CWE-319— Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.— MITRE CWE catalog
1,010 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-319page 21 of 21
- CVE-2026-25608LOWCVSS 2.3EG 2.32026-05-22
STER uses unencrypted TCP traffic to transmit data over the network. It allows an attacker to conduct a Man-In-The-Middle attack and obtain sensitive data such as passwords, personal data, or authentication tokens. This issue was fixed …
- CVE-2025-61738LOWCVSS 2.3EG 2.32025-12-22
Under certain circumstances, attacker can capture the network key, read or write encrypted packets on the PowerG network.
- CVE-2025-54799LOWCVSS 2.3EG 2.32025-08-07
Let's Encrypt client and ACME library written in Go (Lego). In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package (thus the lego library and the lego cli as well) don't enforce HTTPS when talking to CAs as an ACME c…
- CVE-2026-21812LOWCVSS 2.2EG 2.22026-10-22
HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmission of Sensitive Information vulnerability when configured to communicate with the AppScan server over HTTP. This could allow an attacker to intercept credentials or authe…
- CVE-2025-0250LOWCVSS 2.2EG 2.22025-07-25
HCL IEM is affected by an authorization token sent in cookie vulnerability. A token used for authentication and authorization is being handled in a manner that may increase its exposure to security risks.
- CVE-2024-8013LOWCVSS 2.2EG 2.22024-10-28
A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to the server as plaintext instead of ciphertext. Should this occur, no documents …
- CVE-2026-48978LOWCVSS 2.1EG 2.12026-07-01
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry …
- CVE-2023-45716LOWCVSS 1.7EG 1.72024-02-09
Sametime is impacted by sensitive information passed in URL.
- CVE-2024-42181LOWCVSS 1.6EG 1.62025-01-12
HCL MyXalytics is affected by a cleartext transmission of sensitive information vulnerability. The application transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actor…
- CVE-2026-120734UnratedEG not assessed2026-11-03
Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request tha…
Map vulnerabilities like CWE-319 to your infrastructure
EchelonGraph correlates every CVE — across CWE-319 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →