3.7CVE-2019-4214EPSS 0.5%

    IBM SmartCloud Analytics 1.3.1 through 1.3.5 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 159…

  9. 5.5CVE-2019-15704EPSS 0.2%

    A clear text storage of sensitive information vulnerability in FortiClient for Mac may allow a local attacker to read sensitive information logged in the console window when the user connects to an SSL VPN Gateway.

  10. 7.5CVE-2019-18980EPSS 0.4%

    On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. Anyone can turn the bulb on or off, or change its color or brightness remotely. There is …

  11. 6.5CVE-2010-3299EPSS 1.1%

    The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks.

  12. 5.5CVE-2010-3292EPSS 0.2%

    The update{_bad,}_phishing_sites scripts in mailscanner 4.79.11-2 downloads files and trusts them without using encryption (e.g., https) or digital signature checking which could allow an attacker to replace certain configuration files (e.…

  13. 5.5CVE-2019-16210EPSS 0.2%

    Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save.

  14. 5.5CVE-2019-16206EPSS 0.2%

    The authentication mechanism, in Brocade SANnav versions before v2.0, logs plaintext account credentials at the ‘trace’ and the 'debug' logging level; which could allow a local authenticated attacker to access sensitive information.

  15. 8.8CVE-2019-18800EPSS 1.7%

    Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber account, because not all Viber protocol traffic is encrypted. TCP data packet 9 on port 4244 from the victim's device contains…

  16. 7.5CVE-2019-10084EPSS 1.0%

    In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries via a specially-constructed request and thereby potentially bypass authorization…

  17. 6.5CVE-2019-11664EPSS 0.5%

    Clear text password in browser in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow sensitive data exposure.

  18. 6.5CVE-2019-11663EPSS 0.5%

    Clear text credentials are used to access managers app in Tomcat in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to al…

  19. 3.7CVE-2019-4171EPSS 0.6%

    IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-F…

  20. 5.3CVE-2019-9681EPSS 0.8%

    Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing firmware packages by specific means. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X…

  21. 2.7CVE-2019-13922EPSS 0.6%

    A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). An attacker with administrative privileges can obtain the hash of a connected device's password. The security vulnerability could be exploited b…

  22. 7.5CVE-2019-13419EPSS 0.9%

    Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked.

  23. 7.5CVE-2019-13418EPSS 0.9%

    Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized.

  24. 8.1CVE-2019-5448EPSS 0.7%

    Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.

  25. 9.8CVE-2019-12924EPSS 0.9%

    MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploited by an unauthenticated user. It was possible for an attacker to use a vulnerability in the configuration of the XML pr…

  26. 8.1CVE-2019-10103EPSS 0.8%

    JetBrains IntelliJ IDEA projects created using the Kotlin (JS Client/JVM Server) IDE Template were resolving Gradle artifacts using an http connection, potentially allowing an MITM attack. This issue, which was fixed in Kotlin plugin versi…

  27. 7.5CVE-2019-6169EPSS 0.8%

    A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow unencrypted downloads over FTP.

  28. 2.4CVE-2019-0307ExploitEPSS 2.1%

    Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP Secure Storage file which is not encrypted by default. By decoding these credentials…

  29. 9.8CVE-2018-10698EPSS 2.3%

    An issue was discovered on Moxa AWK-3121 1.14 devices. The device enables an unencrypted TELNET service by default. This allows an attacker who has been able to gain an MITM position to easily sniff the traffic between the device and the u…

  30. 8.1CVE-2018-10694EPSS 0.8%

    An issue was discovered on Moxa AWK-3121 1.14 devices. The device provides a Wi-Fi connection that is open and does not use any encryption mechanism by default. An administrator who uses the open wireless connection to set up the device ca…

  31. 8.1CVE-2018-10690EPSS 1.5%

    An issue was discovered on Moxa AWK-3121 1.14 devices. The device by default allows HTTP traffic thus providing an insecure communication mechanism for a user connecting to the web server. This allows an attacker to sniff the traffic easil…

  32. 9.8CVE-2019-11523EPSS 1.2%

    Anviz Global M3 Outdoor RFID Access Control executes any command received from any source. No authentication/encryption is done. Attackers can fully interact with the device: for example, send the "open door" command, download the users li…

  33. 7.8CVE-2019-7311EPSS 0.2%

    An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. A lack of encryption in how the user login cookie (admin-auth) is stored on a victim's computer results in the admin password being discoverable by a local attacker, and u…

  34. 9.8CVE-2019-11367EPSS 2.8%

    An issue was discovered in AUO Solar Data Recorder before 1.3.0. The web portal uses HTTP Basic Authentication and provides the account and password in the WWW-Authenticate attribute. By using this account and password, anyone can login su…

  35. 8.6CVE-2017-14852EPSS 1.0%

    An insecure communication was found between a user and the Orpak SiteOmat management console for all known versions, due to an invalid SSL certificate. The attack allows for an eavesdropper to capture the communication and decrypt the data.

  36. 7.8CVE-2019-10139EPSS 0.2%

    During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var` which contains the admin and the appliance passwords as plain-text. At the of th…

  37. 4.6CVE-2019-11836EPSS 0.3%

    The Rediffmail (aka com.rediff.mail.and) application 2.2.6 for Android has cleartext mail content in file storage, persisting after a logout.

  38. 9.8CVE-2018-13992EPSS 1.1%

    The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 allows for plaintext transmission (HTTP) of user credentials by default.

  39. 5.3CVE-2019-1692EPSS 1.2%

    A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) Software could allow an unauthenticated, remote attacker to access sensitive system usage information. The vulnerability is …

  40. 4.6CVE-2019-1589EPSS 0.1%

    A vulnerability in the Trusted Platform Module (TPM) functionality of software for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an unauthenticated, local attacker with physical access…

  41. 7.4CVE-2019-11405EPSS 1.2%

    OpenAPI Tools OpenAPI Generator before 4.0.0-20190419.052012-560 uses http:// URLs in various build.gradle, build.gradle.mustache, and build.sbt files, which may have caused insecurely resolved dependencies.

  42. 5.9CVE-2019-11404EPSS 1.1%

    arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by an MITM attack.

  43. 4.9CVE-2018-17287EPSS 0.4%

    In Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as passwords, are obfuscated in the front-end, but the cleartext value can be exfiltrated by using the back-end "download" feature, as demonstrated by a…

  44. 9.8CVE-2019-6526EPSS 1.0%

    Moxa IKS-G6824A series Versions 4.5 and prior, EDS-405A series Version 3.8 and prior, EDS-408A series Version 3.8 and prior, and EDS-510A series Version 3.8 and prior use plaintext transmission of sensitive data, which may allow an attacke…

  45. 2.5CVE-2019-1573EPSS 0.3%

    GlobalProtect Agent 4.1.0 for Windows and GlobalProtect Agent 4.1.10 and earlier for macOS may allow a local authenticated attacker who has compromised the end-user account and gained the ability to inspect memory, to access authentication…

  46. 6.5CVE-2019-1003095EPSS 1.2%

    Jenkins Perfecto Mobile Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

  47. 6.5CVE-2019-1003094EPSS 1.2%

    Jenkins Open STF Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

  48. 6.5CVE-2019-1003089EPSS 1.2%

    Jenkins Upload to pgyer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

  49. 6.5CVE-2019-1003088EPSS 1.2%

    Jenkins Fabric Beta Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

  50. 8.8CVE-2019-1003075EPSS 1.4%

    Jenkins Audit to Database Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.