cve.bz

CWE-319: Cleartext Transmission of Sensitive Information, page 6

Filter

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

What the weakness is: CWE-319 at MITRE. OWASP Top 10: A04:2025 Cryptographic Failures

Related attack patterns (CAPEC): 5
  • CAPEC-65 Sniff Application Code Likelihood: Low · Severity: High
  • CAPEC-102 Session Sidejacking Likelihood: High · Severity: High
  • CAPEC-117 Interception Likelihood: Low · Severity: Medium
  • CAPEC-383 Harvesting Information via API Event Monitoring Severity: Low
  • CAPEC-477 Signature Spoofing by Mixing Signed and Unsigned Content Likelihood: Low · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-319, as MITRE names them. Credits.

Ask an AI about CWE-319

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-319: Cleartext Transmission of Sensitive Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/319.html and https://cve.bz/cve/cwe/319?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2025-5270EPSS 0.3%

    In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled. This vulnerability was fixed in Firefox 139 and Thunderbird 139.

  2. 6.5CVE-2025-3480EPSS 0.2%

    MedDream WEB DICOM Viewer Cleartext Transmission of Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of MedDream WEB DICOM Vi…

  3. 5.3CVE-2025-0136EPSS 0.2%

    Using the AES-128-CCM algorithm for IPSec on certain Palo Alto Networks PAN-OS® firewalls (PA-7500, PA-5400, PA-5400f, PA-3400, PA-1600, PA-1400, and PA-400 Series) leads to unencrypted data transfer to devices that are connected to the PA…

  4. 6.7CVE-2025-40583EPSS 0.1%

    A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V2.1 HF0 with SINEMA Remote Connect Edge Client installed). Affected devices do transmit sensitive information in cleartext. This could allow a p…

  5. 9.3CVE-2025-27720EPSS 0.3%

    The Pixmeo Osirix MD Web Portal sends credential information without encryption, which could allow an attacker to steal credentials.

  6. 9.1CVE-2024-12378EPSS 0.5%

    On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan tunnels in the clear.

  7. 10.0CVE-2025-47419EPSS 0.3%

    Cleartext Transmission of Sensitive Information vulnerability in Crestron Automate VX allows Sniffing Network Traffic. The device allows Web UI and API access over non-secure network ports which exposes sensitive information such as user …

  8. 6.5CVE-2025-32887EPSS 0.2%

    An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. A command channel includes the next hop. which can be intercepted and used to break frequency hopping.

  9. 6.5CVE-2025-32884EPSS 0.2%

    An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. By default, a GID is the user's phone number unless they specifically opt out. A phone number is very sensitive information because it can be tied back to …

  10. 6.5CVE-2025-32881EPSS 0.2%

    An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. By default, the GID is the user's phone number unless they specifically opt out. A phone number is very sensitive information because it can be tied back to …

  11. 3.7CVE-2025-25046EPSS 0.2%

    IBM InfoSphere Information Server 11.7 DataStage Flow Designer  transmits sensitive information via URL or query parameters that could be exposed to an unauthorized actor using man in the middle techniques.

  12. 8.7CVE-2025-42603EPSS 0.3%

    This vulnerability exists in the Meon KYC solutions due to transmission of sensitive data in plain text within the response payloads of certain API endpoints. An authenticated remote attacker could exploit this vulnerability by interceptin…

  13. 4.0CVE-2025-32793EPSS 0.1%

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.15.0 to 1.15.15, 1.16.0 to 1.16.8, and 1.17.0 to 1.17.2, are vulnerable when using Wireguard transparent encryption in a Cilium cluster, …

  14. 7.5CVE-2025-43013EPSS 0.2%

    In JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possible

  15. 4.7CVE-2025-43704EPSS 0.1%

    Arctera/Veritas Data Insight before 7.1.2 can send cleartext credentials when configured to use HTTP Basic Authentication to a Dell Isilon OneFS server.

  16. 5.9CVE-2025-27722EPSS 0.3%

    Cleartext transmission of sensitive information issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a man-in-the-middle attack may allow a remote unauthenticated attacker to eavesdrop the communication and obtain the authenti…

  17. 6.8CVE-2025-26654EPSS 0.2%

    SAP Commerce Cloud (Public Cloud) does not allow to disable unencrypted HTTP (port 80) entirely, but instead allows a redirect from port 80 to 443 (HTTPS). As a result, Commerce normally communicates securely over HTTPS. However, the confi…

  18. 2.3CVE-2025-3329EPSS 0.4%

    A vulnerability classified as problematic has been found in Consumer Comanda Mobile up to 14.9.3.2/15.0.0.8. This affects an unknown part of the component Restaurant Order Handler. The manipulation of the argument Login/Password leads to c…

  19. 6.9CVE-2025-2861EPSS 0.2%

    SaTECH BCU in its firmware version 2.1.3 uses the HTTP protocol. The use of the HTTP protocol for web browsing has the problem that information is exchanged in unencrypted text. Since sensitive data such as credentials are exchanged, an at…

  20. 6.5CVE-2024-45361EPSS 0.2%

    A protocol flaw vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited by attackers to leak sensitive user information.

  21. 9.0CVE-2025-2311EPSS 0.2%

    Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in Sechard Information Technologies SecHard allows Authentication Bypass, Interface Manipulation, Authent…

  22. 7.5CVE-2024-10718EPSS 0.3%

    In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set. This could cause the user agent to send those cookies in plaintext over an HTTP session, potentially exposing sensitive information.…

  23. 7.3CVE-2024-44276EPSS 0.3%

    This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in iOS 18.2 and iPadOS 18.2. A user in a privileged network position may be able to leak sensitive information.

  24. 7.5CVE-2025-27594EPSS 0.5%

    The device uses an unencrypted, proprietary protocol for communication. Through this protocol, configuration data is transmitted and device authentication is performed. An attacker can thereby intercept the authentication hash and use it t…

  25. 9.4CVE-2024-13872EPSS 0.2%

    Bitdefender Box, versions 1.3.11.490 through 1.3.11.505, uses the insecure HTTP protocol to download assets over the Internet to update and restart daemons and detection rules on the devices. Updates can be remotely triggered through the /…

  26. 5.6CVE-2025-22493EPSS 0.1%

    Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software (FRS). Absence of this secure flag could lead into the session cookie being transmitted over unencrypted HTTP connections. This security issue has been reso…

  27. 7.5CVE-2025-24849EPSS 0.09%

    Lack of encryption in transit for cloud infrastructure facilitating potential for sensitive data manipulation or exposure.

  28. 6.5CVE-2025-25728EPSS 0.2%

    Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to send communications to the update API in plaintext, allowing attackers to access sensitive information via a man-in-the-middle at…

  29. 6.4CVE-2022-41545EPSS 0.3%

    The administrative web interface of a Netgear C7800 Router running firmware version 6.01.07 (and possibly others) authenticates users via basic authentication, with an HTTP header containing a base64 value of the plaintext username and pas…

  30. 5.3CVE-2024-5462EPSS 0.2%

    If Brocade Fabric OS before Fabric OS 9.2.0 configuration settings are not set to encrypt SNMP passwords, then the SNMP privsecret / authsecret fields can be exposed in plaintext. The plaintext passwords can be exposed in a configupload ca…

  31. 8.7CVE-2025-1060EPSS 0.2%

    CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists that could result in the exposure of data when network traffic is being sniffed by an attacker.

  32. 6.5CVE-2025-0556EPSS 0.3%

    In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communication of non-sensitive information between the service agent process and app host process occurs over …

  33. 7.5CVE-2024-36558EPSS 0.2%

    Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h suffers from Cleartext Transmission of Sensitive Information due to lack of encryption in device-server communication.

  34. 7.5CVE-2024-43187EPSS 0.2%

    IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

  35. 8.1CVE-2025-23060EPSS 0.2%

    A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information. Exploiting this vulnerability could allow an attacker to perform a man-in-the-middle attack, poten…

  36. 5.9CVE-2023-35017EPSS 0.2%

    IBM Security Verify Governance 10.0.2 Identity Manager can transmit user credentials in clear text that could be obtained by an attacker using man in the middle techniques.

  37. 6.3CVE-2025-0784EPSS 0.5%

    A vulnerability has been found in Intelbras InControl up to 2.21.58 and classified as problematic. This vulnerability affects unknown code of the file /v1/usuario/ of the component Registered User Handler. The manipulation leads to clearte…

  38. 8.7CVE-2025-0631EPSS 0.3%

    A Credential Exposure Vulnerability exists in the above-mentioned product and version. The vulnerability is due to using HTTP resulting in credentials being sent in clear text.

  39. 6.9CVE-2025-0432EPSS 0.1%

    EWON Flexy 202 transmits user credentials in clear text with no encryption when a user is added, or user credentials are changed via its webpage.

  40. 6.5CVE-2024-28786EPSS 0.2%

    IBM QRadar SIEM 7.5 transmits sensitive or security-critical data in cleartext in a communication channel that could be obtained by an unauthorized actor using man in the middle techniques.

  41. 5.9CVE-2024-41757EPSS 0.3%

    IBM Concert Software 1.0.0 and 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive i…

  42. 6.1CVE-2024-26155EPSS 0.2%

    All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 expose clear text credentials in the web portal. An attacker can access the ETIC RAS web portal and view the HTML code, which is configured to be hidden, thus allowi…

  43. 6.5CVE-2024-48121EPSS 0.2%

    The HI-SCAN 6040i Hitrax HX-03-19-I was discovered to transmit user credentials in cleartext over the GIOP protocol. This allows attackers to possibly gain access to sensitive information via a man-in-the-middle attack.

  44. 6.8CVE-2024-45102EPSS 0.2%

    A privilege escalation vulnerability was discovered that could allow a valid, authenticated LXCA user to escalate their permissions for a connected XCC instance when using LXCA as a Single Sign On (SSO) provider for XCC instances.

  45. 7.5CVE-2024-42181EPSS 0.2%

    HCL MyXalytics is affected by a cleartext transmission of sensitive information vulnerability. The application transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actor…

  46. 9.1CVE-2024-46505EPSS 0.3%

    Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities.

  47. 6.5CVE-2024-11946EPSS 0.3%

    iXsystems TrueNAS CORE fetch_plugin_packagesites tar Cleartext Transmission of Sensitive Information Vulnerability. This vulnerability allows network-adjacent attackers to tamper with firmware update files on affected installations of iXsy…

  48. 7.5CVE-2021-39081EPSS 0.3%

    IBM Cognos Analytics Mobile for Android 1.1.14 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

  49. 5.7CVE-2024-10973EPSS 0.3%

    A vulnerability was found in Keycloak. The environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent net…

  50. 3.7CVE-2024-49820EPSS 0.3%

    IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this…