cve.bz

CWE-319: Cleartext Transmission of Sensitive Information, page 16

Filter

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

What the weakness is: CWE-319 at MITRE. OWASP Top 10: A04:2025 Cryptographic Failures

Related attack patterns (CAPEC): 5
  • CAPEC-65 Sniff Application Code Likelihood: Low · Severity: High
  • CAPEC-102 Session Sidejacking Likelihood: High · Severity: High
  • CAPEC-117 Interception Likelihood: Low · Severity: Medium
  • CAPEC-383 Harvesting Information via API Event Monitoring Severity: Low
  • CAPEC-477 Signature Spoofing by Mixing Signed and Unsigned Content Likelihood: Low · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-319, as MITRE names them. Credits.

Ask an AI about CWE-319

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-319: Cleartext Transmission of Sensitive Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/319.html and https://cve.bz/cve/cwe/319?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.1CVE-2020-11539EPSS 1.0%

    An issue was discovered on Tata Sonata Smart SF Rush 1.12 devices. It has been identified that the smart band has no pairing (mode 0 Bluetooth LE security level) The data being transmitted over the air is not encrypted. Adding to this, the…

  2. 7.5CVE-2020-7483EPSS 0.9%Version not supported when assigned

    A vulnerability could cause certain data to be visible on the network when the 'password' feature is enabled. This vulnerability was discovered in and remediated in versions v4.9.1 and v4.10.1 on May 30, 2013. The 'password' feature is an …

  3. 5.9CVE-2019-4594EPSS 0.8%

    IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive info…

  4. 9.8CVE-2020-6195EPSS 0.6%

    SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, leading to Information Disclosure. It involves social engineering in order to gain access to system and If password is k…

  5. 7.5CVE-2020-11557EPSS 0.7%

    An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. It includes the username and password values in cleartext within each request's cookie value.

  6. 9.8CVE-2020-11542EPSS 1.0%

    3xLOGIC Infinias eIDC32 2.213 devices with Web 1.107 allow Authentication Bypass via CMD.HTM?CMD= because authentication depends on the client side's interpretation of the <KEY>MYKEY</KEY> substring.

  7. 8.1CVE-2020-5860EPSS 0.7%

    On BIG-IP 15.0.0-15.1.0.2, 14.1.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5.1, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, in a High Availability (HA) network failover in Device Service Cluster (DSC), the failover se…

  8. 8.1CVE-2019-19127EPSS 1.3%

    An authentication bypass vulnerability is present in the standalone SITS:Vision 9.7.0 component of Tribal SITS in its default configuration, related to unencrypted communications sent by the client each time it is launched. This occurs bec…

  9. 7.5CVE-2020-6997EPSS 1.0%

    In Moxa EDS-G516E Series firmware, Version 5.2 or lower, sensitive information is transmitted over some web applications in cleartext.

  10. 7.5CVE-2020-7003EPSS 1.0%

    In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower, sensitive information is transmitted over some web applications in clear text.

  11. 7.5CVE-2019-16063EPSS 0.7%

    NETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data rendered within web pages. It is possible for an attacker to expose unencrypted sensitive data.

  12. 7.5CVE-2019-16067EPSS 0.8%

    NETSAS Enigma NMS 65.0.0 and prior utilises basic authentication over HTTP for enforcing access control to the web application. The use of weak authentication transmitted over cleartext protocols can allow an attacker to steal username and…

  13. 6.5CVE-2019-12122EPSS 0.6%

    An issue was discovered in ONAP Portal through Dublin. By executing a call to ONAPPORTAL/portalApi/loggedinUser, an attacker who possesses a user's cookie may retrieve that user's password from the database. All Portal setups are affected.

  14. 9.8CVE-2019-13394EPSS 0.8%

    The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses HTTP Basic Authentication over cleartext HTTP.

  15. 3.7CVE-2020-0884EPSS 1.7%

    A spoofing vulnerability exists in Microsoft Visual Studio as it includes a reply URL that is not secured by SSL, aka 'Microsoft Visual Studio Spoofing Vulnerability'.

  16. 7.5CVE-2019-5107EPSS 1.1%

    A cleartext transmission vulnerability exists in the network communication functionality of WAGO e!Cockpit version 1.5.1.1. An attacker with access to network traffic can easily intercept, interpret, and manipulate data coming from, or des…

  17. 7.5CVE-2019-9101EPSS 1.0%

    An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1. Sensitive information is sent to the web server in cleartext, which…

  18. 9.8CVE-2020-10376EPSS 1.1%

    Technicolor TC7337NET 08.89.17.23.03 devices allow remote attackers to discover passwords by sniffing the network for an "Authorization: Basic" HTTP header.

  19. 9.8CVE-2020-6198EPSS 1.4%

    SAP Solution Manager (Diagnostics Agent), version 720, allows unencrypted connections from unauthenticated sources. This allows an attacker to control all remote functions on the Agent due to Missing Authentication Check.

  20. 4.3CVE-2020-2157EPSS 0.5%

    Jenkins Skytap Cloud CI Plugin 2.07 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.

  21. 4.3CVE-2020-2156EPSS 0.6%

    Jenkins DeployHub Plugin 8.0.14 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.

  22. 5.3CVE-2020-2155EPSS 0.6%

    Jenkins OpenShift Deployer Plugin 1.2.0 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.

  23. 4.3CVE-2020-2153EPSS 0.6%

    Jenkins Backlog Plugin 2.4 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.

  24. 5.3CVE-2020-2151EPSS 0.8%

    Jenkins Quality Gates Plugin 2.5 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.

  25. 5.3CVE-2020-2150EPSS 0.6%

    Jenkins Sonar Quality Gates Plugin 1.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.

  26. 5.3CVE-2020-2149EPSS 0.6%

    Jenkins Repository Connector Plugin 1.2.6 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.

  27. 5.3CVE-2020-2143EPSS 0.6%

    Jenkins Logstash Plugin 2.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.

  28. 9.8CVE-2020-9550EPSS 0.7%

    Rubetek SmartHome 2020 devices use unencrypted 433 MHz communication between controllers and beacons, allowing an attacker to sniff and spoof beacon requests remotely.

  29. 9.8CVE-2020-9477EPSS 1.3%

    An issue was discovered on HUMAX HGA12R-02 BRGCAA 1.1.53 devices. A vulnerability in the authentication functionality in the web-based interface could allow an unauthenticated remote attacker to capture packets at the time of authenticatio…

  30. 6.5CVE-2020-3841EPSS 0.5%

    The issue was addressed with improved UI handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, Safari 13.0.5. A local user may unknowingly send a password unencrypted over the network.

  31. 7.5CVE-2020-7907EPSS 0.8%

    In the JetBrains Scala plugin before 2019.2.1, some artefact dependencies were resolved over unencrypted connections.

  32. 7.4CVE-2020-5399EPSS 0.5%

    Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS. A malicious user with access to the network between CredHub and its MySQL database may eavesdrop on database connect…

  33. 7.5CVE-2019-20061EPSS 0.9%

    The user-introduction email in MFScripts YetiShare v3.5.2 through v4.5.4 may leak the (system-picked) password if this email is sent in cleartext. In other words, the user is not allowed to choose their own initial password.

  34. 7.5CVE-2020-8507EPSS 1.4%

    The Citytv Video application 4.08.0 for Android and 3.35 for iOS sends Unencrypted Analytics.

  35. 5.3CVE-2020-8506EPSS 1.1%

    The Global TV application 2.3.2 for Android and 4.7.5 for iOS sends Unencrypted Analytics.

  36. 7.5CVE-2020-7984EPSS 2.5%

    SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain admin credentials from the Agent & Probe settings, and obtain other sensitive information. The attacker can use a custome…

  37. 7.5CVE-2019-19898EPSS 0.7%

    In IXP EasyInstall 6.2.13723, there are cleartext credentials in network communication on TCP port 20050 when using the Administrator console remotely.

  38. 7.5CVE-2019-12399EPSS 3.9%

    When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in …

  39. 7.5CVE-2014-5380ExploitEPSS 4.3%

    Grand MA 300 allows retrieval of the access PIN from sniffed data.

  40. 7.5CVE-2019-16274EPSS 0.7%

    DTEN D5 before 1.3 and D7 before 1.3 devices transfer customer data files via unencrypted HTTP.

  41. 7.5CVE-2019-19967EPSS 1.0%

    The Administration page on Connect Box EuroDOCSIS 3.0 Voice Gateway CH7465LG-NCIP-6.12.18.25-2p6-NOSH devices accepts a cleartext password in a POST request on port 80, as demonstrated by the Password field to the xml/setter.xml URI.

  42. 4.3CVE-2019-4743EPSS 0.6%

    IBM Financial Transaction Manager 3.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the u…

  43. 9.8CVE-2019-15911EPSS 0.8%

    An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Because of insecure key transport in ZigBee communication, attackers can obtain sensitive information, cause the multiple denial…

  44. 7.5CVE-2019-19890EPSS 1.0%

    An issue was discovered on Humax Wireless Voice Gateway HGB10R-2 20160817_1855 devices. Admin credentials are sent over cleartext HTTP.

  45. 7.5CVE-2019-19889EPSS 1.1%

    An issue was discovered on Humax Wireless Voice Gateway HGB10R-2 20160817_1855 devices. The attacker can discover admin credentials in the backup file, aka backupsettings.conf.

  46. 6.5CVE-2019-8632EPSS 1.3%

    Some analytics data was sent using HTTP rather than HTTPS. This was addressed by no longer sending this analytics data. This issue is fixed in Texture 5.11.10 for iOS, Texture 4.22.0.4 for Android. An attacker in a privileged network posit…

  47. 7.5CVE-2019-3993EPSS 46%

    ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can recover a user's password hash by sending a crafted HTTP POST request.

  48. 7.5CVE-2019-3992EPSS 1.3%

    ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can access the server's configuration file by sending an HTTP GET request. Amongst the configuration data, the attacker …

  49. 5.3CVE-2019-16568EPSS 0.6%

    Jenkins SCTMExecutor Plugin 2.2 and earlier transmits previously configured service credentials in plain text as part of the global configuration, as well as individual jobs' configurations.

  50. 8.1CVE-2019-16732EPSS 0.9%

    Unencrypted HTTP communications for firmware upgrades in Petalk AI and PF-103 allow man-in-the-middle attackers to run arbitrary code as the root user.