Fallos del tipo CWE-319

582 resultados

Transmissão de dados sensíveis em texto plano

A aplicação envia dados críticos (senhas, tokens, informações pessoais) sem criptografia em um canal de comunicação que pode ser interceptado. Um atacante na mesma rede ou posicionado no caminho do tráfego consegue ler esses dados diretamente, comprometendo confidencialidade.

Ejemplo

Um aplicativo mobile que envia credenciais de login via HTTP simples em vez de HTTPS, ou um sistema legado que transmite números de cartão de crédito em texto plano pela rede corporativa. Qualquer um fazendo sniffing de pacotes consegue capturar essas informações.

Cómo mitigar

Use HTTPS/TLS para toda comunicação que envolva dados sensíveis, implemente verificação de certificados válidos no cliente, e nunca transmita senhas ou tokens em parâmetros GET — prefira POST com corpo criptografado. Em APIs, aplique autenticação com tokens seguros e considere criptografia adicional end-to-end para dados ultra-críticos.

CVE-2021-21270MEDIUMCleartext Storage of Sensitive InformationEPSS 0.3%CVE-2023-33837MEDIUMIBM Security Verify Governance information disclosureEPSS 0.3%CVE-2026-69212MEDIUMHttp4s: FollowRedirect middleware leaks credentials over https->http same-authority redirectEPSS 0.3%CVE-2023-43125MEDIUMBIG-IP APM Clients TunnelCrack vulnerabilityEPSS 0.3%CVE-2026-31278HIGHAn issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers EPSS 0.3%CVE-2024-39746MEDIUMIBM Sterling Connect:Direct Web Services information disclosureEPSS 0.3%CVE-2026-24455HIGHJinan USR IOT Technology Limited (PUSR) USR-W610 Cleartext Transmission of Sensitive InformationEPSS 0.3%CVE-2024-41124MEDIUMPuncia Cleartext Transmission of Sensitive Information via HTTP urls in `API_URLS`EPSS 0.3%CVE-2026-81691HIGHopenssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLsEPSS 0.3%CVE-2024-30209CRITICALA vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating ManageEPSS 0.3%CVE-2026-34346MEDIUMWindows Ancillary Function Driver for WinSock Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-116105MEDIUMHeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmissionEPSS 0.3%CVE-2024-41757MEDIUMIBM Concert Software information disclosureEPSS 0.3%CVE-2023-31195MEDIUMASUS Router RT-AX3000 Firmware versions prior to 3.0.0.4.388.23403 uses sensitive cookies without 'Secure' attribute. When an attacker is inEPSS 0.3%CVE-2024-10973MEDIUMKeycloak: cli option for encrypted jgroups ignoredEPSS 0.3%CVE-2026-11833HIGHOverview: A vulnerability has been found in FAST/TOOLS and CI Server. The web server may return a response containing the CI Server settingEPSS 0.3%CVE-2025-36107MEDIUMIBM Cognos Analytics Mobile (iOS) information disclosureEPSS 0.3%CVE-2026-76244CRITICALstigmem-node Insecure Federation Transport ConfigurationEPSS 0.3%CVE-2024-44276HIGHThis issue was addressed by using HTTPS when sending information over the network. This issue is fixed in iOS 18.2 and iPadOS 18.2. A user iEPSS 0.3%CVE-2025-50110HIGHAn issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, the GetHttpsResponse mEPSS 0.3%