Falhas do tipo CWE-319

580 resultados

Transmissão de dados sensíveis em texto plano

A aplicação envia informações sensíveis (senhas, tokens, dados pessoais) sem criptografia em um canal de comunicação que pode ser interceptado. Um atacante na rede consegue capturar esses dados facilmente com ferramentas simples como packet sniffers, comprometendo a confidencialidade.

Exemplo

Uma API envia credenciais de usuário via HTTP simples em vez de HTTPS, ou um sistema transmite tokens de autenticação em requisições GET visíveis em logs de proxy. Um atacante na mesma rede Wi-Fi captura os pacotes e acessa as credenciais diretamente.

Como mitigar

Use HTTPS/TLS em todas as comunicações envolvendo dados sensíveis, implemente criptografia end-to-end quando necessário, e nunca transmita credenciais em parâmetros de URL. Valide certificados SSL/TLS do lado cliente e revise protocolos legados (FTP, Telnet) para alternativas seguras.

CVE-2026-53624MEDIUMFiber: HSTS header never set in helmet middleware due to incorrect protocol checkEPSS 0.2%CVE-2025-54156CRITICALSantesoft Sante PACS Server Cleartext Transmission of Sensitive InformationEPSS 0.2%CVE-2026-48978LOWoras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokensEPSS 0.2%CVE-2025-13490MEDIUMIBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that report metrics are vulnerable to loss of confidentialityEPSS 0.2%CVE-2026-50034HIGHApollo Pharmacy Blood Glucose Monitoring System APG-01 BT Cleartext Transmission of Sensitive InformationEPSS 0.2%CVE-2026-32309HIGHCryptomator: Hub unlocking accepts plaintext HTTP and unvalidated endpoint schemesEPSS 0.2%CVE-2024-5631MEDIUMLongse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, are transmitting user's login and passwordEPSS 0.2%CVE-2026-25608LOWLack of traffic encryption in STEREPSS 0.2%CVE-2024-0066MEDIUMJohan Fagerström, member of the AXIS OS Bug Bounty Program, has found that a O3C feature may expose sensitive traffic between the client (AxEPSS 0.2%CVE-2026-22306CRITICALCritical flaw impacting OZOLS ERP's automatic update channelEPSS 0.2%CVE-2025-36274HIGHIBM Aspera HTTP Gateway information disclosureEPSS 0.2%CVE-2022-2338MEDIUMSofting Secure Integration Server Cleartext Transmission of Sensitive InformationEPSS 0.2%CVE-2026-107285MEDIUMAsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnelEPSS 0.2%CVE-2022-0005LOWSensitive information accessible by physical probing of JTAG interface for some Intel(R) Processors with SGX may allow an unprivileged user EPSS 0.2%CVE-2024-45102MEDIUMA privilege escalation vulnerability was discovered that could allow a valid, authenticated LXCA user to escalate their permissions for a coEPSS 0.2%CVE-2025-44612MEDIUMTinxy WiFi Lock Controller v1 RF was discovered to transmit sensitive information in plaintext, including control information and device creEPSS 0.2%CVE-2021-23896LOWCleartext Transmission of Sensitive Information in McAfee DBSecEPSS 0.2%CVE-2026-18536HIGHData::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTPEPSS 0.2%CVE-2026-105245MEDIUMsgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmissionEPSS 0.2%CVE-2025-12530MEDIUMVulnerabilities found in Watson Data IntelligenceEPSS 0.2%