cve.bz

CWE-319: Cleartext Transmission of Sensitive Information, page 5

Filter

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

What the weakness is: CWE-319 at MITRE. OWASP Top 10: A04:2025 Cryptographic Failures

Related attack patterns (CAPEC): 5
  • CAPEC-65 Sniff Application Code Likelihood: Low · Severity: High
  • CAPEC-102 Session Sidejacking Likelihood: High · Severity: High
  • CAPEC-117 Interception Likelihood: Low · Severity: Medium
  • CAPEC-383 Harvesting Information via API Event Monitoring Severity: Low
  • CAPEC-477 Signature Spoofing by Mixing Signed and Unsigned Content Likelihood: Low · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-319, as MITRE names them. Credits.

Ask an AI about CWE-319

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-319: Cleartext Transmission of Sensitive Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/319.html and https://cve.bz/cve/cwe/319?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2025-56447EPSS 0.3%

    TM2 Monitoring v3.04 contains an authentication bypass and plaintext credential disclosure.

  2. 7.1CVE-2025-10641EPSS 0.3%

    All WorkExaminer Professional traffic between monitoring client, console and server is transmitted as plain text. This allows an attacker with access to the network to read the transmitted sensitive data. An attacker can also freely modify…

  3. 8.6CVE-2025-62643EPSS 0.3%

    The Restaurant Brands International (RBI) assistant platform through 2025-09-06 transmits passwords of user accounts in cleartext e-mail messages.

  4. 7.5CVE-2025-11492EPSS 0.2%

    In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. A…

  5. 7.1CVE-2025-53139EPSS 0.3%

    Cleartext transmission of sensitive information in Windows Hello allows an unauthorized attacker to bypass a security feature locally.

  6. 7.5CVE-2025-41718EPSS 0.2%

    A cleartext transmission of sensitive information vulnerability in the affected products allows an unauthorized remote attacker to gain login credentials and access the Web-UI.

  7. 2.3CVE-2025-11640EPSS 0.2%

    A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. This affects an unknown function of the component Bluetooth Low Energy. The manipulation results in cleartext transmission of sensitive information. Access to the local network…

  8. 4.7CVE-2025-59448EPSS 0.2%

    Components of the YoSmart YoLink ecosystem through 2025-10-02 leverage unencrypted MQTT to communicate over the internet. An attacker with the ability to monitor network traffic could therefore obtain sensitive information or tamper with t…

  9. 6.2CVE-2025-59406EPSS 0.2%

    The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) has a cleartext Auth0 client secret in its codebase. Because app…

  10. 7.5CVE-2025-36274EPSS 0.2%

    IBM Aspera HTTP Gateway 2.0.0 through 2.3.1 stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user.

  11. 6.5CVE-2025-10540EPSS 0.1%

    iMonitor EAM 9.6394 transmits communication between the EAM client agent and the EAM server, as well as between the EAM monitor management software and the server, in plaintext without authentication or encryption. An attacker with network…

  12. 2.9CVE-2017-20200EPSS 0.3%

    A vulnerability has been found in Coinomi up to 1.7.6. This issue affects some unknown processing. Such manipulation leads to cleartext transmission of sensitive information. The attack can be launched remotely. This attack is characterize…

  13. 2.9CVE-2025-10776EPSS 0.3%

    A vulnerability was detected in LionCoders SalePro POS up to 5.5.0. This issue affects some unknown processing of the component Login. Performing manipulation results in cleartext transmission of sensitive information. The attack can be in…

  14. 8.6CVE-2025-54818EPSS 0.1%

    Cognex In-Sight Explorer and In-Sight Camera Firmware expose a proprietary protocol on TCP port 1069 to perform management operations such as modifying system properties. The user management functionality handles sensitive data such as…

  15. 8.6CVE-2025-47698EPSS 0.1%

    An adjacent attacker without authentication can exploit this vulnerability to retrieve a set of user-privileged credentials. These credentials are present during the firmware upgrade procedure.

  16. 9.6CVE-2025-7743EPSS 0.2%

    Cleartext Transmission of Sensitive Information vulnerability in Dolusoft Omaspot allows Interception, Privilege Escalation. This issue affects Omaspot: before 12.09.2025.

  17. 8.8CVE-2025-50110EPSS 0.3%

    An issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, the GetHttpsResponse method transmits sensitive information - including internal server URLs, account IDs, passwords, and…

  18. 8.4CVE-2025-55976EPSS 3.5%

    Intelbras IWR 3000N 1.9.8 exposes the Wi-Fi password in plaintext via the /api/wireless endpoint. Any unauthenticated user on the local network can directly obtain the Wi-Fi network password by querying this endpoint.

  19. 7.4CVE-2025-41708EPSS 0.2%

    Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit this to learn sensitive data during transmission.

  20. 7.5CVE-2025-7731EPSS 0.3%

    Cleartext Transmission of Sensitive Information vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to obtain credential information by intercepting SLMP communication mes…

  21. 6.5CVE-2025-31972EPSS 0.09%

    HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data transmitted between internal components.

  22. 8.8CVE-2025-52351EPSS 0.2%

    Aikaan IoT management platform v3.25.0325-5-g2e9c59796 sends a newly generated password to users in plaintext via email and also includes the same password as a query parameter in the account activation URL (e.g., https://domain.com/activa…

  23. 8.5CVE-2025-6180EPSS 0.1%

    The StrongDM Client insufficiently protected a pre-authentication token. Attackers could exploit this to intercept and reuse the token, potentially redeeming valid authentication credentials through a race condition.

  24. 7.5CVE-2025-57727EPSS 0.2%

    In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference

  25. 9.1CVE-2025-54156EPSS 0.2%

    The Sante PACS Server Web Portal sends credential information without encryption.

  26. 7.0CVE-2025-8863EPSS 0.3%

    YugabyteDB diagnostic information was transmitted over HTTP, which could expose sensitive data during transmission

  27. 2.9CVE-2025-8741EPSS 0.4%

    A vulnerability was found in macrozheng mall up to 1.0.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/login. The manipulation leads to cleartext transmission of sensiti…

  28. 7.5CVE-2025-52586EPSS 0.09%

    The MOD3 command traffic between the monitoring application and the inverter is transmitted in plaintext without encryption or obfuscation. This vulnerability may allow an attacker with access to a local network to intercept, manipulate…

  29. 2.3CVE-2025-54799EPSS 0.2%

    Let's Encrypt client and ACME library written in Go (Lego). In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package (thus the lego library and the lego cli as well) don't enforce HTTPS when talking to CAs as an ACME c…

  30. 7.5CVE-2025-36020EPSS 0.2%

    IBM Guardium Data Protection could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive credential information.

  31. 7.3CVE-2025-52490EPSS 0.2%

    An issue was discovered in Couchbase Sync Gateway before 3.2.6. In sgcollect_info_options.log and sync_gateway.log, there are cleartext passwords in redacted and unredacted output.

  32. 2.9CVE-2025-8205EPSS 0.5%

    A vulnerability, which was classified as problematic, has been found in Comodo Dragon up to 134.0.6998.179. Affected by this issue is some unknown functionality of the component IP DNS Leakage Detector. The manipulation leads to cleartext …

  33. 4.8CVE-2025-0252EPSS 0.2%

    HCL IEM is affected by a password in cleartext vulnerability.  Sensitive information is transmitted without adequate protection, potentially exposing it to unauthorized access during transit.

  34. 4.9CVE-2025-0250EPSS 0.2%

    HCL IEM is affected by an authorization token sent in cookie vulnerability.  A token used for authentication and authorization is being handled in a manner that may increase its exposure to security risks.

  35. 8.7CVE-2025-53703EPSS 0.1%

    DuraComm SPM-500 DP-10iN-100-MU transmits sensitive data without encryption over a channel that could be intercepted by attackers.

  36. 7.5CVE-2025-36107EPSS 0.3%

    IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 could allow malicious actors to obtain sensitive information due to the cleartext transmission of data.

  37. 5.1CVE-2025-2818EPSS 0.1%

    A vulnerability was reported in version 1.0 of the Bluetooth Transmission Alliance protocol adopted by Motorola Smart Connect Android Application that could allow a nearby attacker within the Bluetooth interaction range to intercept files …

  38. 8.7CVE-2025-53756EPSS 0.3%

    This vulnerability exists in Digisol DG-GR6821AC Router due to cleartext transmission of credentials in its web management interface. A remote attacker could exploit this vulnerability by intercepting the network traffic and capturing clea…

  39. 3.1CVE-2025-53861EPSS 0.1%

    A flaw was found in Ansible. Sensitive cookies without security flags over non-encrypted channels can lead to Man-in-the-Middle (MitM) and Cross-site scripting (XSS) attacks allowing attackers to read transmitted data.

  40. 7.5CVE-2025-44251EPSS 0.2%

    Ecovacs Deebot T10 1.7.2 transmits Wi-Fi credentials in cleartext during the pairing process.

  41. 7.5CVE-2025-27457EPSS 0.3%

    All communication between the VNC server and client(s) is unencrypted. This allows an attacker to intercept the traffic and obtain sensitive data.

  42. 5.9CVE-2025-36034EPSS 0.2%

    IBM InfoSphere DataStage Flow Designer in IBM InfoSphere Information Server 11.7 discloses sensitive user information in API requests in clear text that could be intercepted using man in the middle techniques.

  43. 6.0CVE-2025-5087EPSS 0.3%

    Kaleris NAVIS N4 ULC (Ultra Light Client) communicates insecurely using zlib-compressed data over HTTP. An attacker capable of observing network traffic between Ultra Light Clients and N4 servers can extract sensitive information, includin…

  44. 10.0CVE-2025-4378EPSS 0.3%

    Cleartext Transmission of Sensitive Information, Use of Hard-coded Credentials vulnerability in Ataturk University ATA-AOF Mobile Application allows Authentication Abuse, Authentication Bypass. This issue affects ATA-AOF Mobile Applicatio…

  45. 9.8CVE-2025-32880EPSS 0.5%

    An issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a WLAN. With WLAN access, the COROS Pace 3 downloads firmware files via HTTP. However, the communication is not encrypted an…

  46. 9.8CVE-2025-26199EPSS 0.6%

    CloudClassroom-PHP-Project v1.0 is affected by an insecure credential transmission vulnerability. The application transmits passwords over unencrypted HTTP during the login process, exposing sensitive credentials to potential interception …

  47. 1.0CVE-2025-4227EPSS 0.2%

    An improper access control vulnerability in the Endpoint Traffic Policy Enforcement https://docs.paloaltonetworks.com/globalprotect/6-0/globalprotect-app-new-features/new-features-released-in-gp-app/endpoint-traffic-policy-enforcement fe…

  48. 7.5CVE-2025-49194EPSS 0.3%

    The server supports authentication methods in which credentials are sent in plaintext over unencrypted channels. If an attacker were to intercept traffic between a client and this server, the credentials would be exposed.

  49. 7.5CVE-2025-49183EPSS 0.3%

    All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver. This leads to the possibility of information gathering and downloading media files.

  50. 5.9CVE-2025-44612EPSS 0.2%

    Tinxy WiFi Lock Controller v1 RF was discovered to transmit sensitive information in plaintext, including control information and device credentials, allowing attackers to possibly intercept and access sensitive information via a man-in-th…