CWE-319 Cleartext Transmission of Sensitive Information
baseThe product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (1180)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-22948US | medium6.5OT critical | KEV | ||
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may… | ||||
| CVE-2018-12710US | high8.0OT high | Exploit | ||
An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account (which is a low privilege account) access, an attacker can inter… | ||||
| CVE-2017-5259US | high8.8OT high | Exploit | ||
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path https://<device-ip-or… | ||||
| CVE-2018-1297US | critical9.8OT high | Exploit | ||
When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauth… | ||||
| CVE-2017-3737US | medium5.9OT high | — | ||
OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into th… | ||||
| CVE-2019-6203US | critical9.8OT high | Exploit | ||
A logic issue was addressed with improved state management. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2. An attacker in a privileged network position may be ab… | ||||
| CVE-2023-33730US | critical9.8OT high | Exploit | ||
Privilege Escalation in the "GetUserCurrentPwd" function in Microworld Technologies eScan Management Console 14.0.1400.2281 allows any remote attacker to retrieve password of any a… | ||||
| CVE-2016-5649US | critical9.8OT high | — | ||
A vulnerability is in the 'BSW_cxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.50_7.0.50, and DGND3700, version DGND3700-V1.0.0.17_1.0.17, which can allow a remot… | ||||
| CVE-2019-3993US | high7.5OT high | — | ||
ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can recover a user's password hash by sending a crafted HTTP… | ||||
| CVE-2020-14930US | high8.1OT elevated | Exploit | ||
An issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur because the password-reset feature discloses the verification token. Upon a getverif… | ||||
| CVE-2023-32784US | high7.5OT elevated | Exploit | ||
In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be… | ||||
| CVE-2020-9992US | high7.8OT elevated | Exploit | ||
This issue was addressed by encrypting communications over the network to devices running iOS 14, iPadOS 14, tvOS 14, and watchOS 7. This issue is fixed in iOS 14.0 and iPadOS 14.0… | ||||
| CVE-2020-25748US | high8.1OT elevated | Exploit | ||
A Cleartext Transmission issue was discovered on Rubetek RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339). Someone in the middle can intercept and modify the vi… | ||||
| CVE-2020-11539US | high8.1OT elevated | Exploit | ||
An issue was discovered on Tata Sonata Smart SF Rush 1.12 devices. It has been identified that the smart band has no pairing (mode 0 Bluetooth LE security level) The data being tra… | ||||
| CVE-2014-5380US | high7.5OT elevated | Exploit | ||
Grand MA 300 allows retrieval of the access PIN from sniffed data. | ||||
| CVE-2024-37393US | high7.5OT elevated | Exploit | ||
Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltra… | ||||
| CVE-2022-36200US | high7.5OT elevated | Exploit | ||
In FiberHome VDSL2 Modem HG150-Ub_V3.0, Credentials of Admin are submitted in URL, which can be logged/sniffed. | ||||
| CVE-2012-2379US | high10.0OT elevated | — | ||
Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure t… | ||||
| CVE-2011-1377US | high10.0OT elevated | — | ||
The Web Services Security component in the Web Services Feature Pack before 6.1.0.41 for IBM WebSphere Application Server (WAS) 6.1 does not properly handle the enabling of WS-Secu… | ||||
| CVE-2001-0133US | high10.0OT elevated | — | ||
The web administration interface for Interscan VirusWall 3.6.x and earlier does not use encryption, which could allow remote attackers to obtain the administrator password to sniff… | ||||
04
attack patterns (5)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan