Falhas do tipo CWE-319

583 resultados

Transmissão de dados sensíveis em texto plano

A aplicação envia informações sensíveis (senhas, tokens, dados pessoais) sem criptografia em um canal de comunicação que pode ser interceptado. Um atacante na rede consegue capturar esses dados facilmente com ferramentas simples como packet sniffers, comprometendo a confidencialidade.

Exemplo

Uma API envia credenciais de usuário via HTTP simples em vez de HTTPS, ou um sistema transmite tokens de autenticação em requisições GET visíveis em logs de proxy. Um atacante na mesma rede Wi-Fi captura os pacotes e acessa as credenciais diretamente.

Como mitigar

Use HTTPS/TLS em todas as comunicações envolvendo dados sensíveis, implemente criptografia end-to-end quando necessário, e nunca transmita credenciais em parâmetros de URL. Valide certificados SSL/TLS do lado cliente e revise protocolos legados (FTP, Telnet) para alternativas seguras.

CVE-2025-62330MEDIUMHCL DevOps Deploy is susceptible to a cleartext transmission of sensitive informationEPSS 0.2%CVE-2025-43013MEDIUMIn JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possibleEPSS 0.2%CVE-2025-27903MEDIUMMultiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and WindowsEPSS 0.2%CVE-2026-54586MEDIUMmport permits repository and package mirror fetches over insecure transportEPSS 0.2%CVE-2024-40595MEDIUMAn authentication-bypass issue in the RDP component of One Identity Safeguard for Privileged Sessions (SPS) On Premise before 7.5.1 (and LTSEPSS 0.2%CVE-2020-3442MEDIUMDuoConnect SSH Connection VulnerabilityEPSS 0.2%CVE-2026-79588MEDIUMU-speed WIFI4 N300 T1 Pro v1.0.0 is vulnerable to Cleartext transmission of administration credentials over HTTP.EPSS 0.2%CVE-2024-41927MEDIUMCleartext transmission of sensitive information vulnerability exists in multiple IDEC PLCs. If an attacker sends a specific command to PLC'sEPSS 0.2%CVE-2026-116200HIGHSnipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()EPSS 0.2%CVE-2024-0098MEDIUMCVEEPSS 0.2%CVE-2026-104704HIGHCleartext Transmission of Sensitive Information in hMailServerEPSS 0.1%CVE-2026-7666LOWPotential unencrypted email transmission via STARTTLS in the SMTP backendEPSS 0.1%CVE-2024-35210MEDIUMA vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server is not enfEPSS 0.1%CVE-2026-55568MEDIUMGuzzle: Silent HTTPS-Proxy Downgrade to CleartextEPSS 0.1%CVE-2024-28169MEDIUMCleartext transmission of sensitive information for some BigDL software maintained by Intel(R) before version 2.5.0 may allow an authenticatEPSS 0.1%CVE-2026-21742MEDIUMA cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 throughEPSS 0.1%CVE-2026-32838HIGHEdimax GS-5008PL <= 1.00.54 Transmits Credentials Over Cleartext HTTPEPSS 0.1%CVE-2025-54818HIGHCognex In-Sight Explorer and In-Sight Camera Firmware Cleartext Transmission of Sensitive InformationEPSS 0.1%CVE-2026-36610MEDIUMMercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over plaintext HTTP with only Base64 encoding. The firmwEPSS 0.1%CVE-2026-21812LOWMultiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)EPSS 0.1%