Fallos del tipo CWE-311
322 resultadosAusência de criptografia para dados sensíveis
A aplicação processa ou armazena dados sensíveis (senhas, tokens, dados financeiros, PII) sem aplicar criptografia. Isso expõe as informações a quem tiver acesso ao meio de transmissão ou armazenamento, permitindo roubo ou vazamento direto.
Ejemplo
Um servidor que salva tokens de autenticação em um arquivo de log em texto plano, ou uma API que trafega CPF e dados bancários via HTTP simples em vez de HTTPS. Um atacante monitora a rede ou acessa o servidor e recupera os dados.
Cómo mitigar
Sempre use HTTPS/TLS para transmissão de dados sensíveis, criptografe dados em repouso usando algoritmos reconhecidos (AES-256), e aplique criptografia end-to-end onde possível. Nunca deixe senhas ou tokens em logs ou cache sem proteção.
CVE-2024-38283MEDIUMMissing Encryption of Sensitive Data in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)EPSS 0.1%CVE-2026-21079HIGHMissing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data.EPSS 0.1%CVE-2023-50126MEDIUMMissing encryption in the RFID tags of the Hozard alarm system (Alarmsysteem) v1.0 allow attackers to create a cloned tag via brief physicalEPSS 0.1%CVE-2024-38302MEDIUMDell Data Lakehouse, version(s) 1.0.0.0, contain(s) a Missing Encryption of Sensitive Data vulnerability in the DDAE (Starburst). A low privEPSS 0.1%CVE-2025-13053HIGHA missing encryption of sensitive data vulnerability was found in the UPS settings of ADMEPSS 0.1%CVE-2026-43854MEDIUMA vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled EPSS 0.1%CVE-2025-1243LOWField in api-go proxy not transformed before version 1.44.1EPSS 0.1%CVE-2026-5345LOWHCL AION is affected by multiple security vulnerabilities.EPSS 0.1%CVE-2026-21849LOWHCL AION is affected by multiple security vulnerabilities.EPSS 0.1%CVE-2026-35110MEDIUMHCL AION is affected by multiple security vulnerabilities.EPSS 0.1%CVE-2023-52948MEDIUMMissing encryption of sensitive data vulnerability in settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 EPSS 0.1%CVE-2024-41982MEDIUMA vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >=EPSS 0.1%CVE-2025-40680MEDIUMEncryption of sensitive data in CapillaryScope missingEPSS 0.1%CVE-2025-15548MEDIUMMissing Application-Layer Encryption in Web Interface Endpoints on TP-Link VX800vEPSS 0.1%CVE-2023-52950MEDIUMMissing encryption of sensitive data vulnerability in login component in Synology Active Backup for Business Agent before 2.7.0-3221 allows EPSS 0.1%CVE-2026-116198MEDIUMSnipe-IT before 8.7.0 Missing Encryption via Api AssetsController storeEPSS 0.1%CVE-2025-10227MEDIUMLack of Encryption in Object Archive in AxxonSoft Axxon One (C-Werk) before 2.0.8EPSS 0.1%CVE-2025-36751CRITICALMissing encryption on Local Configuration Interface or Cloud Endpoint Communication - Growatt MIC3300TL-X and ShineLan-XEPSS 0.1%CVE-2026-92756MEDIUMCombining encryption settings may disable encryptionEPSS 0.1%CVE-2026-92757MEDIUMMalformed connection string may disable field level encryptionEPSS 0.1%