CWE-311 · Cryptography
Missing Encryption of Sensitive Data
461CVEs
1exploited
1with a public check
0likely (EPSS 10%+)
SortMost likely exploited
461 CVEs with CWE-311 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-34486In CISA KEVExploitedApache Tomcat Tribes EncryptInterceptor Bypass - Remote Code ExecutionApache Software Foundation · Apache Tomcat · CVSS 7.5 · 2026-04-09 | 7.5 | 99% | 2026-04-09 |
| CVE-2026-27944CheckNginx UI < 2.3.3 - Information Disclosure0xJacky · nginx-ui · CVSS 9.8 · 2026-03-05 | 9.8 | 23% | 2026-03-05 |
| CVE-2019-11367An issue was discovered in AUO Solar Data Recorder before 1.3.0. The web portal uses HTTP Basic Authentication and provides the account and password in the WWW-Authenticate attrib…Auo · Solar Data Recorder · 2019-06-03 | – | 2.8% | 2019-06-03 |
| CVE-2017-8221Wireless IP Camera (P2P) WIFICAM devices rely on a cleartext UDP tunnel protocol (aka the Cloud feature) for communication between an Android application and a camera device, whic…Wificam · Wireless Ip Camera (p2p) Firmware · 2017-04-25 | – | 2.7% | 2017-04-25 |
| CVE-2018-10698An issue was discovered on Moxa AWK-3121 1.14 devices. The device enables an unencrypted TELNET service by default. This allows an attacker who has been able to gain an MITM posit…Moxa · Awk-3121 Firmware · 2019-06-07 | – | 2.3% | 2019-06-07 |
| CVE-2016-10593ibapi is an Interactive Brokers API addon for NodeJS. ibapi downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. Before 2.5.6, it may be possible to c…HackerOne · ibapi node module · 2018-05-29 | – | 2.3% | 2018-05-29 |
| CVE-2017-16003windows-build-tools is a module for installing C++ Build Tools for Windows using npm. windows-build-tools versions below 1.0.0 download resources over HTTP, which leaves it vulner…HackerOne · windows-build-tools node module · 2018-05-29 | – | 2.2% | 2018-05-29 |
| CVE-2016-10663wixtoolset is a Node module wrapper around the wixtoolset binaries wixtoolset downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible…HackerOne · wixtoolset node module · 2018-06-04 | – | 2.2% | 2018-06-04 |
| CVE-2016-10665herbivore is a packet sniffing and crafting library. Built on libtins herbivore 0.0.3 and below download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It…HackerOne · herbivore node module · 2018-06-04 | – | 2.1% | 2018-06-04 |
| CVE-2019-0307Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP Secure Storage file whic…SAP SE · SAP Solution Manager(Diagnostics Agent) · 2019-06-12 | – | 2.1% | 2019-06-12 |
| CVE-2018-1340Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. This cookie lacked the "secure" flag, which could allow an attacker eavesdroppi…Apache Software Foundation · Apache Guacamole · 2019-02-07 | – | 2.0% | 2019-02-07 |
| CVE-2016-10694alto-saxophone is a module to install and launch Chromedriver for Mac, Linux or Windows. alto-saxophone versions below 2.25.1 download binary resources over HTTP, which leaves it…HackerOne · alto-saxophone node module · 2018-06-04 | – | 2.0% | 2018-06-04 |
| CVE-2016-10686fis-sass-all is another libsass wrapper for node. fis-sass-all downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote…HackerOne · fis-sass-all node module · 2018-06-04 | – | 2.0% | 2018-06-04 |
| CVE-2016-10649frames-compiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the reque…HackerOne · frames-compiler node module · 2018-06-04 | – | 2.0% | 2018-06-04 |
| CVE-2016-10642cmake installs the cmake x86 linux binaries. cmake downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execut…HackerOne · cmake node module · 2018-06-04 | – | 2.0% | 2018-06-04 |
| CVE-2016-10628selenium-wrapper is a selenium server wrapper, including installation and chrome webdriver. selenium-wrapper downloads binary resources over HTTP, which leaves it vulnerable to MI…HackerOne · selenium-wrapper node module · 2018-06-01 | – | 2.0% | 2018-06-01 |
| CVE-2016-10624selenium-chromedriver is a simple utility for downloading the Selenium Webdriver for Google Chrome selenium-chromedriver downloads binary resources over HTTP, which leaves it vuln…HackerOne · selenium-chromedriver node module · 2018-06-01 | – | 2.0% | 2018-06-01 |
| CVE-2016-10604dalek-browser-chrome is Google Chrome bindings for DalekJS. dalek-browser-chrome downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possib…HackerOne · dalek-browser-chrome node module · 2018-06-01 | – | 2.0% | 2018-06-01 |
| CVE-2016-10600webrtc-native uses WebRTC from chromium project. webrtc-native downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote…HackerOne · webrtc-native node module · 2018-06-01 | – | 2.0% | 2018-06-01 |
| CVE-2016-10573baryton-saxophone is a module to install and launch Selenium Server for Mac, Linux and Windows. baryton-saxophone versions below 3.0.1 download binary resources over HTTP, which l…HackerOne · baryton-saxophone node module · 2018-05-29 | – | 2.0% | 2018-05-29 |
| CVE-2016-10584dalek-browser-chrome-canary provides Google Chrome bindings for DalekJS. dalek-browser-chrome-canary downloads binary resources over HTTP, which leaves it vulnerable to MITM attac…HackerOne · dalek-browser-chrome-canary node module · 2018-05-29 | – | 2.0% | 2018-05-29 |
| CVE-2016-10622nodeschnaps is a NodeJS compatibility layer for Java (Rhino). nodeschnaps downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to c…HackerOne · nodeschnaps node module · 2018-06-01 | – | 2.0% | 2018-06-01 |
| CVE-2018-1683IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by the failure to encrypt ORB communication. IBM X-Force ID: 145455.IBM · WebSphere Application Server · CVSS 5.9 · 2018-09-26 | 5.9 | 2.0% | 2018-09-26 |
| CVE-2016-10679selenium-standalone-painful installs a start-selenium command line to start a standalone selenium server with chrome-driver. selenium-standalone-painful downloads binary resources…HackerOne · selenium-standalone-painful node module · 2018-05-29 | – | 2.0% | 2018-05-29 |
| CVE-2016-10675libsbmlsim is a module that installs linux binaries for libsbmlsim libsbmlsim downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible…HackerOne · libsbmlsim node module · 2018-06-04 | – | 2.0% | 2018-06-04 |
| CVE-2016-10668libsbml is a module that installs Linux binaries for libSBML libsbml downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote…HackerOne · libsbml node module · 2018-06-04 | – | 2.0% | 2018-06-04 |
| CVE-2016-10609chromedriver126 is chromedriver version 1.26 for linux OS. chromedriver126 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to…HackerOne · chromedriver126 node module · 2018-06-01 | – | 2.0% | 2018-06-01 |
| CVE-2018-5162Plaintext of decrypted emails can leak through the src attribute of remote images, or links. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8.Mozilla · Thunderbird ESR · 2018-06-11 | – | 1.9% | 2018-06-11 |
| CVE-2016-10588nw is an installer for nw.js. nw downloads zipped resources over HTTP, It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attac…HackerOne · nw node module · 2018-06-01 | – | 1.7% | 2018-06-01 |
| CVE-2016-10698mystem-fix is a node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem-fix downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It ma…HackerOne · mystem-fix node module · 2018-05-29 | – | 1.7% | 2018-05-29 |
| CVE-2016-10697react-native-baidu-voice-synthesizer is a baidu voice speech synthesizer for react native. react-native-baidu-voice-synthesizer downloads resources over HTTP, which leaves it vuln…HackerOne · react-native-baidu-voice-synthesizer node module · 2018-06-04 | – | 1.7% | 2018-06-04 |
| CVE-2016-10695The npm-test-sqlite3-trunk module provides asynchronous, non-blocking SQLite3 bindings. npm-test-sqlite3-trunk downloads binary resources over HTTP, which leaves it vulnerable to…HackerOne · npm-test-sqlite3-trunk node module · 2018-06-04 | – | 1.7% | 2018-06-04 |
| CVE-2016-10693pm2-kafka is a PM2 module that installs and runs a kafka server pm2-kafka downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to c…HackerOne · pm2-kafka node module · 2018-06-04 | – | 1.7% | 2018-06-04 |
| CVE-2016-10687windows-selenium-chromedriver is a module that downloads the Selenium Jar file. windows-selenium-chromedriver downloads binary resources over HTTP, which leaves it vulnerable to M…HackerOne · windows-selenium-chromedriver node module · 2018-06-04 | – | 1.7% | 2018-06-04 |
| CVE-2016-10684healthcenter - IBM Monitoring and Diagnostic Tools health Center agent healthcenter downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be pos…HackerOne · healthcenter node module · 2018-06-04 | – | 1.7% | 2018-06-04 |
| CVE-2016-10681roslib-socketio - The standard ROS Javascript Library fork for add support to socket.io roslib-socketio downloads binary resources over HTTP, which leaves it vulnerable to MITM at…HackerOne · roslib-socketio node module · 2018-05-29 | – | 1.7% | 2018-05-29 |
| CVE-2016-10677google-closure-tools-latest is a Node.js module wrapper for downloading the latest version of the Google Closure tools google-closure-tools-latest downloads binary resources over…HackerOne · google-closure-tools-latest node module · 2018-06-04 | – | 1.7% | 2018-06-04 |
| CVE-2016-10676rs-brightcove is a wrapper around brightcove's web api rs-brightcove downloads source file resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to c…HackerOne · rs-brightcove node module · 2018-06-04 | – | 1.7% | 2018-06-04 |
| CVE-2016-10667selenium-portal is a Selenium Testing Framework selenium-portal downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remot…HackerOne · selenium-portal node module · 2018-06-04 | – | 1.7% | 2018-06-04 |
| CVE-2016-10661phantomjs-cheniu is a Headless WebKit with JS API phantomjs-cheniu downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause re…HackerOne · phantomjs-cheniu node module · 2018-06-04 | – | 1.7% | 2018-06-04 |
| CVE-2016-10659poco - The POCO libraries, downloads source file resources used for compilation over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code exec…HackerOne · poco node module · 2018-05-29 | – | 1.7% | 2018-05-29 |
| CVE-2016-10655The clang-extra module installs LLVM's clang-extra tools. clang-extra downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause…HackerOne · clang-extra node module · 2018-06-04 | – | 1.7% | 2018-06-04 |
| CVE-2016-10653xd-testing is a testing library for cross-device (XD) web applications. xd-testing downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be poss…HackerOne · xd-testing node module · 2018-06-04 | – | 1.7% | 2018-06-04 |
| CVE-2016-10650ntfserver is a Network Testing Framework Server. ntfserver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote cod…HackerOne · ntfserver node module · 2018-05-29 | – | 1.7% | 2018-05-29 |
| CVE-2016-10648marionette-socket-host is a marionette-js-runner host for sending actions over a socket. marionette-socket-host downloads binary resources over HTTP, which leaves it vulnerable to…HackerOne · marionette-socket-host node module · 2018-06-04 | – | 1.7% | 2018-06-04 |
| CVE-2016-10647node-air-sdk is an AIR SDK for nodejs. node-air-sdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execu…HackerOne · node-air-sdk node module · 2018-06-04 | – | 1.7% | 2018-06-04 |
| CVE-2016-10644slimerjs-edge is a npm wrapper for installing the bleeding edge version of slimerjs. slimerjs-edge downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks…HackerOne · slimerjs-edge node module · 2018-06-04 | – | 1.7% | 2018-06-04 |
| CVE-2016-10640node-thulac is a node binding for thulac. node-thulac downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code exe…HackerOne · node-thulac node module · 2018-06-04 | – | 1.7% | 2018-06-04 |
| CVE-2016-10639redis-srvr is a npm wrapper for redis-server. redis-srvr downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code…HackerOne · redis-srvr node module · 2018-06-04 | – | 1.7% | 2018-06-04 |
| CVE-2016-10637haxe-dev is a cross-platform toolkit. haxe-dev downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution…HackerOne · haxe-dev node module · 2018-06-04 | – | 1.7% | 2018-06-04 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.