cve.bz

CWE-311: Missing Encryption of Sensitive Data, page 8

Filter

The product does not encrypt sensitive or critical information before storage or transmission.

What the weakness is: CWE-311 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 14
  • CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies Likelihood: High · Severity: High
  • CAPEC-37 Retrieve Embedded Sensitive Data Likelihood: High · Severity: Very High
  • CAPEC-65 Sniff Application Code Likelihood: Low · Severity: High
  • CAPEC-157 Sniffing Attacks Severity: Medium
  • CAPEC-158 Sniffing Network Traffic Severity: Medium
  • CAPEC-204 Lifting Sensitive Data Embedded in Cache Severity: Medium
  • CAPEC-383 Harvesting Information via API Event Monitoring Severity: Low
  • CAPEC-384 Application API Message Manipulation via Man-in-the-Middle Severity: Low
  • CAPEC-385 Transaction or Event Tampering via Application API Manipulation Severity: Medium
  • CAPEC-386 Application API Navigation Remapping Severity: Medium
  • CAPEC-387 Navigation Remapping To Propagate Malicious Content Severity: Medium
  • CAPEC-388 Application API Button Hijacking Severity: Medium
  • CAPEC-477 Signature Spoofing by Mixing Signed and Unsigned Content Likelihood: Low · Severity: High
  • CAPEC-609 Cellular Traffic Intercept Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-311, as MITRE names them. Credits.

Ask an AI about CWE-311

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-311: Missing Encryption of Sensitive Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/311.html and https://cve.bz/cve/cwe/311?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.1CVE-2017-16040EPSS 1.7%

    gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resource…

  2. 8.1CVE-2017-16035EPSS 0.7%

    The hubl-server module is a wrapper for the HubL Development Server. During installation hubl-server downloads a set of dependencies from api.hubapi.com. It appears in the code that these files are downloaded over HTTPS however the api.hub…

  3. 8.1CVE-2016-10697EPSS 1.7%

    react-native-baidu-voice-synthesizer is a baidu voice speech synthesizer for react native. react-native-baidu-voice-synthesizer downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote c…

  4. 8.1CVE-2016-10696EPSS 1.7%

    windows-latestchromedriver downloads the latest version of chromedriver.exe. windows-latestchromedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RC…

  5. 8.1CVE-2016-10695EPSS 1.7%

    The npm-test-sqlite3-trunk module provides asynchronous, non-blocking SQLite3 bindings. npm-test-sqlite3-trunk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execut…

  6. 8.1CVE-2016-10694EPSS 2.1%

    alto-saxophone is a module to install and launch Chromedriver for Mac, Linux or Windows. alto-saxophone versions below 2.25.1 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remo…

  7. 8.1CVE-2016-10693EPSS 1.7%

    pm2-kafka is a PM2 module that installs and runs a kafka server pm2-kafka downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the request…

  8. 8.1CVE-2016-10691EPSS 1.7%

    windows-seleniumjar is a module that downloads the Selenium Jar file windows-seleniumjar downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping …

  9. 8.1CVE-2016-10690EPSS 1.7%

    openframe-ascii-image module is an openframe plugin which adds support for ascii images via fim. openframe-ascii-image downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execu…

  10. 8.1CVE-2016-10689EPSS 1.7%

    The windows-iedriver module downloads fixed version of iedriverserver.exe windows-iedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swappin…

  11. 8.1CVE-2016-10688EPSS 1.7%

    Haxe 3 : The Cross-Platform Toolkit (a fork from David Mouton's damoebius/haxe-npm) haxe3 downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out th…

  12. 8.1CVE-2016-10687EPSS 1.7%

    windows-selenium-chromedriver is a module that downloads the Selenium Jar file. windows-selenium-chromedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code executi…

  13. 8.1CVE-2016-10686EPSS 2.1%

    fis-sass-all is another libsass wrapper for node. fis-sass-all downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resource…

  14. 8.1CVE-2016-10685EPSS 1.7%

    pk-app-wonderbox is an integration with wonderbox pk-app-wonderbox downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested reso…

  15. 8.1CVE-2016-10684EPSS 1.7%

    healthcenter - IBM Monitoring and Diagnostic Tools health Center agent healthcenter downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out t…

  16. 8.1CVE-2016-10683EPSS 1.7%

    arcanist downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the …

  17. 8.1CVE-2016-10678EPSS 1.7%

    serc.js is a Selenium RC process wrapper serc.js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an atta…

  18. 8.1CVE-2016-10677EPSS 1.7%

    google-closure-tools-latest is a Node.js module wrapper for downloading the latest version of the Google Closure tools google-closure-tools-latest downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be …

  19. 8.1CVE-2016-10676EPSS 1.7%

    rs-brightcove is a wrapper around brightcove's web api rs-brightcove downloads source file resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the request…

  20. 8.1CVE-2016-10675EPSS 2.0%

    libsbmlsim is a module that installs linux binaries for libsbmlsim libsbmlsim downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the req…

  21. 8.1CVE-2016-10673EPSS 0.5%

    ipip-coffee queries geolocation information from IP ipip-coffee downloads geolocation resources over HTTP, which leaves it vulnerable to MITM attacks. This could impact the integrity and availability of the data being used to make geolocat…

  22. 8.1CVE-2016-10672EPSS 1.7%

    cloudpub-redis is a module for CloudPub: Redis Backend cloudpub-redis downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested r…

  23. 8.1CVE-2016-10671EPSS 1.7%

    mystem-wrapper is a Yandex mystem app wrapper module. mystem-wrapper downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested re…

  24. 8.1CVE-2016-10670EPSS 1.7%

    windows-seleniumjar-mirror downloads the Selenium Jar file windows-seleniumjar-mirror downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out…

  25. 8.1CVE-2016-10669EPSS 1.7%

    soci downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on t…

  26. 8.1CVE-2016-10668EPSS 2.0%

    libsbml is a module that installs Linux binaries for libSBML libsbml downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources…

  27. 8.1CVE-2016-10667EPSS 1.7%

    selenium-portal is a Selenium Testing Framework selenium-portal downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resourc…

  28. 8.1CVE-2016-10665EPSS 2.2%

    herbivore is a packet sniffing and crafting library. Built on libtins herbivore 0.0.3 and below download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swa…

  29. 8.1CVE-2016-10664EPSS 1.7%

    mystem is a Node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out t…

  30. 8.1CVE-2016-10663EPSS 2.2%

    wixtoolset is a Node module wrapper around the wixtoolset binaries wixtoolset downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the req…

  31. 8.1CVE-2016-10662EPSS 1.7%

    tomita is a node wrapper for Yandex Tomita Parser tomita downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with…

  32. 8.1CVE-2016-10661EPSS 1.7%

    phantomjs-cheniu is a Headless WebKit with JS API phantomjs-cheniu downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested reso…

  33. 8.1CVE-2016-10660EPSS 1.7%

    fis-parser-sass-bin a plugin for fis to compile sass using node-sass-binaries. fis-parser-sass-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by…

  34. 8.1CVE-2016-10657EPSS 1.7%

    co-cli-installer downloads the co-cli module as part of the install process, but does so over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources…

  35. 8.1CVE-2016-10656EPSS 1.7%

    qbs is a build tool that helps simplify the build process for developing projects across multiple platforms. qbs downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code exec…

  36. 8.1CVE-2016-10655EPSS 1.7%

    The clang-extra module installs LLVM's clang-extra tools. clang-extra downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested r…

  37. 8.1CVE-2016-10654EPSS 0.5%

    sfml downloads resources over HTTP, which leaves it vulnerable to MITM attacks.

  38. 8.1CVE-2016-10653EPSS 1.7%

    xd-testing is a testing library for cross-device (XD) web applications. xd-testing downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out th…

  39. 8.1CVE-2016-10652EPSS 0.5%

    prebuild-lwip is a module for comprehensive, fast, and simple image processing and manipulation. prebuild-lwip downloads resources over HTTP, which leaves it vulnerable to MITM attacks.

  40. 8.1CVE-2016-10651EPSS 1.7%

    webdriver-launcher is a Node.js Selenium Webdriver Launcher. webdriver-launcher downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the r…

  41. 8.1CVE-2016-10649EPSS 2.1%

    frames-compiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attack…

  42. 8.1CVE-2016-10648EPSS 1.7%

    marionette-socket-host is a marionette-js-runner host for sending actions over a socket. marionette-socket-host downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execu…

  43. 8.1CVE-2016-10647EPSS 1.7%

    node-air-sdk is an AIR SDK for nodejs. node-air-sdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an atta…

  44. 8.1CVE-2016-10646EPSS 1.7%

    resourcehacker is a Node wrapper of Resource Hacker (windows executable resource editor). resourcehacker downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (R…

  45. 8.1CVE-2016-10645EPSS 1.7%

    grunt-images is a grunt plugin for processing images. grunt-images downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested bina…

  46. 8.1CVE-2016-10644EPSS 1.7%

    slimerjs-edge is a npm wrapper for installing the bleeding edge version of slimerjs. slimerjs-edge downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by…

  47. 8.1CVE-2016-10643EPSS 1.7%

    jstestdriver is a wrapper for Google's jstestdriver. jstestdriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binar…

  48. 8.1CVE-2016-10642EPSS 2.1%

    cmake installs the cmake x86 linux binaries. cmake downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attac…

  49. 8.1CVE-2016-10641EPSS 0.6%

    node-bsdiff-android downloads resources over HTTP, which leaves it vulnerable to MITM attacks.

  50. 8.1CVE-2016-10640EPSS 1.7%

    node-thulac is a node binding for thulac. node-thulac downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an at…