Fallos del tipo CWE-319

583 resultados

Transmissão de dados sensíveis em texto plano

A aplicação envia dados críticos (senhas, tokens, informações pessoais) sem criptografia em um canal de comunicação que pode ser interceptado. Um atacante na mesma rede ou posicionado no caminho do tráfego consegue ler esses dados diretamente, comprometendo confidencialidade.

Ejemplo

Um aplicativo mobile que envia credenciais de login via HTTP simples em vez de HTTPS, ou um sistema legado que transmite números de cartão de crédito em texto plano pela rede corporativa. Qualquer um fazendo sniffing de pacotes consegue capturar essas informações.

Cómo mitigar

Use HTTPS/TLS para toda comunicação que envolva dados sensíveis, implemente verificação de certificados válidos no cliente, e nunca transmita senhas ou tokens em parâmetros GET — prefira POST com corpo criptografado. Em APIs, aplique autenticação com tokens seguros e considere criptografia adicional end-to-end para dados ultra-críticos.

CVE-2026-21812LOWMultiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)EPSS 0.1%CVE-2026-76114MEDIUMDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cleartext Transmission of Sensitive Information vEPSS 0.1%CVE-2026-85973HIGHCleartext transmission in Progress MarkLogic Server cluster join operationsEPSS 0.1%CVE-2026-14984CRITICALCleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware2EPSS 0.1%CVE-2023-30565LOW CQI Data Sniffing EPSS 0.1%CVE-2025-32793MEDIUMCilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clustersEPSS 0.1%CVE-2025-53703HIGHDuraComm DP-10iN-100-MU Cleartext Transmission of Sensitive InformationEPSS 0.1%CVE-2025-10174HIGHImproper Access Control in Pan Software's PanCafe ProEPSS 0.1%CVE-2025-66604LOWA vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The library version could be displayed on the webEPSS 0.1%CVE-2025-43704MEDIUMArctera/Veritas Data Insight before 7.1.2 can send cleartext credentials when configured to use HTTP Basic Authentication to a Dell Isilon OEPSS 0.1%CVE-2021-20335MEDIUMSSL may be unexpectedly disabled during upgrade of multiple-server MongoDB Ops ManagerEPSS 0.1%CVE-2025-47698HIGHAn adjacent attacker without authentication can exploit this vulnerability to retrieve a set of user-privileged credentials. These credentiaEPSS 0.1%CVE-2023-45321HIGHThe Android Client application, when enrolled with the define method 1 (the user manually inserts the server ip address), use HTTP protocolEPSS 0.1%CVE-2026-8874HIGHCVE-2026-8874EPSS 0.1%CVE-2026-0714HIGHA physical attack vulnerability exists in certain Moxa industrial computers using TPM-backed LUKS full-disk encryption on Moxa Industrial LiEPSS 0.1%CVE-2024-9834CRITICALImproper data protection on Life2000 ventilator serial interfaceEPSS 0.1%CVE-2026-107692MEDIUMWar Thunder Account ImpersonationEPSS 0.1%CVE-2021-39077MEDIUMIBM Security Guardium information disclosureEPSS 0.1%CVE-2026-79782CRITICALrclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP RedirectEPSS 0.1%CVE-2022-22457MEDIUMIBM Security Verify Governance, Identity Manager information disclosureEPSS 0.1%