Falhas do tipo CWE-319

538 resultados

Transmissão de dados sensíveis em texto plano

A aplicação envia informações sensíveis (senhas, tokens, dados pessoais) sem criptografia em um canal de comunicação que pode ser interceptado. Um atacante na rede consegue capturar esses dados facilmente com ferramentas simples como packet sniffers, comprometendo a confidencialidade.

Exemplo

Uma API envia credenciais de usuário via HTTP simples em vez de HTTPS, ou um sistema transmite tokens de autenticação em requisições GET visíveis em logs de proxy. Um atacante na mesma rede Wi-Fi captura os pacotes e acessa as credenciais diretamente.

Como mitigar

Use HTTPS/TLS em todas as comunicações envolvendo dados sensíveis, implemente criptografia end-to-end quando necessário, e nunca transmita credenciais em parâmetros de URL. Valide certificados SSL/TLS do lado cliente e revise protocolos legados (FTP, Telnet) para alternativas seguras.

CVE-2019-18248—BIOTRONIK CardioMessenger II, The affected products transmit credentials in clear-text prior to switching to an encrypted communication chanEPSS 0.4%CVE-2023-5100MEDIUM Cleartext Transmission of Sensitive Information in RDT400 in SICK APU allows an unprivileged remote attacker to retrieve potentially sensitEPSS 0.4%CVE-2023-1656HIGHWhen the LDAP connector is started with StartTLS configured, LDAP BIND credentials are transmitted insecurely, prior to establishing the TLS connection.EPSS 0.3%CVE-2025-3329LOWConsumer Comanda Mobile Restaurant Order cleartext transmissionEPSS 0.3%CVE-2021-38828MEDIUMXiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to plain-text traffic sniffing.EPSS 0.3%CVE-2023-22870MEDIUMIBM Aspera Faspex information disclosureEPSS 0.3%CVE-2025-62578HIGHDVP-12SE - Modbus/TCP Cleartext Transmission of Sensitive InformationEPSS 0.3%CVE-2022-46685MEDIUMIn Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentialEPSS 0.3%CVE-2023-34142CRITICALCleartext Transmission Vulnerability in Hitachi Device ManagerEPSS 0.3%CVE-2021-35246MEDIUMUnprotected Transport of Credentials (HSTS) VulnerabilityEPSS 0.3%CVE-2023-27861MEDIUMIBM Maximo Application Suite information disclosureEPSS 0.3%CVE-2019-11276MEDIUMApps Manager sends tokens to Spring apps via HTTPEPSS 0.3%CVE-2019-25278CRITICALFaceSentry Access Control System 6.4.8 Authentication Credentials MiTM DisclosureEPSS 0.3%CVE-2025-7731HIGHInformation Disclosure Vulnerability in MELSEC iQ-F Series CPU moduleEPSS 0.3%CVE-2023-27291MEDIUMIBM Watson CP4D Data Stores information disclosureEPSS 0.3%CVE-2024-31206HIGHUse of Unencrypted HTTP Request in dectalk-ttsEPSS 0.3%CVE-2024-43432MEDIUMMoodle: authorization headers preserved between "emulated redirects"EPSS 0.3%CVE-2020-7592—A vulnerability has been identified in SIMATIC HMI Basic Panels 1st Generation (incl. SIPLUS variants) (All versions), SIMATIC HMI Basic PanEPSS 0.3%CVE-2022-47560MEDIUMCleartext Transmission of Sensitive Information in Ormazabal productsEPSS 0.3%CVE-2026-4873MEDIUMconnection reuse ignores TLS requirementEPSS 0.3%