Filtered by CWE-319
Filtered by vendor Subscriptions
Total 774 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-22870 2 Ibm, Linux 2 Aspera Faspex, Linux Kernel 2024-11-21 5.9 Medium
IBM Aspera Faspex 5.0.5 transmits sensitive information in cleartext which could be obtained by an attacker using man in the middle techniques. IBM X-Force ID: 244121.
CVE-2023-0001 2 Microsoft, Paloaltonetworks 2 Windows, Cortex Xdr Agent 2024-11-21 6 Medium
An information exposure vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local system administrator to disclose the admin password for the agent in cleartext, which bad actors can then use to execute privileged cytool commands that disable or uninstall the agent.
CVE-2022-47892 1 Riello-ups 2 Netman 204, Netman 204 Firmware 2024-11-21 5.3 Medium
All versions of NetMan 204 could allow an unauthenticated remote attacker to read a file (config.cgi) containing sensitive information, like credentials.
CVE-2022-45877 1 Openharmony 1 Openharmony 2024-11-21 8.3 High
OpenHarmony-v3.1.4 and prior versions had an vulnerability. PIN code is transmitted to the peer device in plain text during cross-device authentication, which reduces the difficulty of man-in-the-middle attacks.
CVE-2022-42916 5 Apple, Fedoraproject, Haxx and 2 more 5 Macos, Fedora, Curl and 2 more 2024-11-21 7.5 High
In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN conversion, e.g., using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.). The earliest affected version is 7.77.0 2021-05-26.
CVE-2022-41327 1 Fortinet 2 Fortios, Fortiproxy 2024-11-21 7.6 High
A cleartext transmission of sensitive information vulnerability [CWE-319] in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.8, FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.8 allows an authenticated attacker with readonly superadmin privileges to intercept traffic in order to obtain other adminstrators cookies via diagnose CLI commands.
CVE-2022-40693 1 Moxa 4 Sds-3008, Sds-3008-t, Sds-3008-t Firmware and 1 more 2024-11-21 7.5 High
A cleartext transmission vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted network sniffing can lead to a disclosure of sensitive information. An attacker can sniff network traffic to trigger this vulnerability.
CVE-2022-3261 1 Redhat 2 Openstack, Openstack Platform 2024-11-21 4.4 Medium
A flaw was found in OpenStack. Multiple components show plain-text passwords in /var/log/messages during the OpenStack overcloud update run, leading to a disclosure of sensitive information problem.
CVE-2022-38846 1 Espocrm 1 Espocrm 2024-11-21 5.9 Medium
EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP). An attacker may capture the cookie from the insecure channel using MITM attack.
CVE-2022-36200 1 Fiberhome 2 Hg150-ub, Hg150-ub Firmware 2024-11-21 7.5 High
In FiberHome VDSL2 Modem HG150-Ub_V3.0, Credentials of Admin are submitted in URL, which can be logged/sniffed.
CVE-2022-34804 1 Jenkins 1 Opsgenie 2024-11-21 4.3 Medium
Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configuration forms, potentially resulting in their exposure.
CVE-2022-34801 1 Jenkins 1 Build Notifications 2024-11-21 4.3 Medium
Jenkins Build Notifications Plugin 1.5.0 and earlier transmits tokens in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
CVE-2022-33724 1 Google 1 Android 2024-11-21 3.3 Low
Exposure of Sensitive Information in Samsung Dialer application?prior to SMR Aug-2022 Release 1 allows local attackers to access ICCID via log.
CVE-2022-32245 1 Sap 1 Businessobjects Business Intelligence 2024-11-21 8.2 High
SAP BusinessObjects Business Intelligence Platform (Open Document) - versions 420, 430, allows an unauthenticated attacker to retrieve sensitive information plain text over the network. On successful exploitation, the attacker can view any data available for a business user and put load on the application by an automated attack. Thus, completely compromising confidentiality but causing a limited impact on the availability of the application.
CVE-2022-31204 1 Omron 15 Cp1w-cif41, Cp1w-cif41 Firmware, Cx-programmer and 12 more 2024-11-21 7.5 High
Omron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords. They feature a UM Protection setting that allows users or system integrators to configure a password in order to restrict sensitive engineering operations (such as project/logic uploads and downloads). This password is set using the OMRON FINS command Program Area Protect and unset using the command Program Area Protect Clear, both of which are transmitted in cleartext.
CVE-2022-30994 3 Acronis, Linux, Microsoft 3 Cyber Protect, Linux Kernel, Windows 2024-11-21 7.5 High
Cleartext transmission of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 29240
CVE-2022-30993 3 Acronis, Linux, Microsoft 3 Cyber Protect, Linux Kernel, Windows 2024-11-21 7.5 High
Cleartext transmission of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240
CVE-2022-30115 3 Haxx, Netapp, Splunk 15 Curl, Clustered Data Ontap, H300s and 12 more 2024-11-21 4.3 Medium
Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL.
CVE-2022-2083 1 Simple Sign On Project 1 Simple Sign On 2024-11-21 7.5 High
The Simple Single Sign On WordPress plugin through 4.1.0 leaks its OAuth client_secret, which could be used by attackers to gain unauthorized access to the site.
CVE-2022-29945 1 Dji 22 Air 2, Air 2 Firmware, Air 2s and 19 more 2024-11-21 4 Medium
DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope protocol.