CWE-319 · Cryptography
Cleartext Transmission of Sensitive Information
881CVEs
0exploited
3with a public check
5likely (EPSS 10%+)
SortMost likely exploited
881 CVEs with CWE-319 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-25735CheckWyreStorm Apollo VX20 - Information DisclosureWyrestorm · Apollo Vx20 Firmware · CVSS 9.1 · 2024-03-27 | 9.1 | 51% | 2024-03-27 |
| CVE-2016-5649CheckNETGEAR DGN2200 / DGND3700 - Admin Password DisclosureNetgear · DGN2200 · 2018-07-24 | – | 24% | 2018-07-24 |
| CVE-2021-39341CheckOptinMonster Plugin < 2.6.5 - Unprotected REST-APIOptinMonster · OptinMonster · CVSS 8.2 · 2021-11-01 | 8.2 | 22% | 2021-11-01 |
| CVE-2018-12710An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account (which is a low privilege account) access, an attacker can inte…Dlink · Dir-601 Firmware · 2018-08-29 | – | 77% | 2018-08-29 |
| CVE-2022-43551A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of usi…Haxx · https://github.com/curl/curl · CVSS 7.5 · 2022-12-23 | 7.5 | 17% | 2022-12-23 |
| CVE-2023-25437An issue was discovered in vTech VCS754 version 1.1.1.A before 1.1.1.H, allows attackers to gain escalated privileges and gain sensitive information due to cleartext passwords pas…Vtech · Vcs754a Firmware · CVSS 8.8 · 2023-04-27 | 8.8 | 14% | 2023-04-27 |
| CVE-2018-1297When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unaut…Apache Software Foundation · Apache JMeter · 2018-02-13 | – | 12% | 2018-02-13 |
| CVE-2021-40847The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a MitM attack. While the…Netgear · R6400v2 Firmware · 2021-09-21 | – | 10% | 2021-09-21 |
| CVE-2017-6341Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 send cleartext passw…Dahuasecurity · Camera Firmware · 2017-02-27 | – | 8.9% | 2017-02-27 |
| CVE-2019-4382IBM API Connect 5.0.0.0 through 5.0.8.6 could allow an unauthorized user to obtain sensitive information about the system users using specially crafted HTTP requests. IBM X-Force…IBM · API Connect · CVSS 5.3 · 2019-06-25 | 5.3 | 7.8% | 2019-06-25 |
| CVE-2018-13140Druide Antidote through 9.5.1 on Windows and Linux allows remote code execution through the update mechanism by leveraging use of HTTP to download installation packages.Druide · Antidote 9 · 2018-09-24 | – | 6.6% | 2018-09-24 |
| CVE-2020-25605Cleartext transmission of sensitive information in Agora Video SDK prior to 3.1 allows a remote attacker to obtain access to audio and video of any ongoing Agora video call throug…Agora · Video Software Development Kit · 2021-02-17 | – | 6.3% | 2021-02-17 |
| CVE-2008-3289EMC Dantz Retrospect Backup Client 7.5.116 sends the password hash in cleartext at an unspecified point, which allows remote attackers to obtain sensitive information via a crafte…Storcentric · Retrospect Backup Client · 2008-07-24 | – | 5.2% | 2008-07-24 |
| CVE-2023-32784In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can b…Keepass · Keepass · CVSS 7.5 · 2023-05-15 | 7.5 | 4.4% | 2023-05-15 |
| CVE-2014-5380Grand MA 300 allows retrieval of the access PIN from sniffed data.Granding · Grand Ma300 Firmware · 2020-01-13 | – | 4.3% | 2020-01-13 |
| CVE-2019-12399When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on tha…Apache · Kafka · 2020-01-14 | – | 3.9% | 2020-01-14 |
| CVE-2021-45735TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to use the HTTP protocol for authentication into the admin interface, allowing attackers to intercept user credentials via pa…Totolink · X5000r Firmware · 2022-02-04 | – | 3.8% | 2022-02-04 |
| CVE-2017-9035Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to eavesdrop and tamper with updates by leveraging unencrypted communications with update servers.Trendmicro · Serverprotect · 2017-05-25 | – | 3.6% | 2017-05-25 |
| CVE-2020-14930An issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur because the password-reset feature discloses the verification token. Upon a getveri…Bt Ctroms Terminal Project · Bt Ctroms Terminal · 2020-06-19 | – | 3.4% | 2020-06-19 |
| CVE-2008-4390The Cisco Linksys WVC54GC wireless video camera before firmware 1.25 sends cleartext configuration data in response to a Setup Wizard remote-management command, which allows remot…Cisco · Linksys Wvc54gc Firmware · 2008-12-09 | – | 3.3% | 2008-12-09 |
| CVE-2023-46382LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) use cleartext HTTP for login.Loytec · Linx-212 Firmware · 2023-11-04 | – | 3.1% | 2023-11-04 |
| CVE-2023-46380LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) send password-change requests via cleartext HTTP.Loytec · Linx-212 Firmware · CVSS 7.5 · 2023-11-04 | 7.5 | 3.1% | 2023-11-04 |
| CVE-2020-25988UPNP Service listening on port 5555 in Genexis Platinum 4410 Router V2.1 (P4410-V2–1.34H) has an action 'X_GetAccess' which leaks the credentials of 'admin', provided that the att…Genexis · Platinum 4410 Firmware · 2020-11-17 | – | 3.1% | 2020-11-17 |
| CVE-2020-13528An information disclosure vulnerability exists in the Web Manager and telnet CLI functionality of Lantronix XPort EDGE 3.0.0.0R11, 3.1.0.0R9, 3.4.0.0R12 and 4.2.0.0R7. A specially…Lantronix · Lantronix · CVSS 3.1 · 2020-12-17 | 3.1 | 3.0% | 2020-12-17 |
| CVE-2021-20623Video Insight VMS versions prior to 7.8 allows a remote attacker to execute arbitrary code with the system user privilege by sending a specially crafted request.Panasonic Corporation · Video Insight VMS · 2021-02-05 | – | 2.9% | 2021-02-05 |
| CVE-2020-1343An information disclosure vulnerability exists in Visual Studio Code Live Share Extension when it exposes tokens in plain text, aka 'Visual Studio Code Live Share Information Disc…Microsoft · Microsoft Visual Studio Code Live Share extension · 2020-06-09 | – | 2.9% | 2020-06-09 |
| CVE-2005-2069pam_ldap and nss_ldap, when used with OpenLDAP and connecting to a slave using TLS, does not use TLS for the subsequent connection if the client is referred to a master, which may…Padl · Nss Ldap · 2005-06-29 | – | 2.8% | 2005-06-29 |
| CVE-2016-5638Netgear WNDR4500 running firmware version V1.0.1.40_1.0.6877 reveals some sensitive information such as 2.4GHz & 5GHz Wireless Network Name (SSID) and Network Key (Password) in cl…Netgear · WNDR4500 · 2018-07-24 | – | 2.7% | 2018-07-24 |
| CVE-2022-42916In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using…Haxx · Curl · CVSS 7.5 · 2022-10-29 | 7.5 | 2.5% | 2022-10-29 |
| CVE-2020-7984SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain admin credentials from the Agent & Probe settings, and obtain…Solarwinds · N-Central · 2020-01-26 | – | 2.5% | 2020-01-26 |
| CVE-2020-25645A flaw was found in the Linux kernel in versions before 5.9-rc7. Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specif…Linux · kernel · 2020-10-13 | – | 2.4% | 2020-10-13 |
| CVE-2022-36200In FiberHome VDSL2 Modem HG150-Ub_V3.0, Credentials of Admin are submitted in URL, which can be logged/sniffed.Fiberhome · Hg150-Ub Firmware · 2022-08-29 | – | 2.3% | 2022-08-29 |
| CVE-2020-14093Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response.Mutt · Mutt · 2020-06-15 | – | 2.1% | 2020-06-15 |
| CVE-2019-0231Apache MINA SSLFilter security IssueApache Software Foundation · Apache MINA · 2019-10-01 | – | 2.1% | 2019-10-01 |
| CVE-2008-0374OKI C5510MFP Printer CU H2.15, PU 01.03.01, System F/W 1.01, and Web Page 1.00 sends the configuration of the printer in cleartext, which allows remote attackers to obtain the adm…Oki · C5510mfp Firmware · 2008-01-22 | – | 2.1% | 2008-01-22 |
| CVE-2019-15135The handshake protocol in Object Management Group (OMG) DDS Security 1.1 sends cleartext information about all of the capabilities of a participant (including capabilities inappli…Omg · Dds Security · 2019-08-18 | – | 2.0% | 2019-08-18 |
| CVE-2021-22923When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequ…Haxx · https://github.com/curl/curl · 2021-08-05 | – | 2.0% | 2021-08-05 |
| CVE-2019-12504Due to unencrypted and unauthenticated data communication, the wireless presenter Inateck WP2002 is prone to keystroke injection attacks. Thus, an attacker is able to send arbitra…Inateck · Wp2002 Firmware · 2019-06-07 | – | 1.9% | 2019-06-07 |
| CVE-2019-15635An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana (e.g., MySQL) are not encrypted. An admin user can reveal passwords for any data source by pre…Grafana · Grafana · 2019-09-23 | – | 1.9% | 2019-09-23 |
| CVE-2005-3140Procom NetFORCE 800 4.02 M10 Build 20 and possibly other versions sends the NIS password map (passwd.nis) as a file attachment in diagnostic e-mail messages, which allows remote a…Procom · Netforce 800 Firmware · 2005-10-05 | – | 1.9% | 2005-10-05 |
| CVE-2022-21829Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing…Concretecms · https://github.com/concrete5/concrete5 · 2022-06-24 | – | 1.8% | 2022-06-24 |
| CVE-2019-17393The Customer's Tomedo Server in Version 1.7.3 communicates to the Vendor Tomedo Server via HTTP (in cleartext) that can be sniffed by unauthorized actors. Basic authentication is…Tomedo · Server · 2019-10-18 | – | 1.8% | 2019-10-18 |
| CVE-2018-4227An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. The issue involves the "Mail" component. It allows remote attacke…Apple · Iphone Os · 2018-06-08 | – | 1.8% | 2018-06-08 |
| CVE-2019-15626The Deep Security Manager application (Versions 10.0, 11.0 and 12.0), when configured in a certain way, may transmit initial LDAP communication in clear text. This may result in c…Trend Micro · Deep Security Manager · 2019-10-17 | – | 1.8% | 2019-10-17 |
| CVE-2019-12781An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SEC…Djangoproject · Django · 2019-07-01 | – | 1.7% | 2019-07-01 |
| CVE-2020-25178Rockwell Automation ISaGRAF5 Runtime Cleartext Transmission of Sensitive InformationRockwell Automation · ISaGRAF Runtime · CVSS 7.5 · 2022-03-18 | 7.5 | 1.7% | 2022-03-18 |
| CVE-2020-0884A spoofing vulnerability exists in Microsoft Visual Studio as it includes a reply URL that is not secured by SSL, aka 'Microsoft Visual Studio Spoofing Vulnerability'.Microsoft · Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8) · 2020-03-12 | – | 1.7% | 2020-03-12 |
| CVE-2019-18800Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber account, because not all Viber protocol traffic is encrypted. TCP…Rakuten · Viber · 2019-11-06 | – | 1.7% | 2019-11-06 |
| CVE-2019-18852Certain D-Link devices have a hardcoded Alphanetworks user account with TELNET access because of /etc/config/image_sign or /etc/alpha_config/image_sign. This affects DIR-600 B1 V2…Dlink · Dir-600 B1 Firmware · 2019-11-11 | – | 1.6% | 2019-11-11 |
| CVE-2019-10926A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6). Communication with the device is not encrypted. Data transmitted between the device and the us…Siemens · SIMATIC MV400 family · 2019-06-12 | – | 1.5% | 2019-06-12 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.