Filtered by CWE-319
Filtered by vendor Subscriptions
Total 756 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2018-0025 1 Juniper 21 Junos, Srx100, Srx110 and 18 more 2024-11-21 N/A
When an SRX Series device is configured to use HTTP/HTTPS pass-through authentication services, a client sending authentication credentials in the initial HTTP/HTTPS session is at risk that these credentials may be captured during follow-on HTTP/HTTPS requests by a malicious actor through a man-in-the-middle attack or by authentic servers subverted by malicious actors. FTP, and Telnet pass-through authentication services are not affected. Affected releases are Juniper Networks SRX Series: 12.1X46 versions prior to 12.1X46-D67 on SRX Series; 12.3X48 versions prior to 12.3X48-D25 on SRX Series; 15.1X49 versions prior to 15.1X49-D35 on SRX Series.
CVE-2017-9637 1 Schneider-electric 1 Ampla Manufacturing Execution System 2024-11-21 N/A
Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases. When connectivity to those databases is configured to use a SQL user name and password, an attacker may be able to sniff details from the connection string. Schneider Electric recommends that users of Ampla MES versions 6.4 and prior should upgrade to Ampla MES version 6.5 as soon as possible.
CVE-2017-8154 1 Huawei 2 Honor 8 Lite, Honor 8 Lite Firmware 2024-11-21 N/A
The Themes App Honor 8 Lite Huawei mobile phones with software of versions before Prague-L31C576B172, versions before Prague-L31C530B160, versions before Prague-L31C432B180 has a man-in-the-middle (MITM) vulnerability due to the use of the insecure HTTP protocol for theme download. An attacker may exploit this vulnerability to tamper with downloaded themes.
CVE-2017-7252 1 Botan Project 1 Botan 2024-11-21 7.5 High
bcrypt password hashing in Botan before 2.1.0 does not correctly handle passwords with a length between 57 and 72 characters, which makes it easier for attackers to determine the cleartext password.
CVE-2017-16041 1 Ikst Project 1 Ikst 2024-11-21 N/A
ikst versions before 1.1.2 download resources over HTTP, which leaves it vulnerable to MITM attacks.
CVE-2017-16040 1 Gfe-sass Project 1 Gfe-sass 2024-11-21 N/A
gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVE-2017-16035 1 Hubspot 1 Hubl-server 2024-11-21 N/A
The hubl-server module is a wrapper for the HubL Development Server. During installation hubl-server downloads a set of dependencies from api.hubapi.com. It appears in the code that these files are downloaded over HTTPS however the api.hubapi.com endpoint redirects to a HTTP url. Because of this behavior an attacker with the ability to man-in-the-middle a developer or system performing a package installation could compromise the integrity of the installation.
CVE-2017-12716 1 Abbott 8 Accent, Accent Firmware, Accent Mri and 5 more 2024-11-21 N/A
Abbott Laboratories Accent and Anthem pacemakers manufactured prior to Aug 28, 2017 transmit unencrypted patient information via RF communications to programmers and home monitoring units. Additionally, the Accent and Anthem pacemakers store the optional patient information without encryption. CVSS v3 base score: 3.1, CVSS vector string: AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Abbott has developed a firmware update to help mitigate the identified vulnerabilities.
CVE-2017-0925 2 Debian, Gitlab 2 Debian Linux, Gitlab 2024-11-21 N/A
Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resulting in an information disclosure of plaintext password.
CVE-2016-5649 1 Netgear 4 Dgn2200, Dgn2200 Firmware, Dgnd3700 and 1 more 2024-11-21 N/A
A vulnerability is in the 'BSW_cxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.50_7.0.50, and DGND3700, version DGND3700-V1.0.0.17_1.0.17, which can allow a remote attacker to access this page without any authentication. When processed, it exposes the admin password in clear text before it gets redirected to absw_vfysucc.cgia. An attacker can use this password to gain administrator access to the targeted router's web interface.
CVE-2016-5638 1 Netgear 2 Wndr4500, Wndr4500 Firmware 2024-11-21 N/A
There are few web pages associated with the genie app on the Netgear WNDR4500 running firmware version V1.0.1.40_1.0.6877. Genie app adds some capabilities over the Web GUI and can be accessed even when you are away from home. A remote attacker can access genie_ping.htm or genie_ping2.htm or genie_ping3.htm page without authentication. Once accessed, the page will be redirected to the aCongratulations2.htma page, which reveals some sensitive information such as 2.4GHz & 5GHz Wireless Network Name (SSID) and Network Key (Password) in clear text.
CVE-2015-7542 3 Aquamaniac, Debian, Opensuse 3 Gwenhywfar, Debian Linux, Leap 2024-11-21 5.3 Medium
A vulnerability exists in libgwenhywfar through 4.12.0 due to the usage of outdated bundled CA certificates.
CVE-2014-5380 1 Granding 2 Grand Ma300, Grand Ma300 Firmware 2024-11-21 7.5 High
Grand MA 300 allows retrieval of the access PIN from sniffed data.
CVE-2014-0048 2 Apache, Docker 2 Geode, Docker 2024-11-21 9.8 Critical
An issue was found in Docker before 1.6.0. Some programs and scripts in Docker are downloaded via HTTP and then executed or used in unsafe ways.
CVE-2012-5562 1 Redhat 2 Network Proxy, Satellite 2024-11-21 6.5 Medium
rhn-proxy: may transmit credentials over clear-text when accessing RHN Satellite
CVE-2012-1257 1 Pidgin 1 Pidgin 2024-11-21 5.5 Medium
Pidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain sensitive information via a dbus session monitor.
CVE-2010-4177 2 Fedoraproject, Oracle 2 Fedora, Mysql-gui-tools 2024-11-21 5.5 Medium
mysql-gui-tools (mysql-query-browser and mysql-admin) before 5.0r14+openSUSE-2.3 exposes the password of a user connected to the MySQL server in clear text form via the list of running processes.
CVE-2003-5002 1 Ibm 1 Iss Blackice Pc Protection 2024-11-21 3.7 Low
A vulnerability was found in ISS BlackICE PC Protection. It has been declared as problematic. Affected by this vulnerability is the component Update Handler which allows cleartext transmission of data. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVE-2024-9834 1 Baxter 1 Life2000 Ventilator Firmware 2024-11-15 9.3 Critical
Improper data protection on the ventilator's serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance.
CVE-2024-28169 2024-11-15 5.4 Medium
Cleartext transmission of sensitive information for some BigDL software maintained by Intel(R) before version 2.5.0 may allow an authenticated user to potentially enable denial of service via adjacent access.