Fallos del tipo CWE-319

583 resultados

Transmissão de dados sensíveis em texto plano

A aplicação envia dados críticos (senhas, tokens, informações pessoais) sem criptografia em um canal de comunicação que pode ser interceptado. Um atacante na mesma rede ou posicionado no caminho do tráfego consegue ler esses dados diretamente, comprometendo confidencialidade.

Ejemplo

Um aplicativo mobile que envia credenciais de login via HTTP simples em vez de HTTPS, ou um sistema legado que transmite números de cartão de crédito em texto plano pela rede corporativa. Qualquer um fazendo sniffing de pacotes consegue capturar essas informações.

Cómo mitigar

Use HTTPS/TLS para toda comunicação que envolva dados sensíveis, implemente verificação de certificados válidos no cliente, e nunca transmita senhas ou tokens em parâmetros GET — prefira POST com corpo criptografado. Em APIs, aplique autenticação com tokens seguros e considere criptografia adicional end-to-end para dados ultra-críticos.

CVE-2026-87482MEDIUMCleartext transmission of sensitive data in HttpsUpgrades in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker to leaEPSS 0.2%CVE-2025-13489MEDIUMIBM DevOps Deploy is susceptible to a Cleartext Transmission of Sensitive InformationEPSS 0.2%CVE-2023-3028HIGHImproper backend communication allows access and manipulation of the telemetry dataEPSS 0.2%CVE-2026-40431MEDIUMSenseLive X3050 Cleartext transmission of sensitive informationEPSS 0.2%CVE-2026-111594CRITICALInterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive InformationEPSS 0.2%CVE-2026-107282CRITICALAsyncHttpClient: Replay to a different host sends the original host request and credentials to the new hostEPSS 0.2%CVE-2025-64648MEDIUMMultiple Vulnerabilities in IBM Concert SoftwareEPSS 0.2%CVE-2024-32384MEDIUMKerlink gateways running KerOS prior to version 5.10 expose their web interface exclusively over HTTP, without HTTPS support. This lack of tEPSS 0.2%CVE-2026-116114MEDIUMYoosee GM8135S Camera Live UDP H.264 Video Stream npc cleartext transmissionEPSS 0.2%CVE-2026-88013LOWrclone: http backend forwards custom/auth headers to a different host on redirectEPSS 0.2%CVE-2026-2671LOWMendi Neurofeedback Headset Bluetooth Low Energy cleartext transmissionEPSS 0.2%CVE-2026-33569MEDIUMAnviz Products Cleartext Transmission of Sensitive InformationEPSS 0.2%CVE-2026-43625HIGHCodexBar < 0.32.0 Session Cookie Exposure via HTTP RedirectEPSS 0.2%CVE-2026-50200HIGHSteeltoe's env sanitizer misses connection strings — leaks embedded DB passwordsEPSS 0.2%CVE-2024-42181LOWHCL MyXalytics is affected by a cleartext transmission of sensitive information vulnerabilityEPSS 0.2%CVE-2025-59448MEDIUMComponents of the YoSmart YoLink ecosystem through 2025-10-02 leverage unencrypted MQTT to communicate over the internet. An attacker with tEPSS 0.2%CVE-2025-61738LOWJohnson Controls PowerG and IQPanel cleartext transmission of sensitive informationEPSS 0.2%CVE-2025-25046LOWIBM InfoSphere Information Server information disclosureEPSS 0.2%CVE-2026-82826HIGHAuthentication information or sensitive data may be intercepted in transitEPSS 0.2%CVE-2026-48022MEDIUM@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirectsEPSS 0.2%