Fallos del tipo CWE-319

538 resultados

Transmissão de dados sensíveis em texto plano

A aplicação envia dados críticos (senhas, tokens, informações pessoais) sem criptografia em um canal de comunicação que pode ser interceptado. Um atacante na mesma rede ou posicionado no caminho do tráfego consegue ler esses dados diretamente, comprometendo confidencialidade.

Ejemplo

Um aplicativo mobile que envia credenciais de login via HTTP simples em vez de HTTPS, ou um sistema legado que transmite números de cartão de crédito em texto plano pela rede corporativa. Qualquer um fazendo sniffing de pacotes consegue capturar essas informações.

Cómo mitigar

Use HTTPS/TLS para toda comunicação que envolva dados sensíveis, implemente verificação de certificados válidos no cliente, e nunca transmita senhas ou tokens em parâmetros GET — prefira POST com corpo criptografado. Em APIs, aplique autenticação com tokens seguros e considere criptografia adicional end-to-end para dados ultra-críticos.

CVE-2025-61481CRITICALAn issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an oEPSS 0.3%CVE-2025-47419CRITICALNon-Secure AccessEPSS 0.3%CVE-2026-55854MEDIUMMariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadbEPSS 0.3%CVE-2021-21270MEDIUMCleartext Storage of Sensitive InformationEPSS 0.3%CVE-2025-0631HIGHPowerFlex® 755 Credential Exposure VulnerabilityEPSS 0.3%CVE-2024-39746MEDIUMIBM Sterling Connect:Direct Web Services information disclosureEPSS 0.3%CVE-2024-30209CRITICALA vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating ManageEPSS 0.3%CVE-2024-10973MEDIUMKeycloak: cli option for encrypted jgroups ignoredEPSS 0.3%CVE-2026-30795HIGHRustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake FailureEPSS 0.3%CVE-2024-41124MEDIUMPuncia Cleartext Transmission of Sensitive Information via HTTP urls in `API_URLS`EPSS 0.3%CVE-2026-34346MEDIUMWindows Ancillary Function Driver for WinSock Information Disclosure VulnerabilityEPSS 0.3%CVE-2023-31195MEDIUMASUS Router RT-AX3000 Firmware versions prior to 3.0.0.4.388.23403 uses sensitive cookies without 'Secure' attribute. When an attacker is inEPSS 0.3%CVE-2026-11833HIGHOverview: A vulnerability has been found in FAST/TOOLS and CI Server. The web server may return a response containing the CI Server settingEPSS 0.3%CVE-2025-50110HIGHAn issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, the GetHttpsResponse mEPSS 0.3%CVE-2021-32456MEDIUMSITEL CAP/PRX cleartext transmission of sensitive informationEPSS 0.3%CVE-2024-41757MEDIUMIBM Concert Software information disclosureEPSS 0.3%CVE-2022-41983LOWBIG-IP TMM Vulnerability CVE-2022-41983EPSS 0.3%CVE-2025-53756HIGHCleartext Transmission Vulnerability in Digisol DG-GR6821AC RouterEPSS 0.3%CVE-2025-63364HIGHWaveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discovEPSS 0.3%CVE-2023-33837MEDIUMIBM Security Verify Governance information disclosureEPSS 0.3%