Weaknesses of type CWE-319

582 results

Transmissão de dados sensíveis em texto plano

A aplicação envia informações críticas (senhas, tokens, dados pessoais) sem criptografia em canais de comunicação que podem ser interceptados. Um atacante na rede consegue capturar esses dados diretamente, comprometendo a confidencialidade da informação e permitindo roubo de credenciais ou dados sensíveis.

Example

Um app mobile envia login e senha via HTTP (não HTTPS), ou um sistema transmite números de cartão de crédito em requisições não criptografadas. Ferramentas simples como Wireshark permitem capturar esse tráfego em redes abertas ou mesmo corporativas.

How to mitigate

Sempre usar HTTPS/TLS para qualquer transmissão de dados sensíveis, implementar pinning de certificado em apps mobile, validar certificados no lado cliente, e nunca transmitir segredos em URLs ou headers sem criptografia. Na prática: configure HTTPS em produção, force redirecionamento HTTP → HTTPS, e audite logs de requisições para detectar canais desprotegidos.

CVE-2022-41545MEDIUMThe administrative web interface of a Netgear C7800 Router running firmware version 6.01.07 (and possibly others) authenticates users via baEPSS 0.3%CVE-2025-27722MEDIUMCleartext transmission of sensitive information issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a man-in-the-middle attackEPSS 0.3%CVE-2025-61481CRITICALAn issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an oEPSS 0.3%CVE-2023-34441MEDIUMBaker Hughes Bently Nevada 3500 System Cleartext Transmission of Sensitive InformationEPSS 0.3%CVE-2023-41088MEDIUMCleartext Transmission of Sensitive Information in DEXMA DEXGateEPSS 0.3%CVE-2025-27457MEDIUMCVE-2025-27457EPSS 0.3%CVE-2023-40729HIGHA vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application lacks security control to prevent unEPSS 0.3%CVE-2025-67159HIGHVatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext.EPSS 0.3%CVE-2025-56447CRITICALTM2 Monitoring v3.04 contains an authentication bypass and plaintext credential disclosure.EPSS 0.3%CVE-2024-36426HIGHIn TARGIT Decision Suite 23.2.15007.0 before Autumn 2023, the session token is part of the URL and may be sent in a cleartext HTTP session.EPSS 0.3%CVE-2025-53139HIGHWindows Hello Security Feature Bypass VulnerabilityEPSS 0.3%CVE-2023-25848MEDIUMBUG-000158039 - There is an information disclosure issue in ArcGIS Server.EPSS 0.3%CVE-2025-0631HIGHPowerFlex® 755 Credential Exposure VulnerabilityEPSS 0.3%CVE-2025-58107HIGHIn Microsoft Exchange through 2019, Exchange ActiveSync (EAS) configurations on on-premises servers may transmit sensitive data from SamsungEPSS 0.3%CVE-2024-32946MEDIUMA vulnerability in the LevelOne WBR-6012 router's firmware version R0.40e6 allows sensitive information to be transmitted in cleartext via WEPSS 0.3%CVE-2024-53246MEDIUMSensitive Information Disclosure through SPL commandsEPSS 0.3%CVE-2023-33187MEDIUMhighlight vulnerable to cleartext transmission of sensitive informationEPSS 0.3%CVE-2025-5270HIGHSNI was sometimes unencryptedEPSS 0.3%CVE-2025-63364HIGHWaveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discovEPSS 0.3%CVE-2026-81836MEDIUMRooCodeInc Roo-Code OAuth Callback oauth.ts cleartext transmissionEPSS 0.3%