Skip to content
BackEsc
Sign in

CWE-319 · weakness in Cryptography

Cleartext Transmission of Sensitive Information

881 CVEs

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

check available
3
likely to be exploited
5

Every one of the 881 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. WyreStorm Apollo VX20 - Information DisclosureCVE-2024-25735Wyrestorm · CVSS 9.1 · 51% likely
  2. NETGEAR DGN2200 / DGND3700 - Admin Password DisclosureCVE-2016-5649Netgear · 24% likely

    NETGEAR

  3. OptinMonster Plugin < 2.6.5 - Unprotected REST-APICVE-2021-39341OptinMonster · CVSS 8.2 · 22% likely
  4. An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account (which is a low privilege account) access, an attacker can inte…CVE-2018-1271077% likely
  5. A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of usi…CVE-2022-43551https://github.com/curl/curl · CVSS 7.5 · 17% likely
  6. An issue was discovered in vTech VCS754 version 1.1.1.A before 1.1.1.H, allows attackers to gain escalated privileges and gain sensitive information due to cleartext passwords pas…CVE-2023-25437Vtech · CVSS 8.8 · 14% likely
  7. When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unaut…CVE-2018-1297Apache Software Foundation · 12% likely

    Apache

  8. The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a MitM attack. While the…CVE-2021-4084710% likely
  9. Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 send cleartext passw…CVE-2017-63418.9% likely
  10. IBM API Connect 5.0.0.0 through 5.0.8.6 could allow an unauthorized user to obtain sensitive information about the system users using specially crafted HTTP requests. IBM X-Force…CVE-2019-4382IBM · CVSS 5.3 · 7.8% likely

    IBM

  11. Druide Antidote through 9.5.1 on Windows and Linux allows remote code execution through the update mechanism by leveraging use of HTTP to download installation packages.CVE-2018-131406.6% likely
  12. Cleartext transmission of sensitive information in Agora Video SDK prior to 3.1 allows a remote attacker to obtain access to audio and video of any ongoing Agora video call throug…CVE-2020-256056.3% likely
  13. EMC Dantz Retrospect Backup Client 7.5.116 sends the password hash in cleartext at an unspecified point, which allows remote attackers to obtain sensitive information via a crafte…CVE-2008-32895.2% likely
  14. In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can b…CVE-2023-32784Keepass · CVSS 7.5 · 4.4% likely
  15. Grand MA 300 allows retrieval of the access PIN from sniffed data.CVE-2014-53804.3% likely
  16. When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on tha…CVE-2019-12399Apache · 3.9% likely

    Apache

  17. TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to use the HTTP protocol for authentication into the admin interface, allowing attackers to intercept user credentials via pa…CVE-2021-457353.8% likely
  18. Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to eavesdrop and tamper with updates by leveraging unencrypted communications with update servers.CVE-2017-90353.6% likely
  19. An issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur because the password-reset feature discloses the verification token. Upon a getveri…CVE-2020-149303.4% likely
  20. The Cisco Linksys WVC54GC wireless video camera before firmware 1.25 sends cleartext configuration data in response to a Setup Wizard remote-management command, which allows remot…CVE-2008-43903.3% likely
  21. LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) use cleartext HTTP for login.CVE-2023-46382Loytec · 3.1% likely

    Loytec

  22. LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) send password-change requests via cleartext HTTP.CVE-2023-46380Loytec · CVSS 7.5 · 3.1% likely

    Loytec

  23. UPNP Service listening on port 5555 in Genexis Platinum 4410 Router V2.1 (P4410-V2–1.34H) has an action 'X_GetAccess' which leaks the credentials of 'admin', provided that the att…CVE-2020-259883.1% likely
  24. An information disclosure vulnerability exists in the Web Manager and telnet CLI functionality of Lantronix XPort EDGE 3.0.0.0R11, 3.1.0.0R9, 3.4.0.0R12 and 4.2.0.0R7. A specially…CVE-2020-13528Lantronix · CVSS 3.1 · 3.0% likely
  25. Video Insight VMS versions prior to 7.8 allows a remote attacker to execute arbitrary code with the system user privilege by sending a specially crafted request.CVE-2021-20623Panasonic Corporation · 2.9% likely

    Panasonic

  26. An information disclosure vulnerability exists in Visual Studio Code Live Share Extension when it exposes tokens in plain text, aka 'Visual Studio Code Live Share Information Disc…CVE-2020-1343Microsoft · 2.9% likely

    Microsoft

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in