Fallos del tipo CWE-319

580 resultados

Transmissão de dados sensíveis em texto plano

A aplicação envia dados críticos (senhas, tokens, informações pessoais) sem criptografia em um canal de comunicação que pode ser interceptado. Um atacante na mesma rede ou posicionado no caminho do tráfego consegue ler esses dados diretamente, comprometendo confidencialidade.

Ejemplo

Um aplicativo mobile que envia credenciais de login via HTTP simples em vez de HTTPS, ou um sistema legado que transmite números de cartão de crédito em texto plano pela rede corporativa. Qualquer um fazendo sniffing de pacotes consegue capturar essas informações.

Cómo mitigar

Use HTTPS/TLS para toda comunicação que envolva dados sensíveis, implemente verificação de certificados válidos no cliente, e nunca transmita senhas ou tokens em parâmetros GET — prefira POST com corpo criptografado. Em APIs, aplique autenticação com tokens seguros e considere criptografia adicional end-to-end para dados ultra-críticos.

CVE-2026-53624MEDIUMFiber: HSTS header never set in helmet middleware due to incorrect protocol checkEPSS 0.2%CVE-2025-54156CRITICALSantesoft Sante PACS Server Cleartext Transmission of Sensitive InformationEPSS 0.2%CVE-2026-48978LOWoras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokensEPSS 0.2%CVE-2025-13490MEDIUMIBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that report metrics are vulnerable to loss of confidentialityEPSS 0.2%CVE-2026-50034HIGHApollo Pharmacy Blood Glucose Monitoring System APG-01 BT Cleartext Transmission of Sensitive InformationEPSS 0.2%CVE-2026-32309HIGHCryptomator: Hub unlocking accepts plaintext HTTP and unvalidated endpoint schemesEPSS 0.2%CVE-2024-5631MEDIUMLongse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, are transmitting user's login and passwordEPSS 0.2%CVE-2026-25608LOWLack of traffic encryption in STEREPSS 0.2%CVE-2024-0066MEDIUMJohan Fagerström, member of the AXIS OS Bug Bounty Program, has found that a O3C feature may expose sensitive traffic between the client (AxEPSS 0.2%CVE-2026-22306CRITICALCritical flaw impacting OZOLS ERP's automatic update channelEPSS 0.2%CVE-2025-36274HIGHIBM Aspera HTTP Gateway information disclosureEPSS 0.2%CVE-2022-2338MEDIUMSofting Secure Integration Server Cleartext Transmission of Sensitive InformationEPSS 0.2%CVE-2026-107285MEDIUMAsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnelEPSS 0.2%CVE-2022-0005LOWSensitive information accessible by physical probing of JTAG interface for some Intel(R) Processors with SGX may allow an unprivileged user EPSS 0.2%CVE-2024-45102MEDIUMA privilege escalation vulnerability was discovered that could allow a valid, authenticated LXCA user to escalate their permissions for a coEPSS 0.2%CVE-2025-44612MEDIUMTinxy WiFi Lock Controller v1 RF was discovered to transmit sensitive information in plaintext, including control information and device creEPSS 0.2%CVE-2021-23896LOWCleartext Transmission of Sensitive Information in McAfee DBSecEPSS 0.2%CVE-2026-18536HIGHData::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTPEPSS 0.2%CVE-2026-105245MEDIUMsgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmissionEPSS 0.2%CVE-2025-12530MEDIUMVulnerabilities found in Watson Data IntelligenceEPSS 0.2%