Falhas do tipo CWE-319

583 resultados

Transmissão de dados sensíveis em texto plano

A aplicação envia informações sensíveis (senhas, tokens, dados pessoais) sem criptografia em um canal de comunicação que pode ser interceptado. Um atacante na rede consegue capturar esses dados facilmente com ferramentas simples como packet sniffers, comprometendo a confidencialidade.

Exemplo

Uma API envia credenciais de usuário via HTTP simples em vez de HTTPS, ou um sistema transmite tokens de autenticação em requisições GET visíveis em logs de proxy. Um atacante na mesma rede Wi-Fi captura os pacotes e acessa as credenciais diretamente.

Como mitigar

Use HTTPS/TLS em todas as comunicações envolvendo dados sensíveis, implemente criptografia end-to-end quando necessário, e nunca transmita credenciais em parâmetros de URL. Valide certificados SSL/TLS do lado cliente e revise protocolos legados (FTP, Telnet) para alternativas seguras.

CVE-2023-52951MEDIUMA cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle atEPSS 0.1%CVE-2022-22457MEDIUMIBM Security Verify Governance, Identity Manager information disclosureEPSS 0.1%CVE-2026-23564MEDIUMTransmission of Unencrypted Data in Content Distribution ServiceEPSS 0.1%CVE-2025-2818MEDIUMA vulnerability was reported in version 1.0 of the Bluetooth Transmission Alliance protocol adopted by Motorola Smart Connect Android ApplicEPSS 0.1%CVE-2022-41327HIGHA cleartext transmission of sensitive information vulnerability [CWE-319] in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0EPSS 0.1%CVE-2025-10540MEDIUMUnencrypted and Unauthenticated Communication Allows Data Exposure and Manipulation in iMonitor EAMEPSS 0.1%CVE-2026-82585HIGHBotslab G980H Dashcams Cleartext Transmission of Sensitive InformationEPSS 0.1%CVE-2026-22079HIGHCleartext Transmission Vulnerability in Tenda Wireless RoutersEPSS 0.1%CVE-2026-22080HIGHInsecure Transmission Vulnerability in Tenda Wireless RoutersEPSS 0.1%CVE-2024-8013LOWCSFLE and Queryable Encryption self-lookup may fail to encrypt values in subpipelinesEPSS 0.1%CVE-2026-64893HIGH- Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack. This issuEPSS 0.1%CVE-2026-20801MEDIUMCleartext Transmission of Sensitive Information (CWE-319) in a component used in the Gallagher Hanwha VMS and Gallagher NxWitness VMS integrEPSS 0.1%CVE-2026-40045MEDIUMOpenClaw < 2026.4.2 - Cleartext Credential Transmission via Unencrypted WebSocket Gateway EndpointsEPSS 0.1%CVE-2023-47745MEDIUMIBM MQ Container information disclosureEPSS 0.1%CVE-2026-116166HIGHSiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS SettingEPSS 0.1%CVE-2025-40583MEDIUMA vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V2.1 HF0 with SINEMA Remote Connect Edge ClientEPSS 0.1%CVE-2025-63292LOWFreebox v5 HD (firmware = 1.7.20), Freebox v5 Crystal (firmware = 1.7.20), Freebox v6 Révolution r1–r3 (firmware = 4.7.x), Freebox Mini 4K (EPSS 0.1%CVE-2026-25599MEDIUMMissing authentication and clear‑text data transmission affecting Orca heat pumpsEPSS 0.1%CVE-2025-53861LOWAap: sensitive cookie(s) set without security flagsEPSS 0.1%CVE-2024-25960HIGHDell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains a cleartext transmission of sensitive information vulnerability. A local lowEPSS 0.1%