Falhas do tipo CWE-319

582 resultados

Transmissão de dados sensíveis em texto plano

A aplicação envia informações sensíveis (senhas, tokens, dados pessoais) sem criptografia em um canal de comunicação que pode ser interceptado. Um atacante na rede consegue capturar esses dados facilmente com ferramentas simples como packet sniffers, comprometendo a confidencialidade.

Exemplo

Uma API envia credenciais de usuário via HTTP simples em vez de HTTPS, ou um sistema transmite tokens de autenticação em requisições GET visíveis em logs de proxy. Um atacante na mesma rede Wi-Fi captura os pacotes e acessa as credenciais diretamente.

Como mitigar

Use HTTPS/TLS em todas as comunicações envolvendo dados sensíveis, implemente criptografia end-to-end quando necessário, e nunca transmita credenciais em parâmetros de URL. Valide certificados SSL/TLS do lado cliente e revise protocolos legados (FTP, Telnet) para alternativas seguras.

CVE-2025-32887HIGHAn issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. A command channel includes the next hop. which can be inteEPSS 0.2%CVE-2026-5115LOWSession hijacking in PaperCut NG/MF embedded application for Konica Minolta devicesEPSS 0.2%CVE-2026-29988HIGHA cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affecteEPSS 0.2%CVE-2025-4227LOWGlobalProtect App: Interception in Endpoint Traffic Policy EnforcementEPSS 0.2%CVE-2025-32884MEDIUMAn issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. By default, a GID is the user's phone number unless theyEPSS 0.2%CVE-2025-32881MEDIUMAn issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. By default, the GID is the user's phone number unless theyEPSS 0.2%CVE-2026-73174HIGHNozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive Information vulnerability in the edgserver management protocoEPSS 0.2%CVE-2024-44105HIGHCleartext transmission of sensitive information in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allEPSS 0.2%CVE-2026-38740MEDIUMFoscam VD1 Video Doorbell before V5.3.13_1072 is vulnerable to Cleartext Transmission of Sensitive Information. The device transmits sensitiEPSS 0.2%CVE-2026-103098HIGHGV-Eye Sensitive information exposure in URL query parameter VulnerabilityEPSS 0.2%CVE-2025-7743CRITICALSensitive Data Exposure in Dolusoft's OmaspotEPSS 0.2%CVE-2026-20115MEDIUMA vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device informaEPSS 0.2%CVE-2025-15619LOWHCL Connections is vulnerable to broken access controlEPSS 0.2%CVE-2024-5462MEDIUMBrocade Fabric OS may capture SNMP Passwords in clear textEPSS 0.2%CVE-2024-9620MEDIUMEvent-driven automation in ansible automation platform (aap): ansible event-driven automation (eda) lacks encryptionEPSS 0.2%CVE-2023-0864HIGHConfiguration data is exchanged in plaintext and could be available to a nearby attacker if present during configuration or usage of the device via Bluetooth Low Energy (BLE).EPSS 0.2%CVE-2024-28786MEDIUMIBM QRadar SIEM information disclosureEPSS 0.2%CVE-2025-62330MEDIUMHCL DevOps Deploy is susceptible to a cleartext transmission of sensitive informationEPSS 0.2%CVE-2026-67105HIGHHCL BigFix Service Management is affected by multiple security vulnerabilities.EPSS 0.2%CVE-2024-36558HIGHForever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h suffers from Cleartext Transmission of Sensitive InformatioEPSS 0.2%