Filtered by CWE-319
Filtered by vendor Subscriptions
Total 876 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2016-5597 2 Oracle, Redhat 6 Jdk, Jre, Enterprise Linux and 3 more 2025-11-05 N/A
Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect confidentiality via vectors related to Networking.
CVE-2023-46385 1 Loytec 1 L-inx Configurator 2025-11-04 7.5 High
LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. An admin credential is passed as a value of URL parameters without encryption, so it allows remote attackers to steal the password and gain full control of Loytec device configuration.
CVE-2023-46383 1 Loytec 1 L-inx Configurator 2025-11-04 7.5 High
LOYTEC electronics GmbH LINX Configurator (all versions) uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext and allows remote attackers to steal the password and gain full control of Loytec device configuration.
CVE-2023-46382 1 Loytec 6 Linx-212, Linx-212 Firmware, Liob-586 and 3 more 2025-11-04 7.5 High
LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) use cleartext HTTP for login.
CVE-2023-46380 1 Loytec 10 L-inx Configurator, Linx-151, Linx-212 and 7 more 2025-11-04 7.5 High
LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) send password-change requests via cleartext HTTP.
CVE-2023-39172 1 Enbw 2 Senec Storage Box, Senec Storage Box Firmware 2025-11-04 9.1 Critical
The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic.
CVE-2020-10124 1 Ncr 2 Aptra Xfs, Selfserv Atm 2025-11-04 7.1 High
NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the integrity of messages between the BNA and the host computer, which could allow an attacker with physical access to the internal components of the ATM to execute arbitrary code, including code that enables the attacker to commit deposit forgery.
CVE-2024-25735 1 Wyrestorm 2 Apollo Vx20, Apollo Vx20 Firmware 2025-11-04 9.1 Critical
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext passwords via a SoftAP /device/config GET request.
CVE-2023-32328 1 Ibm 1 Security Verify Access 2025-11-04 7.5 High
IBM Security Verify Access 10.0.0.0 through 10.0.6.1 uses insecure protocols in some instances that could allow an attacker on the network to take control of the server. IBM X-Force Id: 254957.
CVE-2025-62643 2 Rbi, Restaurant Brands International 2 Restaurant Brands International Assistant, Assistant Platform 2025-10-31 3.4 Low
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 transmits passwords of user accounts in cleartext e-mail messages.
CVE-2024-39746 3 Ibm, Linux, Microsoft 5 Aix, Sterling Connect\, Sterling Connect Direct Web Services and 2 more 2025-10-31 5.9 Medium
IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
CVE-2025-31972 1 Hcltech 1 Bigfix Service Management 2025-10-29 6.5 Medium
HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data transmitted between internal components.
CVE-2025-11640 2 Furbo, Tomofun 6 Furbo 360 Dog Camera, Furbo 360 Dog Camera Firmware, Furbo Mini and 3 more 2025-10-29 3.1 Low
A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. This affects an unknown function of the component Bluetooth Low Energy. The manipulation results in cleartext transmission of sensitive information. Access to the local network is required for this attack. Attacks of this nature are highly complex. The exploitability is reported as difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-59406 3 Flock Safety, Flocksafety, Google 7 Bravo Edge Ai Compute Device, Bravo Edge Ai Compute Device, Falcon and 4 more 2025-10-24 6.2 Medium
The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) has a cleartext Auth0 client secret in its codebase. Because application binaries can be trivially decompiled or inspected, attackers can recover this OAuth secret without special privileges. This secret is intended to remain confidential and should never be embedded directly in client-side software.
CVE-2025-36020 1 Ibm 2 Guardium Data Protection, Security Guardium 2025-10-22 5.9 Medium
IBM Guardium Data Protection could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive credential information.
CVE-2025-55976 1 Intelbras 2 Iwr 3000n, Iwr 3000n Firmware 2025-10-17 8.4 High
Intelbras IWR 3000N 1.9.8 exposes the Wi-Fi password in plaintext via the /api/wireless endpoint. Any unauthenticated user on the local network can directly obtain the Wi-Fi network password by querying this endpoint.
CVE-2025-54156 1 Santesoft 1 Sante Pacs Server 2025-10-17 7.4 High
The Sante PACS Server Web Portal sends credential information without encryption.
CVE-2025-7743 1 Dolusoft 1 Omaspot 2025-10-15 9.6 Critical
Cleartext Transmission of Sensitive Information vulnerability in Dolusoft Omaspot allows Interception, Privilege Escalation.This issue affects Omaspot: before 12.09.2025.
CVE-2025-2861 1 Arteche 2 Satech Bcu, Satech Bcu Firmware 2025-10-10 7.5 High
SaTECH BCU in its firmware version 2.1.3 uses the HTTP protocol. The use of the HTTP protocol for web browsing has the problem that information is exchanged in unencrypted text. Since sensitive data such as credentials are exchanged, an attacker could obtain them and log in legitimately.
CVE-2024-25650 1 Delinea 2 Distributed Engine, Secret Server 2025-10-10 5.9 Medium
Insecure key exchange between Delinea PAM Secret Server 11.4 and the Distributed Engine 8.4.3 allows a PAM administrator to obtain the Symmetric Key (used to encrypt RabbitMQ messages) via crafted payloads to the /pre-authenticate, /authenticate, and /execute-and-respond REST API endpoints. This makes it possible for a PAM administrator to impersonate the Engine and exfiltrate sensitive information from the messages published in the RabbitMQ exchanges, without being audited in the application.