Cleartext Transmission of Sensitive Information
CWE-319
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
We track 226 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.0.
How this weakness is prevented
- Architecture and Design: Before transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic protocols.
- Implementation: When using web applications with SSL, use SSL for the entire session from login to logout, not just for the initial login page.
- Implementation: When designing hardware platforms, ensure that approved encryption algorithms (such as those recommended by NIST) protect paths from security critical data to trusted user applications.
- Testing: Use tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
- Operation: Configure servers to use encrypted channels for communication, which may include SSL or other secure protocols.
Latest Cleartext Transmission of Sensitive Information vulnerabilities
- 10.0 Critical severity
GV-Face: Cleartext Transmission of Sensitive Information
GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections. The HTTP traffic is not encrypted, an attacker with the ability to intercept network traffic.
- 8.1 High severity
WS_FTP Server: Cleartext Transmission of Sensitive Information
Insufficient protection of communications in Progress WS_FTP Server versions prior to 2025.0.5 could allow a network attacker to intercept sensitive information or modify requests when unencrypted connections are used.
- 8.1 High severity
IRIS for Health: Cleartext Transmission of Sensitive Information
InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.
- 7.5 High severity
ADP Desktop SDK: Cleartext Transmission of Sensitive Information
ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text. Exploitation of this vulnerability can lead to unauthorized access to Autodesk services.
- 7.5 High severity
MarkLogic Server: Cleartext Transmission of Sensitive Information
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default. A network-positioned attacker could intercept data or credentials transmitted through an affected connection
- 7.4 High severity
MarkLogic Server: Cleartext Transmission of Sensitive Information
Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transport for certain cluster-management communications. A network-positioned attacker could intercept or modify information transmitted through an affected connection.
- 7.4 High severity
hMailServer: Cleartext Transmission of Sensitive Information
Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE (usage 3) record, contrary to RFC 7672 section 2.2. The server used only DANE-EE record
- 9.4 Critical severity
async-http-client: Cleartext Transmission of Sensitive Information
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related pr
- 7.5 High severity
async-http-client: Cleartext Transmission of Sensitive Information
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rath
- 8.7 High severity
async-http-client: Cleartext Transmission of Sensitive Information
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malici
- 7.6 High severity
Docker Engine: Improper Certificate Validation
Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single addr
- 7.5 High severity
GV-Eye: Cleartext Transmission of Sensitive Information
Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could inter
- 7.3 High severity
EasyIO NEO: Cleartext Transmission of Sensitive Information
- Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack. This issue affects EasyIO NEO: before 3.3b25.
- 8.5 High severity
Aware2: Cleartext Transmission of Sensitive Information
Cleartext transmission without a cryptographic integrity check in operator control unit to robot UDP traffic in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows adjacent unauthenticated attackers to intercept, hijack, or mod
- 9.4 Critical severity
Aware2: Cleartext Transmission of Sensitive Information
Cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackBot robots running this software via snif
- 7.4 High severity
HCL BigFix Service Management: Cleartext Transmission of Sensitive Information
HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and poten
- 7.5 High severity
Hitachi Coding Software Suite: Cleartext Transmission of Sensitive Information
Hitachi Coding Software Suite contains a vulnerability related to the Cleartext Transmission of Sensitive Information which allows an attacker to eavesdrop on with authentication credentials and sensitive data in transit. This issue affects Hitachi Coding Soft
- 7.4 High severity
Financial Transaction Manager (FTM) for RedHat…: Cleartext Transmission of Sensitive Information
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive information.
- 7.5 High severity
Financial Transaction Manager (FTM) for RedHat…: Cleartext Transmission of Sensitive Information
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive information.
- 7.5 High severity
async-http-client: Cleartext Transmission of Sensitive Information
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and 3.0.12, requests using an authenticated SOCKS proxy can expose the proxy's credentials to the orig
- 8.7 High severity
EKI-1242IEIMS: Cleartext Transmission of Sensitive Information
Nozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive Information vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a network-adjacent passive observer to intercept ma
- 7.0 High severity
DuoxMe: Cleartext Transmission of Sensitive Information
Transmission of the home Wi-Fi credentials without encryption during the pairing process between the DuoxMe application and VEO and VEO-XS Wi-Fi monitors, in versions prior to 4.3.4 of the application and 01.50.001 of the monitor firmware, allows an attacker o
- 8.1 High severity
atomic-agents-stack: Cleartext Transmission of Sensitive Information
atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spaw
- 7.7 High severity
BioStar 2: Cleartext Transmission of Sensitive Information
An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers to obtain Active Directory service account credentials in cleartext by supplying a crafted GET request.
- 8.1 High severity
httpx2: Cleartext Transmission of Sensitive Information
HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/_sync/socks_proxy.py and src/httpcore2/httpcore2/_async/socks_proxy.py when the remote origin uses wss through a SOCKS5 proxy because t
- 7.4 High severity
scrapy: Cleartext Transmission of Sensitive Information
Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler converts an S3-scheme bucket and key request into a plaintext HTTP request to the corresponding S3 endp
- 7.5 High severity
Ebyte NA111-M Firmware: Cleartext Transmission of Sensitive Information
A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web management interface does not adequately protect sensitive communications using transport-layer encryption. An attacker with access to network tra
- 9.8 Critical severity
Ebyte NA111-M Firmware: Cleartext Transmission of Sensitive Information
MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level attackers. This may enable unauthorized device impersonation and disruption of messaging functions.
- 7.5 High severity
openssl_encrypt: Cleartext Transmission of Sensitive Information
openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including client_id, pas
- 7.6 High severity
AM102/102L V2: Cleartext Transmission of Sensitive Information
A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSK
- 7.7 High severity
HP Easy Start for macOS: Cleartext Transmission of Sensitive Information
Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities.
- 7.4 High severity
ER7212PC v2: Cleartext Transmission of Sensitive Information
A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate tr
- 10.0 Critical severity
OZOLS: Cleartext Transmission of Sensitive Information
Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component:
- 9.1 Critical severity
stigmem: Cleartext Transmission of Sensitive Information
stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-lo
- 7.5 High severity
Data::Entropy: Cleartext Transmission of Sensitive Information
Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomO
- 8.2 High severity
AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to…
AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifi
- 7.5 High severity
core: Cleartext Transmission of Sensitive Information
Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2025.5.0, The iOS companion app ignores the SSID allowlist for internal networks. The app uses SSID to detect when to use the internal URL, but whenever
- 7.5 High severity
Apache Airflow FTP provider: Cleartext Transmission of Sensitive Information
The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was TLS-protected the data channel was transmitted in cleartext. Any deployment using `FTPSHook` or `FTP
- 9.1 Critical severity
deno: Cleartext Transmission of Sensitive Information
Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw in Deno's Node.js tls compatibility layer could cause a TLS client to transmit application data in plaintext after a connection retry. When `autoSelectFamily was enabled
- 8.2 High severity
FAST/TOOLS: Cleartext Transmission of Sensitive Information
Overview: A vulnerability has been found in FAST/TOOLS and CI Server. The web server may return a response containing the CI Server setting information. This information could be exploited by an attacker for other attacks. The affected products and versions ar