CWE-319— Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.— MITRE CWE catalog

1,009 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-319page 9 of 21

CVE-2019-19898HIGHCVSS 7.5EG 7.5
2020-01-23
In IXP EasyInstall 6.2.13723, there are cleartext credentials in network communication on TCP port 20050 when using the Administrator console remotely.
CVE-2019-12399HIGHCVSS 7.5EG 7.5
2020-01-14
When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in …
CVE-2014-5380HIGHCVSS 7.5EG 7.5
2020-01-13
Grand MA 300 allows retrieval of the access PIN from sniffed data.
CVE-2019-16274HIGHCVSS 7.5EG 7.5
2020-01-06
DTEN D5 before 1.3 and D7 before 1.3 devices transfer customer data files via unencrypted HTTP.
CVE-2019-19967HIGHCVSS 7.5EG 7.5
2019-12-25
The Administration page on Connect Box EuroDOCSIS 3.0 Voice Gateway CH7465LG-NCIP-6.12.18.25-2p6-NOSH devices accepts a cleartext password in a POST request on port 80, as demonstrated by the Password field to the xml/setter.xml URI.
CVE-2019-19890HIGHCVSS 7.5EG 7.5
2019-12-18
An issue was discovered on Humax Wireless Voice Gateway HGB10R-2 20160817_1855 devices. Admin credentials are sent over cleartext HTTP.
CVE-2019-19889HIGHCVSS 7.5EG 7.5
2019-12-18
An issue was discovered on Humax Wireless Voice Gateway HGB10R-2 20160817_1855 devices. The attacker can discover admin credentials in the backup file, aka backupsettings.conf.
CVE-2019-3992HIGHCVSS 7.5EG 7.5
2019-12-17
ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can access the server's configuration file by sending an HTTP GET request. Amongst the configuration data, the attacker …
CVE-2019-19316HIGHCVSS 7.5EG 7.5
2019-12-02
When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP.
CVE-2019-12388HIGHCVSS 7.5EG 7.5
2019-12-02
Anviz access control devices perform cleartext transmission of sensitive information (passwords/pins and names) when replying to query on port tcp/5010.
CVE-2019-6845HIGHCVSS 7.5EG 7.5
2019-10-29
A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (all firmware versions), which could cause the disclosure of information when transferring app…
CVE-2019-18201HIGHCVSS 7.5EG 7.5
2019-10-24
An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, an attacker is able to eavesdrop on sensitive data such as passwords.
CVE-2019-15626HIGHCVSS 7.5EG 7.5
2019-10-17
The Deep Security Manager application (Versions 10.0, 11.0 and 12.0), when configured in a certain way, may transmit initial LDAP communication in clear text. This may result in confidentiality impact but does not impact integrity or avail…
CVE-2019-0231HIGHCVSS 7.5EG 7.5
2019-10-01
Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should mi…
CVE-2019-10435HIGHCVSS 7.5EG 7.5
2019-10-01
Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.
CVE-2019-10434HIGHCVSS 7.5EG 7.5
2019-10-01
Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
CVE-2019-10428HIGHCVSS 7.5EG 7.5
2019-09-25
Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
CVE-2019-10412HIGHCVSS 7.5EG 7.5
2019-09-25
Jenkins Inedo ProGet Plugin 1.2 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
CVE-2019-10411HIGHCVSS 7.5EG 7.5
2019-09-25
Jenkins Inedo BuildMaster Plugin 2.4.0 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
CVE-2019-5635HIGHCVSS 7.5EG 7.5
2019-08-22
A cleartext transmission of sensitive information vulnerability is present in Hickory Smart Ethernet Bridge from Belwith Products, LLC. Captured data reveals that the Hickory Smart Ethernet Bridge device communicates over the network to an…
CVE-2019-15135HIGHCVSS 7.5EG 7.5
2019-08-18
The handshake protocol in Object Management Group (OMG) DDS Security 1.1 sends cleartext information about all of the capabilities of a participant (including capabilities inapplicable to the current session), which makes it easier for att…
CVE-2019-4162HIGHCVSS 7.5EG 7.5
2019-06-06
IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 is missing the HTTP Strict Transport Security header. Users can navigate by mistake to the unencrypted version of the web application or accept invalid certificates. This leads …
CVE-2019-5496HIGHCVSS 7.5EG 7.5
2019-05-10
Oncommand Insight versions prior to 7.3.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors.
CVE-2019-5494HIGHCVSS 7.5EG 7.5
2019-05-10
OnCommand Unified Manager 7-Mode prior to version 5.2.4 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors.
CVE-2019-9860HIGHCVSS 7.5EG 7.5
2019-03-27
Due to unencrypted signal communication and predictability of rolling codes, an attacker can "desynchronize" an ABUS Secvest wireless remote control (FUBE50014 or FUBE50015) relative to its controlled Secvest wireless alarm system FUAA5000…
CVE-2019-7675HIGHCVSS 7.5EG 7.5
2019-02-09
An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. The default management application is delivered over cleartext HTTP with Basic Authentication, as demonstrated by the /admin/index.html URI.
CVE-2018-17195HIGHCVSS 7.5EG 7.5
2018-12-19
The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle (MiTM) attack, resulting in a CSRF attack. The required attack vector is complex, requiring a scenario …
CVE-2018-18071HIGHCVSS 7.5EG 7.5
2018-10-09
An issue was discovered in the Daimler Mercedes-Benz Me app 2.11.0-846 for iOS. The encrypted Connected Vehicle API data exchange between the app and a server might be intercepted. The app can be used to operate the Remote Parking Pilot, u…
CVE-2018-11338HIGHCVSS 7.5EG 7.5
2018-07-31
Intuit Lacerte 2017 for Windows in a client/server environment transfers the entire customer list in cleartext over SMB, which allows attackers to (1) obtain sensitive information by sniffing the network or (2) conduct man-in-the-middle (M…
CVE-2016-5638HIGHCVSS 7.5EG 7.5
2018-07-24
There are few web pages associated with the genie app on the Netgear WNDR4500 running firmware version V1.0.1.40_1.0.6877. Genie app adds some capabilities over the Web GUI and can be accessed even when you are away from home. A remote att…
CVE-2018-4227HIGHCVSS 7.5EG 7.5
2018-06-08
An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. The issue involves the "Mail" component. It allows remote attackers to read the cleartext content of S/MIME encrypted message…
CVE-2017-12310HIGHCVSS 7.5EG 7.5
2018-03-27
A vulnerability in the auto discovery phase of Cisco Spark Hybrid Calendar Service could allow an unauthenticated, remote attacker to view sensitive information in the unencrypted headers of an HTTP method request. The attacker could use t…
CVE-2017-14486HIGHCVSS 7.5EG 7.5
2017-12-01
The Vibease Wireless Remote Vibrator app for Android and the Vibease Chat app for iOS use cleartext to exchange messages with other apps and the PLAIN SASL mechanism to send auth tokens to Vibease servers, which allows remote attackers to …
CVE-2017-7133HIGHCVSS 7.5EG 7.5
2017-10-23
An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "MobileBackup" component. It allows remote attackers to obtain sensitive cleartext information in opportunistic circumstances by leveragin…
CVE-2017-15290HIGHCVSS 7.5EG 7.5
2017-10-12
Mirasys Video Management System (VMS) 6.x before 6.4.6, 7.x before 7.5.15, and 8.x before 8.1.1 has a login process in which cleartext data is sent from a server to a client, and not all of this data is required for the client functionalit…
CVE-2017-1000024HIGHCVSS 7.5EG 7.5
2017-07-17
Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential password and oauth token plaintext transmission
CVE-2017-5652HIGHCVSS 7.5EG 7.5
2017-07-10
During a routine security analysis, it was found that one of the ports in Apache Impala (incubating) 2.7.0 to 2.8.0 sent data in plaintext even when the cluster was configured to use TLS. The port in question was used by the StatestoreSubs…
CVE-2008-4122HIGHCVSS 7.5EG 7.5
2008-12-19
Joomla! 1.5.8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
CVE-2008-4390HIGHCVSS 7.5EG 7.5
2008-12-09
The Cisco Linksys WVC54GC wireless video camera before firmware 1.25 sends cleartext configuration data in response to a Setup Wizard remote-management command, which allows remote attackers to obtain sensitive information such as password…
CVE-2008-3289HIGHCVSS 7.5EG 7.5
2008-07-24
EMC Dantz Retrospect Backup Client 7.5.116 sends the password hash in cleartext at an unspecified point, which allows remote attackers to obtain sensitive information via a crafted packet.
CVE-2008-0374HIGHCVSS 7.5EG 7.5
2008-01-22
OKI C5510MFP Printer CU H2.15, PU 01.03.01, System F/W 1.01, and Web Page 1.00 sends the configuration of the printer in cleartext, which allows remote attackers to obtain the administrative password by connecting to TCP port 5548 or 7777.
CVE-2005-3140HIGHCVSS 7.5EG 7.5
2005-10-05
Procom NetFORCE 800 4.02 M10 Build 20 and possibly other versions sends the NIS password map (passwd.nis) as a file attachment in diagnostic e-mail messages, which allows remote attackers to obtain the cleartext NIS password hashes.
CVE-2002-1949HIGHCVSS 7.5EG 7.5
2002-12-31
The Network Attached Storage (NAS) Administration Web Page for Iomega NAS A300U transmits passwords in cleartext, which allows remote attackers to sniff the administrative password.
CVE-2023-1831HIGHCVSS 7.2EG 7.5
2023-04-17
Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled (ExperimentalAuditSettings section in config).
CVE-2022-0988HIGHCVSS 7.1EG 7.5
2022-03-25
Delta Electronics DIAEnergie (Version 1.7.5 and prior) is vulnerable to cleartext transmission as the web application runs by default on HTTP. This could allow an attacker to remotely read transmitted information between the client and pro…
CVE-2026-32838HIGHCVSS 5.9EG 7.5
2026-03-17
Edimax GS-5008PL firmware version 1.00.54 and prior use cleartext HTTP for the web management interface without implementing TLS or SSL encryption. Attackers on the same network can intercept management traffic to capture administrator cre…
CVE-2019-25278HIGHCVSS 5.9EG 7.5
2026-01-08
FaceSentry Access Control System 6.4.8 contains a cleartext transmission vulnerability that allows remote attackers to intercept authentication credentials. Attackers can perform man-in-the-middle attacks to capture HTTP cookie authenticat…
CVE-2023-1802HIGHCVSS 5.9EG 7.5
2023-04-06
In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted network sniffing attack can lead to a disclosure of sensitive information. On…
CVE-2021-20409HIGHCVSS 5.9EG 7.5
2021-02-12
IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to o…
CVE-2021-39342HIGHCVSS 5.3EG 7.5
2021-09-29
The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX action whenever a site user goes to checkout on a page that has the Credova Financing option enabled. T…

Map vulnerabilities like CWE-319 to your infrastructure

EchelonGraph correlates every CVE — across CWE-319 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →