Weaknesses of type CWE-319

582 results

Transmissão de dados sensíveis em texto plano

A aplicação envia informações críticas (senhas, tokens, dados pessoais) sem criptografia em canais de comunicação que podem ser interceptados. Um atacante na rede consegue capturar esses dados diretamente, comprometendo a confidencialidade da informação e permitindo roubo de credenciais ou dados sensíveis.

Example

Um app mobile envia login e senha via HTTP (não HTTPS), ou um sistema transmite números de cartão de crédito em requisições não criptografadas. Ferramentas simples como Wireshark permitem capturar esse tráfego em redes abertas ou mesmo corporativas.

How to mitigate

Sempre usar HTTPS/TLS para qualquer transmissão de dados sensíveis, implementar pinning de certificado em apps mobile, validar certificados no lado cliente, e nunca transmitir segredos em URLs ou headers sem criptografia. Na prática: configure HTTPS em produção, force redirecionamento HTTP → HTTPS, e audite logs de requisições para detectar canais desprotegidos.

CVE-2026-1777HIGHCleartext transmission of sensitive materials in aws/sagemaker-python-sdkEPSS 0.5%CVE-2023-25070MEDIUMCleartext transmission of sensitive information exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier. If the telnet connection isEPSS 0.5%CVE-2021-0296HIGHCTPView: HSTS not being enforced on CTPView server.EPSS 0.5%CVE-2022-45546HIGHInformation Disclosure in Authentication Component of ScreenCheck BadgeMaker 2.6.2.0 application allows internal attacker to obtain credentiEPSS 0.5%CVE-2024-12378CRITICALOn affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan tunnels in the clear.EPSS 0.5%CVE-2007-4786MEDIUMCisco Adaptive Security Appliance (ASA) running PIX 7.0 before 7.0.7.1, 7.1 before 7.1.2.61, 7.2 before 7.2.2.34, and 8.0 before 8.0.2.11, wEPSS 0.5%CVE-2020-12036—Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The affected devices do not implement data-in-transit encryption (e.g., TEPSS 0.5%CVE-2021-3473MEDIUMAn internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be EPSS 0.5%CVE-2023-30513HIGHJenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log EPSS 0.5%CVE-2024-28134HIGHPHOENIX CONTACT: MitM attack gains privileges of the current logged in user in CHARX Series EPSS 0.5%CVE-2020-9420MEDIUMThe login password of the web administrative dashboard in Arcadyan Wifi routers VRV9506JAC23 is sent in cleartext, allowing an attacker to sEPSS 0.5%CVE-2023-30602HIGHHitron Technologies Inc. CODA-5310 - Insecure service TelnetEPSS 0.5%CVE-2021-3792MEDIUMSome device communications in some Motorola-branded Binatone Hubble Cameras with backend Hubble services are not encrypted which could lead EPSS 0.5%CVE-2023-3761LOWIntergard SGS Password Change cleartext transmissionEPSS 0.5%CVE-2023-5461LOWDelta Electronics WPLSoft Modbus cleartext transmissionEPSS 0.5%CVE-2025-0784MEDIUMIntelbras InControl Registered User usuario cleartext transmissionEPSS 0.5%CVE-2022-41636CRITICALCommunication traffic involving "Ethernet Q Commands" service of Haas Controller version 100.20.000.1110 is transmitted in cleartext. This aEPSS 0.5%CVE-2023-0922MEDIUMThe Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-EPSS 0.5%CVE-2022-43691MEDIUMConcrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 inadvertently disclose server-side sensitive information (secretsEPSS 0.5%CVE-2022-44411HIGHWeb Based Quiz System v1.0 transmits user passwords in plaintext during the authentication process, allowing attackers to obtain users' passEPSS 0.5%