Cleartext Transmission of Sensitive Information
CWE-319
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
We track 226 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.0.
How this weakness is prevented
- Architecture and Design: Before transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic protocols.
- Implementation: When using web applications with SSL, use SSL for the entire session from login to logout, not just for the initial login page.
- Implementation: When designing hardware platforms, ensure that approved encryption algorithms (such as those recommended by NIST) protect paths from security critical data to trusted user applications.
- Testing: Use tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
- Operation: Configure servers to use encrypted channels for communication, which may include SSL or other secure protocols.
Latest Cleartext Transmission of Sensitive Information vulnerabilities
- 7.5 High severity
Automate: Cleartext Transmission of Sensitive Information
In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the encr
- 7.5 High severity
Firmware Impact67 Pro 54630: Cleartext Transmission of Sensitive Information
A cleartext transmission of sensitive information vulnerability in the affected products allows an unauthorized remote attacker to gain login credentials and access the Web-UI.
- 7.5 High severity
Aspera HTTP Gateway: Cleartext Transmission of Sensitive Information
IBM Aspera HTTP Gateway 2.0.0 through 2.3.1 stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user.
- 8.0 High severity
In-Sight 2000 series: Cleartext Transmission of Sensitive Information
Cognex In-Sight Explorer and In-Sight Camera Firmware expose a proprietary protocol on TCP port 1069 to perform management operations such as modifying system properties. The user management functionality handles sensitive data such as registered usernames and
- 8.6 High severity
In-Sight 2000 series: Cleartext Transmission of Sensitive Information
An adjacent attacker without authentication can exploit this vulnerability to retrieve a set of user-privileged credentials. These credentials are present during the firmware upgrade procedure.
- 9.6 Critical severity
Omaspot: Cleartext Transmission of Sensitive Information
Cleartext Transmission of Sensitive Information vulnerability in Dolusoft Omaspot allows Interception, Privilege Escalation. This issue affects Omaspot: before 12.09.2025.
- 8.4 High severity
Iwr 3000n Firmware: Exposure of Sensitive Information to an Unauthorized Actor
Intelbras IWR 3000N 1.9.8 exposes the Wi-Fi password in plaintext via the /api/wireless endpoint. Any unauthenticated user on the local network can directly obtain the Wi-Fi network password by querying this endpoint.
- 7.4 High severity
CC612: Cleartext Transmission of Sensitive Information
Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit this to learn sensitive data during transmission.
- 7.5 High severity
MELSEC iQ-F Series FX5U-32MT/ES: Cleartext Transmission of Sensitive Information
Cleartext Transmission of Sensitive Information vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to obtain credential information by intercepting SLMP communication messages, and read or wr
- 8.5 High severity
sdm-cli: Cleartext Transmission of Sensitive Information
The StrongDM Client insufficiently protected a pre-authentication token. Attackers could exploit this to intercept and reuse the token, potentially redeeming valid authentication credentials through a race condition.
- 7.5 High severity
Guardium Data Protection: Cleartext Transmission of Sensitive Information
IBM Guardium Data Protection could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive credential information.
- 7.3 High severity
Sync Gateway: Cleartext Transmission of Sensitive Information
An issue was discovered in Couchbase Sync Gateway before 3.2.6. In sgcollect_info_options.log and sync_gateway.log, there are cleartext passwords in redacted and unredacted output.
- 7.5 High severity
Cognos Analytics Mobile: Cleartext Transmission of Sensitive Information
IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 could allow malicious actors to obtain sensitive information due to the cleartext transmission of data.
- 8.7 High severity
XPON ONU Wi-Fi Router (DG-GR6821AC): Cleartext Transmission of Sensitive Information
This vulnerability exists in Digisol DG-GR6821AC Router due to cleartext transmission of credentials in its web management interface. A remote attacker could exploit this vulnerability by intercepting the network traffic and capturing cleartext credentials. Su
- 10.0 Critical severity
ATA-AOF Mobile Application: Cleartext Transmission of Sensitive Information
Cleartext Transmission of Sensitive Information, Use of Hard-coded Credentials vulnerability in Ataturk University ATA-AOF Mobile Application allows Authentication Abuse, Authentication Bypass. This issue affects ATA-AOF Mobile Application: before 20.06.2025.
- 9.8 Critical severity
Coros Pace 3 Firmware: Cleartext Transmission of Sensitive Information
An issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a WLAN. With WLAN access, the COROS Pace 3 downloads firmware files via HTTP. However, the communication is not encrypted and allows sniffing and
- 9.8 Critical severity
Cloudclassroom-php Project: Cleartext Transmission of Sensitive Information
CloudClassroom-PHP-Project v1.0 is affected by an insecure credential transmission vulnerability. The application transmits passwords over unencrypted HTTP during the login process, exposing sensitive credentials to potential interception by network-based atta
- 7.5 High severity
SICK Media Server: Cleartext Transmission of Sensitive Information
The server supports authentication methods in which credentials are sent in plaintext over unencrypted channels. If an attacker were to intercept traffic between a client and this server, the credentials would be exposed.
- 7.5 High severity
SICK Media Server: Cleartext Transmission of Sensitive Information
All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver. This leads to the possibility of information gathering and downloading media files.
- 7.5 High severity
Firefox: Cleartext Transmission of Sensitive Information
In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled. This vulnerability was fixed in Firefox 139 and Thunderbird 139.
- 9.1 Critical severity
CloudVision Portal: Cleartext Transmission of Sensitive Information
On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan tunnels in the clear.
- 10.0 Critical severity
Automate VX: Cleartext Transmission of Sensitive Information
Cleartext Transmission of Sensitive Information vulnerability in Crestron Automate VX allows Sniffing Network Traffic. The device allows Web UI and API access over non-secure network ports which exposes sensitive information such as user passwords. This issue
- 8.7 High severity
KYC solutions: Cleartext Transmission of Sensitive Information
This vulnerability exists in the Meon KYC solutions due to transmission of sensitive data in plain text within the response payloads of certain API endpoints. An authenticated remote attacker could exploit this vulnerability by intercepting API response that c
- 7.5 High severity
saTECH BCU: Cleartext Transmission of Sensitive Information
SaTECH BCU in its firmware version 2.1.3 uses the HTTP protocol. The use of the HTTP protocol for web browsing has the problem that information is exchanged in unencrypted text. Since sensitive data such as credentials are exchanged, an attacker could obtain t
- 9.0 Critical severity
SecHard: Cleartext Transmission of Sensitive Information
Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in Sechard Information Technologies SecHard allows Authentication Bypass, Interface Manipulation, Authentication Abuse, Harves
- 7.5 High severity
phpipam/phpipam: Cleartext Transmission of Sensitive Information
In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set. This could cause the user agent to send those cookies in plaintext over an HTTP session, potentially exposing sensitive information. The issue is fixed i
- 7.3 High severity
iOS and iPadOS: Cleartext Transmission of Sensitive Information
This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in iOS 18.2 and iPadOS 18.2. A user in a privileged network position may be able to leak sensitive information.
- 7.5 High severity
SICK DL100-2xxxxxxx: Cleartext Transmission of Sensitive Information
The device uses an unencrypted, proprietary protocol for communication. Through this protocol, configuration data is transmitted and device authentication is performed. An attacker can thereby intercept the authentication hash and use it to log into the device
- 7.5 High severity
BOX v1: Cleartext Transmission of Sensitive Information
Bitdefender Box, versions 1.3.11.490 through 1.3.11.505, uses the insecure HTTP protocol to download assets over the Internet to update and restart daemons and detection rules on the devices. Updates can be remotely triggered through the /set_temp_token API me
- 7.5 High severity
Brocade Fabric OS: Cleartext Transmission of Sensitive Information
If Brocade Fabric OS before Fabric OS 9.2.0 configuration settings are not set to encrypt SNMP passwords, then the SNMP privsecret / authsecret fields can be exposed in plaintext. The plaintext passwords can be exposed in a configupload capture or a supportsav
- 7.5 High severity
ASCO 5310 Single-Channel Remote Annunciator: Cleartext Transmission of Sensitive Information
CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists that could result in the exposure of data when network traffic is being sniffed by an attacker.
- 7.5 High severity
Security Verify Access Appliance: Cleartext Transmission of Sensitive Information
IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
- 8.1 High severity
HPE Aruba Networking ClearPass Policy Manager: Cleartext Transmission of Sensitive Information
A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information. Exploiting this vulnerability could allow an attacker to perform a man-in-the-middle attack, potentially granting unaut
- 8.7 High severity
PowerFlex 755: Cleartext Transmission of Sensitive Information
A Credential Exposure Vulnerability exists in the above-mentioned product and version. The vulnerability is due to using HTTP resulting in credentials being sent in clear text.
- 8.6 High severity
Remote Access Server (RAS): Cleartext Transmission of Sensitive Information
All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 expose clear text credentials in the web portal. An attacker can access the ETIC RAS web portal and view the HTML code, which is configured to be hidden, thus allowing a connection to the E
- 7.5 High severity
DRYiCE MyXalytics: Cleartext Transmission of Sensitive Information
HCL MyXalytics is affected by a cleartext transmission of sensitive information vulnerability. The application transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
- 7.5 High severity
Security Guardium Key Lifecycle Manager: Cleartext Transmission of Sensitive Information
IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information in cleartext in a communication channel that can be sniffed by unauthorized actors.
- 7.5 High severity
Splunk Enterprise: Cleartext Transmission of Sensitive Information
In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.3.2408.101, 9.2.2406.106, 9.2.2403.111, and 9.1.2312.206, an SPL command can potentially disclose sensitive information. The vulnerability requires the explo
- 8.1 High severity
ASPECT-Enterprise: Cleartext Transmission of Sensitive Information
Web browser interface may manipulate application username/password in clear text or Base64 encoding providing a higher probability of unintended credentails exposure. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.
- 9.3 Critical severity
Life2000 Ventilation System: Cleartext Transmission of Sensitive Information
Improper data protection on the ventilator's serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance.