Cleartext Transmission of Sensitive Information
CWE-319
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
We track 226 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.0.
How this weakness is prevented
- Architecture and Design: Before transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic protocols.
- Implementation: When using web applications with SSL, use SSL for the entire session from login to logout, not just for the initial login page.
- Implementation: When designing hardware platforms, ensure that approved encryption algorithms (such as those recommended by NIST) protect paths from security critical data to trusted user applications.
- Testing: Use tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
- Operation: Configure servers to use encrypted channels for communication, which may include SSL or other secure protocols.
Latest Cleartext Transmission of Sensitive Information vulnerabilities
- 8.8 High severity
watcharr: Cleartext Transmission of Sensitive Information
A vulnerability in a weak JWT token in Watcharr v1.43.0 and below allows attackers to perform privilege escalation using a crafted JWT token. This vulnerability is not limited to privilege escalation but also affects all functions that require authentication.
- 7.5 High severity
Acronis Cyber Protect 16: Cleartext Transmission of Sensitive Information
Cleartext transmission of sensitive information in acep-collector service. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690.
- 8.7 High severity
IP Camera D8801: Cleartext Transmission of Sensitive Information
** UNSUPPORTED WHEN ASSIGNED ** This vulnerability exists in D3D Security IP Camera D8801 due to usage of weak authentication scheme of the HTTP header protocol where authorization tag contain a Base-64 encoded username and password. A remote attacker could ex
- 7.5 High severity
AI ChatBot with ChatGPT and Content Generator…: Cleartext Transmission of Sensitive Information
The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 discloses the Open AI API Key, allowing unauthenticated users to obtain it
- 7.8 High severity
Workspace Control: Cleartext Transmission of Sensitive Information
Cleartext transmission of sensitive information in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to obtain OS credentials.
- 7.5 High severity
caterease: Cleartext Transmission of Sensitive Information
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Sniffing Network Traffic attack due to the cleartext transmission of sensitive information.
- 7.4 High severity
immudb: Cleartext Transmission of Sensitive Information
mmudb v1.9.3 was discovered to use the HTTP protocol in the ShowMetricsRaw and ShowMetricsAsText functions, possibly allowing attackers to intercept communications via a man-in-the-middle attack.
- 7.5 High severity
SyroTech SY-GPON-1110-WDONT router: Cleartext Transmission of Sensitive Information
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to transmission of password in plain text. A remote attacker could exploit this vulnerability by intercepting transmission within an HTTP session on the vulnerable system. Successful exploitat
- 7.4 High severity
Toshiba Tec e-Studio multi-function peripheral…: Plaintext Storage of a Password
Coredump binaries in Toshiba printers have incorrect permissions. A local attacker can steal confidential information. As for the affected products/models/versions, see the reference URL.
- 7.5 High severity
SINEC Traffic Analyzer: Cleartext Transmission of Sensitive Information
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server is not enforcing HSTS. This could allow an attacker to perform downgrade attacks exposing confidential information.
- 7.5 High severity
mfa: Cleartext Transmission of Sensitive Information
Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the D
- 7.5 High severity
SkyScraper: Cleartext Transmission of Sensitive Information
SkyScrape is a GUI Dashboard for AWS Infrastructure and Managing Resources and Usage Costs. SkyScrape's API requests are currently unsecured HTTP requests, leading to potential vulnerabilities for the user's temporary credentials and data. This affects version
- 9.6 Critical severity
SIMATIC RTLS Locating Manager: Cleartext Transmission of Sensitive Information
A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SI
- 7.0 High severity
CHARX SEC-3000: Cleartext Transmission of Sensitive Information
An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based management access with the privileges of the currently logged in user due to cleartext transmission of sensitive information. No additional user interaction is
- 8.1 High severity
Red Hat Ansible Automation Platform 2.4 for…: Cleartext Transmission of Sensitive Information
A flaw was found in the ansible automation platform. An insecure WebSocket connection was being used in installation from the Ansible rulebook EDA server. An attacker that has access to any machine in the CIDR block could download all rulebook data from the We
- 7.5 High severity
Brocade SANnav: Cleartext Transmission of Sensitive Information
In Brocade SANnav, before Brocade SANnav v2.3.0, syslog traffic received clear text. This could allow an unauthenticated, remote attacker to capture sensitive information.
- 8.2 High severity
dectalk-tts: Channel Accessible by Non-Endpoint
dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `[email protected]`, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone
- 7.8 High severity
PowerScale OneFS: Cleartext Transmission of Sensitive Information
Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains a cleartext transmission of sensitive information vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges.
- 9.1 Critical severity
apollo_vx20: Cleartext Transmission of Sensitive Information
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext passwords via a SoftAP /device/config GET request.
- 7.5 High severity
edgeConnector: Cleartext Transmission of Sensitive Information
The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker to capture packets to craft their own requests.
- 8.7 High severity
CHARX SEC-3000: Cleartext Transmission of Sensitive Information
An unauthenticated remote attacker can influence the communication due to the lack of encryption of sensitive data via a MITM. Charging is not affected.
- 7.5 High severity
Watson CP4D Data Stores: Cleartext Transmission of Sensitive Information
IBM Watson CP4D Data Stores 4.6.0, 4.6.1, 4.6.2, and 4.6.3 does not encrypt sensitive or critical information before storage or transmission which could allow an attacker to obtain sensitive information. IBM X-Force ID: 248740.
- 8.1 High severity
Automation Studio: Improper Control of Generation of Code
B&R Automation Studio Upgrade Service and B&R Technology Guarding use insufficient cryptography for communication to the upgrade and the licensing servers. A network-based attacker could exploit the vulnerability to execute arbitrary code on the products or sn
- 9.8 Critical severity
ESI (Enterprise Storage Integrator) for SAP LAMA: Cleartext Transmission of Sensitive Information
DELL ESI (Enterprise Storage Integrator) for SAP LAMA, version 10.0, contains an information disclosure vulnerability in EHAC component. An remote unauthenticated attacker could potentially exploit this vulnerability by eavesdropping the network traffic to gai
- 9.8 Critical severity
Security Verify Access Appliance: Cleartext Transmission of Sensitive Information
IBM Security Verify Access 10.0.0.0 through 10.0.6.1 uses insecure protocols in some instances that could allow an attacker on the network to take control of the server. IBM X-Force Id: 254957.
- 7.5 High severity
PowerSC: Cleartext Transmission of Sensitive Information
IBM PowerSC 1.3, 2.0, and 2.1 MFA does not implement the "HTTP Strict Transport Security" (HSTS) web security policy mechanism. IBM X-Force ID: 276004.
- 7.5 High severity
Skyworth Router CM5100: Cleartext Transmission of Sensitive Information
This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to transmission of authentication credentials in plaintext over the network. A remote attacker could exploit this vulnerability by eavesdropping on the victim’s network traffic to extrac
- 7.5 High severity
Skyworth Router CM5100: Cleartext Transmission of Sensitive Information
This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to transmission of authentication credentials in plaintext over the network. A remote attacker could exploit this vulnerability by eavesdropping on the victim’s network traffic to extrac
- 7.5 High severity
Cash Point & Transport Optimizer: Cleartext Transmission of Sensitive Information
An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via transmission of unencrypted, cleartext credentials during Password Reset feature.
- 7.5 High severity
Stormshield Network Security: Cleartext Transmission of Sensitive Information
An issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1. It affects user accounts for which the password has an equals sign or space character. The serverd process logs such password
- 7.5 High severity
journalpump: Cleartext Transmission of Sensitive Information
journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out the configuration of a service integration in plaintext to the supplied logging pipeline, including
- 7.5 High severity
L-inx Configurator: Cleartext Transmission of Sensitive Information
LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. An admin credential is passed as a value of URL parameters without encryption, so it allows remote attackers to steal the password and gain full control of Loytec d
- 7.5 High severity
L-inx Configurator: Cleartext Transmission of Sensitive Information
LOYTEC electronics GmbH LINX Configurator (all versions) uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext and allows remote attackers to steal the password and gain full control of Loytec device configuration.
- 9.8 Critical severity
Syrus4 IoT Telematics Gateway: Improper Control of Generation of Code
The Syrus4 IoT gateway utilizes an unsecured MQTT server to download and execute arbitrary commands, allowing a remote unauthenticated attacker to execute code on any Syrus4 device connected to the cloud service. The MQTT server also leaks the location, video
- 7.5 High severity
COMOS: Cleartext Transmission of Sensitive Information
A vulnerability has been identified in COMOS (All versions < V10.4.4). Caching system in the affected application leaks sensitive information such as user and project information in cleartext via UDP.
- 7.5 High severity
lvis-3me12-a1: Cleartext Transmission of Sensitive Information
LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) send password-change requests via cleartext HTTP.
- 8.8 High severity
ctrlX HMI Web Panel - WR21 (WR2107): Cleartext Transmission of Sensitive Information
The Android Client application, when enrolled with the define method 1 (the user manually inserts the server ip address), use HTTP protocol to retrieve sensitive information (ip address and credentials to connect to a remote MQTT broker entity) instead of HTTP
- 7.5 High severity
Cognos Dashboards on Cloud Pak for Data: Cleartext Transmission of Sensitive Information
IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 exposes sensitive information in environment variables which could aid in further attacks against the system. IBM X-Force ID: 260736.
- 7.5 High severity
Cognos Dashboards on Cloud Pak for Data: Cleartext Transmission of Sensitive Information
IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 exposes sensitive information in container images which could lead to further attacks against the system. IBM X-Force ID: 260730.
- 8.2 High severity
Bently Nevada 3500 System: Cleartext Transmission of Sensitive Information
Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to steal the authentication secret from communication traffic to the device and reuse it for arbitrary requests.