CWE-319— Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.— MITRE CWE catalog

1,010 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-319page 18 of 21

CVE-2020-2143MEDIUMCVSS 5.3EG 5.3
2020-03-09
Jenkins Logstash Plugin 2.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
CVE-2020-8506MEDIUMCVSS 5.3EG 5.3
2020-02-05
The Global TV application 2.3.2 for Android and 4.7.5 for iOS sends Unencrypted Analytics.
CVE-2019-16568MEDIUMCVSS 5.3EG 5.3
2019-12-17
Jenkins SCTMExecutor Plugin 2.2 and earlier transmits previously configured service credentials in plain text as part of the global configuration, as well as individual jobs' configurations.
CVE-2019-19251MEDIUMCVSS 5.3EG 5.3
2019-12-10
The Last.fm desktop app (Last.fm Scrobbler) through 2.1.39 on macOS makes HTTP requests that include an API key without the use of SSL/TLS. Although there is an Enable SSL option, it is disabled by default, and cleartext requests are made …
CVE-2015-7542MEDIUMCVSS 5.3EG 5.3
2019-12-03
A vulnerability exists in libgwenhywfar through 4.12.0 due to the usage of outdated bundled CA certificates.
CVE-2019-19463MEDIUMCVSS 5.3EG 5.3
2019-11-30
The Anhui Huami Mi Fit application before 4.0.11 for Android has an Unencrypted Update Check.
CVE-2019-4280MEDIUMCVSS 5.3EG 5.3
2019-09-30
IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 displays sensitive information in HTTP requests which could be used in further attacks against the system. IBM X-Force ID: 160503.
CVE-2019-10427MEDIUMCVSS 5.3EG 5.3
2019-09-25
Jenkins Aqua MicroScanner Plugin 1.0.7 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
CVE-2019-5503MEDIUMCVSS 5.3EG 5.3
2019-09-10
OnCommand Workflow Automation versions prior to 5.0 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors.
CVE-2019-6640MEDIUMCVSS 5.3EG 5.3
2019-07-03
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, SNMP exposes sensitive configuration objects over insecure transmission channels. This issue is exposed when a passphrase is in…
CVE-2019-12781MEDIUMCVSS 5.3EG 5.3
2019-07-01
An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects t…
CVE-2019-4382MEDIUMCVSS 5.3EG 5.3
2019-06-25
IBM API Connect 5.0.0.0 through 5.0.8.6 could allow an unauthorized user to obtain sensitive information about the system users using specially crafted HTTP requests. IBM X-Force ID: 162162.
CVE-2019-10926MEDIUMCVSS 5.3EG 5.3
2019-06-12
A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6). Communication with the device is not encrypted. Data transmitted between the device and the user can be obtained by an attacker in a privileged network po…
CVE-2019-6613MEDIUMCVSS 5.3EG 5.3
2019-05-03
On BIG-IP 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, SNMP may expose sensitive configuration objects over insecure transmission channels. This issue is exposed when a passphrase is used with various profile types a…
CVE-2018-19111MEDIUMCVSS 5.3EG 5.3
2018-11-08
The Google Cardboard application 1.8 for Android and 1.2 for iOS sends potentially private cleartext information to the Unity 3D Stats web site, as demonstrated by device make, model, and OS.
CVE-2017-8154MEDIUMCVSS 5.3EG 5.3
2018-04-11
The Themes App Honor 8 Lite Huawei mobile phones with software of versions before Prague-L31C576B172, versions before Prague-L31C530B160, versions before Prague-L31C432B180 has a man-in-the-middle (MITM) vulnerability due to the use of the…
CVE-2017-7147MEDIUMCVSS 5.3EG 5.3
2017-10-23
An issue was discovered in certain Apple products. The Apple Support app before 1.2 for iOS is affected. The issue involves the "Analytics" component. It allows remote attackers to obtain sensitive analytics information by leveraging its p…
CVE-2017-7078MEDIUMCVSS 5.3EG 5.3
2017-10-23
An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. The issue involves the "Mail Drafts" component. It allows remote attackers to obtain sensitive information by reading unintended …
CVE-2017-3305MEDIUMCVSS 5.3EG 5.3
2017-04-24
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: C API). Supported versions that are affected are 5.5.55 and earlier and 5.6.35 and earlier. Difficult to exploit vulnerability allows low privileged attacke…
CVE-2017-3815MEDIUMCVSS 5.3EG 5.3
2017-03-17
An API Privilege vulnerability in Cisco TelePresence Server Software could allow an unauthenticated, remote attacker to emulate Cisco TelePresence Server endpoints. Affected Products: This vulnerability affects Cisco TelePresence Server MS…
CVE-2017-6370MEDIUMCVSS 5.3EG 5.3
2017-03-17
TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fie…
CVE-2007-4786MEDIUMCVSS 5.3EG 5.3
2007-09-10
Cisco Adaptive Security Appliance (ASA) running PIX 7.0 before 7.0.7.1, 7.1 before 7.1.2.61, 7.2 before 7.2.2.34, and 8.0 before 8.0.2.11, when AAA is enabled, composes %ASA-5-111008 messages from the "test aaa" command with cleartext pass…
CVE-2018-10634MEDIUMCVSS 4.8EG 5.3
2018-08-13
Communications between Medtronic MiniMed MMT pumps and wireless accessories are transmitted in cleartext. A sufficiently skilled attacker could capture these transmissions and extract sensitive information, such as device serial numbers.
CVE-2003-5002MEDIUMCVSS 3.7EG 5.3
2022-03-28
A vulnerability was found in ISS BlackICE PC Protection. It has been declared as problematic. Affected by this vulnerability is the component Update Handler which allows cleartext transmission of data. NOTE: This vulnerability only affects…
CVE-2023-23371MEDIUMCVSS 5.2EG 5.2
2023-10-06
A cleartext transmission of sensitive information vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to read sensitive data via unspecified vectors. …
CVE-2026-92832MEDIUMCVSS 5.1EG 5.1
2026-10-12
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to cleartext transmission of sensitive information.
CVE-2011-3022MEDIUMCVSS v2 5.0EG 5.0
2012-02-16
translate/translate_manager.cc in Google Chrome before 17.0.963.56 and 19.x before 19.0.1036.7 uses an HTTP session to exchange data for translation, which allows remote attackers to obtain sensitive information by sniffing the network.
CVE-2005-2069MEDIUMCVSS v2 5.0EG 5.0
2005-06-30
pam_ldap and nss_ldap, when used with OpenLDAP and connecting to a slave using TLS, does not use TLS for the subsequent connection if the client is referred to a master, which may cause a password to be sent in cleartext and allows remote …
CVE-2004-1852MEDIUMCVSS v2 5.0EG 5.0
2004-03-23
DameWare Mini Remote Control 3.x before 3.74 and 4.x before 4.2 transmits the Blowfish encryption key in plaintext, which allows remote attackers to gain sensitive information.
CVE-2024-47269MEDIUMCVSS 4.9EG 4.9
2026-05-27
Cleartext transmission of sensitive information vulnerability in Export Key functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to obtain sensitiv…
CVE-2022-40939MEDIUMCVSS 4.9EG 4.9
2022-12-08
In certain Secustation products the administrator account password can be read. This affects V2.5.5.3116-S50-SMA-B20171107A, V2.3.4.1301-M20-TSA-B20150617A, V2.5.5.3116-S50-RXA-B20180502A, V2.5.5.3116-S50-SMA-B20190723A, V2.5.5.3116-S50-SM…
CVE-2021-25643MEDIUMCVSS 4.9EG 4.9
2021-05-26
An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2. Internal users with administrator privileges, @cbq-engine-cbauth and @index-cbauth, leak credentials in cleartext in the indexer.log file when the…
CVE-2021-3417MEDIUMCVSS 4.9EG 4.9
2021-03-09
An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator (LXCA), if added as a Resource Manager, are encoded then written to an internal LXCO log file each time a ses…
CVE-2020-8356MEDIUMCVSS 4.9EG 4.9
2021-03-09
An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and SMTP forwarders are written to an internal LXCO log file in clear text. Affected logs are captured in …
CVE-2020-8355MEDIUMCVSS 4.9EG 4.9
2021-02-10
An internal product security audit of Lenovo XClarity Administrator (LXCA) prior to version 3.1.0 discovered the Windows OS credentials provided by the LXCA user to perform driver updates of managed systems may be captured in the First Fai…
CVE-2019-15635MEDIUMCVSS 4.9EG 4.9
2019-09-23
An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana (e.g., MySQL) are not encrypted. An admin user can reveal passwords for any data source by pressing the "Save and test" button within a data source's sett…
CVE-2019-10363MEDIUMCVSS 4.9EG 4.9
2019-07-31
Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported in their encrypted form.
CVE-2026-116844MEDIUMCVSS 4.8EG 4.8
2026-10-27
Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PA…
CVE-2026-107692MEDIUMCVSS 4.8EG 4.8
2026-10-20
The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the TCP handshake, using only LZ4 compression rather than encryption. An attacker positioned on the network path can passi…
CVE-2026-53624MEDIUMCVSS 4.8EG 4.8
2026-07-06
Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-Security response header even when HSTSMaxAge is configured because it checks c.…
CVE-2026-41281MEDIUMCVSS 4.8EG 4.8
2026-05-14
Android App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmission of Sensitive Information (CWE-319) vulnerability. A man-in-the-middle attacker may access and modify communications transmitted i…
CVE-2026-33472MEDIUMCVSS 4.8EG 4.8
2026-04-16
Cryptomator is an open-source client-side encryption application for cloud storage. Version 1.19.1 contains a logic flaw in CheckHostTrustController.getAuthority() that allows an attacker to bypass the security fix for CVE-2026-32303. The …
CVE-2020-3442MEDIUMCVSS 4.8EG 4.8
2020-07-20
The DuoConnect client enables users to establish SSH connections to hosts protected by a DNG instance. When a user initiates an SSH connection to a DNG-protected host for the first time using DuoConnect, the user’s browser is opened to a…
CVE-2020-5865MEDIUMCVSS 4.8EG 4.8
2020-04-23
In versions prior to 3.3.0, the NGINX Controller is configured to communicate with its Postgres database server over unencrypted channels, making the communicated data vulnerable to interception via man-in-the-middle (MiTM) attacks.
CVE-2019-3640MEDIUMCVSS 4.8EG 4.8
2019-11-14
Unprotected Transport of Credentials in ePO extension in McAfee Data Loss Prevention 11.x prior to 11.4.0 allows remote attackers with access to the network to collect login details to the LDAP server via the ePO extension not using a secu…
CVE-2025-59448MEDIUMCVSS 4.7EG 4.7
2025-10-06
Components of the YoSmart YoLink ecosystem through 2025-10-02 leverage unencrypted MQTT to communicate over the internet. An attacker with the ability to monitor network traffic could therefore obtain sensitive information or tamper with t…
CVE-2025-57727MEDIUMCVSS 4.7EG 4.7
2025-08-20
In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference
CVE-2025-43704MEDIUMCVSS 4.7EG 4.7
2025-04-16
Arctera/Veritas Data Insight before 7.1.2 can send cleartext credentials when configured to use HTTP Basic Authentication to a Dell Isilon OneFS server.
CVE-2020-7744MEDIUMCVSS 4.7EG 4.7
2020-10-15
This affects all versions of package com.mintegral.msdk:alphab. The Android SDK distributed by the company contains malicious functionality in this module that tracks: 1. Downloads from Google urls either within Google apps or via browser …
CVE-2024-41927MEDIUMCVSS 4.6EG 4.6
2024-09-04
Cleartext transmission of sensitive information vulnerability exists in multiple IDEC PLCs. If an attacker sends a specific command to PLC's serial communication port, user credentials may be obtained. As a result, the program of the PLC m…

Map vulnerabilities like CWE-319 to your infrastructure

EchelonGraph correlates every CVE — across CWE-319 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →