Falhas do tipo CWE-311

322 resultados

Falta de criptografia de dados sensíveis

A aplicação transmite ou armazena dados sensíveis (senhas, tokens, dados pessoais, números de cartão) em texto plano, sem criptografia. Um atacante que intercepte a comunicação ou acesse o armazenamento consegue ler essas informações diretamente, comprometendo confidencialidade e segurança do usuário.

Exemplo

Um aplicativo mobile envia credenciais de login via HTTP em vez de HTTPS, ou salva senhas em um arquivo de configuração sem criptografia. Um atacante na mesma rede Wi-Fi ou com acesso ao dispositivo rouba as credenciais facilmente.

Como mitigar

Use HTTPS/TLS para toda comunicação de dados sensíveis, criptografe dados em repouso com algoritmos fortes (AES-256), e nunca armazene senhas em texto plano — use hash com salt (bcrypt, argon2). Aplique essas práticas no design, não como remendo.

CVE-2024-38283MEDIUMMissing Encryption of Sensitive Data in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)EPSS 0.1%CVE-2026-21079HIGHMissing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data.EPSS 0.1%CVE-2023-50126MEDIUMMissing encryption in the RFID tags of the Hozard alarm system (Alarmsysteem) v1.0 allow attackers to create a cloned tag via brief physicalEPSS 0.1%CVE-2024-38302MEDIUMDell Data Lakehouse, version(s) 1.0.0.0, contain(s) a Missing Encryption of Sensitive Data vulnerability in the DDAE (Starburst). A low privEPSS 0.1%CVE-2025-13053HIGHA missing encryption of sensitive data vulnerability was found in the UPS settings of ADMEPSS 0.1%CVE-2026-43854MEDIUMA vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled EPSS 0.1%CVE-2025-1243LOWField in api-go proxy not transformed before version 1.44.1EPSS 0.1%CVE-2026-21849LOWHCL AION is affected by multiple security vulnerabilities.EPSS 0.1%CVE-2026-5345LOWHCL AION is affected by multiple security vulnerabilities.EPSS 0.1%CVE-2026-35110MEDIUMHCL AION is affected by multiple security vulnerabilities.EPSS 0.1%CVE-2024-41982MEDIUMA vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >=EPSS 0.1%CVE-2025-40680MEDIUMEncryption of sensitive data in CapillaryScope missingEPSS 0.1%CVE-2023-52948MEDIUMMissing encryption of sensitive data vulnerability in settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 EPSS 0.1%CVE-2025-15548MEDIUMMissing Application-Layer Encryption in Web Interface Endpoints on TP-Link VX800vEPSS 0.1%CVE-2023-52950MEDIUMMissing encryption of sensitive data vulnerability in login component in Synology Active Backup for Business Agent before 2.7.0-3221 allows EPSS 0.1%CVE-2026-116198MEDIUMSnipe-IT before 8.7.0 Missing Encryption via Api AssetsController storeEPSS 0.1%CVE-2025-10227MEDIUMLack of Encryption in Object Archive in AxxonSoft Axxon One (C-Werk) before 2.0.8EPSS 0.1%CVE-2025-36751CRITICALMissing encryption on Local Configuration Interface or Cloud Endpoint Communication - Growatt MIC3300TL-X and ShineLan-XEPSS 0.1%CVE-2026-92756MEDIUMCombining encryption settings may disable encryptionEPSS 0.1%CVE-2026-92757MEDIUMMalformed connection string may disable field level encryptionEPSS 0.1%