CWE-311 Missing Encryption of Sensitive Data
classThe product does not encrypt sensitive or critical information before storage or transmission.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (769)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-34486US | —OT critical | KEV | ||
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.
This issue affects Apache Tomc… | ||||
| CVE-2019-11523US | critical9.8OT high | Exploit | ||
Anviz Global M3 Outdoor RFID Access Control executes any command received from any source. No authentication/encryption is done. Attackers can fully interact with the device: for e… | ||||
| CVE-2024-26581US | high7.8OT elevated | Exploit | ||
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_set_rbtree: skip end interval element from gc
rbtree lazy gc on insert might collect an end int… | ||||
| CVE-2019-9636US | critical9.8OT elevated | — | ||
Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Informa… | ||||
| CVE-2021-0683US | high7.8OT elevated | Exploit | ||
In runTraceIpcStop of ActivityManagerShellCommand.java, there is a possible deletion of system files due to a confused deputy. This could lead to local escalation of privilege with… | ||||
| CVE-2020-26732US | high7.5OT elevated | Exploit | ||
SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attack… | ||||
| CVE-2017-8221US | high7.5OT elevated | Exploit | ||
Wireless IP Camera (P2P) WIFICAM devices rely on a cleartext UDP tunnel protocol (aka the Cloud feature) for communication between an Android application and a camera device, which… | ||||
| CVE-2002-0949US | high7.5OT elevated | Exploit | ||
Telindus 1100 series ADSL router allows remote attackers to gain privileges to the device via a certain packet to UDP port 9833, which generates a reply that includes the router's… | ||||
| CVE-2024-42657US | high7.5OT elevated | Exploit | ||
An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the lack of encryption during login process | ||||
| CVE-2023-32002US | critical9.8OT elevated | — | ||
The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
This vulnerability affects all users usin… | ||||
| CVE-2023-28531US | critical9.8OT elevated | — | ||
ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9. | ||||
| CVE-2018-10698US | critical9.8OT elevated | — | ||
An issue was discovered on Moxa AWK-3121 1.14 devices. The device enables an unencrypted TELNET service by default. This allows an attacker who has been able to gain an MITM positi… | ||||
| CVE-2019-11367US | critical9.8OT elevated | — | ||
An issue was discovered in AUO Solar Data Recorder before 1.3.0. The web portal uses HTTP Basic Authentication and provides the account and password in the WWW-Authenticate attribu… | ||||
| CVE-2019-7745US | critical9.8OT elevated | — | ||
JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices allow remote attackers to obtain the Wi-Fi password by making a cgi-bin/qcmap_web_cgi Page=GetWiFi_Setting request and then reading the… | ||||
| CVE-2017-3198US | critical9.8OT elevated | — | ||
GIGABYTE BRIX UEFI firmware does not cryptographically validate images prior to updating the system firmware. Additionally, the firmware updates are served over HTTP. An attacker c… | ||||
| CVE-2007-3357US | high10.0OT elevated | — | ||
NetClassifieds Premium Edition does not use encryption for (1) stored passwords or (2) sensitive data, which might allow attackers to obtain information via certain vectors. | ||||
| CVE-2026-20157US | critical9.8OT elevated | — | ||
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This revi… | ||||
| CVE-2025-40938US | critical9.8OT elevated | — | ||
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device stores sensitive information in the firmware. This could allow an attacker to ac… | ||||
| CVE-2023-6339US | critical9.8OT elevated | — | ||
Google Nest WiFi Pro root code-execution & user-data compromise | ||||
| CVE-2023-39979US | critical9.8OT elevated | — | ||
There is a vulnerability in MXsecurity versions prior to 1.0.1 that can be exploited to bypass authentication. A remote attacker might access the system if the web service authenti… | ||||
04
attack patterns (14)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan