CWE-319 Cleartext Transmission of Sensitive Information
baseThe product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (1180)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-22948US | medium6.5OT kritisch | KEV | ||
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may… | ||||
| CVE-2018-12710US | high8.0OT hoch | Exploit | ||
An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account (which is a low privilege account) access, an attacker can inter… | ||||
| CVE-2017-5259US | high8.8OT hoch | Exploit | ||
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path https://<device-ip-or… | ||||
| CVE-2018-1297US | critical9.8OT hoch | Exploit | ||
When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauth… | ||||
| CVE-2017-3737US | medium5.9OT hoch | — | ||
OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into th… | ||||
| CVE-2019-6203US | critical9.8OT hoch | Exploit | ||
A logic issue was addressed with improved state management. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2. An attacker in a privileged network position may be ab… | ||||
| CVE-2023-33730US | critical9.8OT hoch | Exploit | ||
Privilege Escalation in the "GetUserCurrentPwd" function in Microworld Technologies eScan Management Console 14.0.1400.2281 allows any remote attacker to retrieve password of any a… | ||||
| CVE-2016-5649US | critical9.8OT hoch | — | ||
A vulnerability is in the 'BSW_cxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.50_7.0.50, and DGND3700, version DGND3700-V1.0.0.17_1.0.17, which can allow a remot… | ||||
| CVE-2019-3993US | high7.5OT hoch | — | ||
ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can recover a user's password hash by sending a crafted HTTP… | ||||
| CVE-2020-14930US | high8.1OT erhöht | Exploit | ||
An issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur because the password-reset feature discloses the verification token. Upon a getverif… | ||||
| CVE-2023-32784US | high7.5OT erhöht | Exploit | ||
In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be… | ||||
| CVE-2020-9992US | high7.8OT erhöht | Exploit | ||
This issue was addressed by encrypting communications over the network to devices running iOS 14, iPadOS 14, tvOS 14, and watchOS 7. This issue is fixed in iOS 14.0 and iPadOS 14.0… | ||||
| CVE-2020-25748US | high8.1OT erhöht | Exploit | ||
A Cleartext Transmission issue was discovered on Rubetek RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339). Someone in the middle can intercept and modify the vi… | ||||
| CVE-2020-11539US | high8.1OT erhöht | Exploit | ||
An issue was discovered on Tata Sonata Smart SF Rush 1.12 devices. It has been identified that the smart band has no pairing (mode 0 Bluetooth LE security level) The data being tra… | ||||
| CVE-2014-5380US | high7.5OT erhöht | Exploit | ||
Grand MA 300 allows retrieval of the access PIN from sniffed data. | ||||
| CVE-2024-37393US | high7.5OT erhöht | Exploit | ||
Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltra… | ||||
| CVE-2022-36200US | high7.5OT erhöht | Exploit | ||
In FiberHome VDSL2 Modem HG150-Ub_V3.0, Credentials of Admin are submitted in URL, which can be logged/sniffed. | ||||
| CVE-2012-2379US | high10.0OT erhöht | — | ||
Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure t… | ||||
| CVE-2011-1377US | high10.0OT erhöht | — | ||
The Web Services Security component in the Web Services Feature Pack before 6.1.0.41 for IBM WebSphere Application Server (WAS) 6.1 does not properly handle the enabling of WS-Secu… | ||||
| CVE-2001-0133US | high10.0OT erhöht | — | ||
The web administration interface for Interscan VirusWall 3.6.x and earlier does not use encryption, which could allow remote attackers to obtain the administrator password to sniff… | ||||
04
Angriffsmuster (5)
CAPEC-Angriffsmuster, die dies ausnutzen.
05
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan