Fallos del tipo CWE-319

583 resultados

Transmissão de dados sensíveis em texto plano

A aplicação envia dados críticos (senhas, tokens, informações pessoais) sem criptografia em um canal de comunicação que pode ser interceptado. Um atacante na mesma rede ou posicionado no caminho do tráfego consegue ler esses dados diretamente, comprometendo confidencialidade.

Ejemplo

Um aplicativo mobile que envia credenciais de login via HTTP simples em vez de HTTPS, ou um sistema legado que transmite números de cartão de crédito em texto plano pela rede corporativa. Qualquer um fazendo sniffing de pacotes consegue capturar essas informações.

Cómo mitigar

Use HTTPS/TLS para toda comunicação que envolva dados sensíveis, implemente verificação de certificados válidos no cliente, e nunca transmita senhas ou tokens em parâmetros GET — prefira POST com corpo criptografado. Em APIs, aplique autenticação com tokens seguros e considere criptografia adicional end-to-end para dados ultra-críticos.

CVE-2023-46889MEDIUMMeross MSH30Q 4.5.23 is vulnerable to Cleartext Transmission of Sensitive Information. During the device setup phase, the MSH30Q creates an EPSS 0.2%CVE-2025-32887HIGHAn issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. A command channel includes the next hop. which can be inteEPSS 0.2%CVE-2026-29988HIGHA cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affecteEPSS 0.2%CVE-2026-5115LOWSession hijacking in PaperCut NG/MF embedded application for Konica Minolta devicesEPSS 0.2%CVE-2025-4227LOWGlobalProtect App: Interception in Endpoint Traffic Policy EnforcementEPSS 0.2%CVE-2024-44105HIGHCleartext transmission of sensitive information in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allEPSS 0.2%CVE-2025-32884MEDIUMAn issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. By default, a GID is the user's phone number unless theyEPSS 0.2%CVE-2025-32881MEDIUMAn issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. By default, the GID is the user's phone number unless theyEPSS 0.2%CVE-2026-73174HIGHNozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive Information vulnerability in the edgserver management protocoEPSS 0.2%CVE-2026-38740MEDIUMFoscam VD1 Video Doorbell before V5.3.13_1072 is vulnerable to Cleartext Transmission of Sensitive Information. The device transmits sensitiEPSS 0.2%CVE-2025-7743CRITICALSensitive Data Exposure in Dolusoft's OmaspotEPSS 0.2%CVE-2026-103098HIGHGV-Eye Sensitive information exposure in URL query parameter VulnerabilityEPSS 0.2%CVE-2026-20115MEDIUMA vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device informaEPSS 0.2%CVE-2026-123497HIGHVikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server DiscoveryEPSS 0.2%CVE-2025-15619LOWHCL Connections is vulnerable to broken access controlEPSS 0.2%CVE-2024-5462MEDIUMBrocade Fabric OS may capture SNMP Passwords in clear textEPSS 0.2%CVE-2024-9620MEDIUMEvent-driven automation in ansible automation platform (aap): ansible event-driven automation (eda) lacks encryptionEPSS 0.2%CVE-2023-0864HIGHConfiguration data is exchanged in plaintext and could be available to a nearby attacker if present during configuration or usage of the device via Bluetooth Low Energy (BLE).EPSS 0.2%CVE-2024-28786MEDIUMIBM QRadar SIEM information disclosureEPSS 0.2%CVE-2025-62330MEDIUMHCL DevOps Deploy is susceptible to a cleartext transmission of sensitive informationEPSS 0.2%