Falhas do tipo CWE-319

582 resultados

Transmissão de dados sensíveis em texto plano

A aplicação envia informações sensíveis (senhas, tokens, dados pessoais) sem criptografia em um canal de comunicação que pode ser interceptado. Um atacante na rede consegue capturar esses dados facilmente com ferramentas simples como packet sniffers, comprometendo a confidencialidade.

Exemplo

Uma API envia credenciais de usuário via HTTP simples em vez de HTTPS, ou um sistema transmite tokens de autenticação em requisições GET visíveis em logs de proxy. Um atacante na mesma rede Wi-Fi captura os pacotes e acessa as credenciais diretamente.

Como mitigar

Use HTTPS/TLS em todas as comunicações envolvendo dados sensíveis, implemente criptografia end-to-end quando necessário, e nunca transmita credenciais em parâmetros de URL. Valide certificados SSL/TLS do lado cliente e revise protocolos legados (FTP, Telnet) para alternativas seguras.

CVE-2022-41545MEDIUMThe administrative web interface of a Netgear C7800 Router running firmware version 6.01.07 (and possibly others) authenticates users via baEPSS 0.3%CVE-2025-27722MEDIUMCleartext transmission of sensitive information issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a man-in-the-middle attackEPSS 0.3%CVE-2025-61481CRITICALAn issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an oEPSS 0.3%CVE-2023-34441MEDIUMBaker Hughes Bently Nevada 3500 System Cleartext Transmission of Sensitive InformationEPSS 0.3%CVE-2023-41088MEDIUMCleartext Transmission of Sensitive Information in DEXMA DEXGateEPSS 0.3%CVE-2025-27457MEDIUMCVE-2025-27457EPSS 0.3%CVE-2023-40729HIGHA vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application lacks security control to prevent unEPSS 0.3%CVE-2025-67159HIGHVatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext.EPSS 0.3%CVE-2025-56447CRITICALTM2 Monitoring v3.04 contains an authentication bypass and plaintext credential disclosure.EPSS 0.3%CVE-2024-36426HIGHIn TARGIT Decision Suite 23.2.15007.0 before Autumn 2023, the session token is part of the URL and may be sent in a cleartext HTTP session.EPSS 0.3%CVE-2025-53139HIGHWindows Hello Security Feature Bypass VulnerabilityEPSS 0.3%CVE-2023-25848MEDIUMBUG-000158039 - There is an information disclosure issue in ArcGIS Server.EPSS 0.3%CVE-2025-0631HIGHPowerFlex® 755 Credential Exposure VulnerabilityEPSS 0.3%CVE-2025-58107HIGHIn Microsoft Exchange through 2019, Exchange ActiveSync (EAS) configurations on on-premises servers may transmit sensitive data from SamsungEPSS 0.3%CVE-2024-53246MEDIUMSensitive Information Disclosure through SPL commandsEPSS 0.3%CVE-2024-32946MEDIUMA vulnerability in the LevelOne WBR-6012 router's firmware version R0.40e6 allows sensitive information to be transmitted in cleartext via WEPSS 0.3%CVE-2023-33187MEDIUMhighlight vulnerable to cleartext transmission of sensitive informationEPSS 0.3%CVE-2025-5270HIGHSNI was sometimes unencryptedEPSS 0.3%CVE-2025-63364HIGHWaveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discovEPSS 0.3%CVE-2026-81836MEDIUMRooCodeInc Roo-Code OAuth Callback oauth.ts cleartext transmissionEPSS 0.3%