Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

CVEs (923)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-18199 1Fujitsu 1Lx390 Firmware Jun 17, 2026 Oct 24, 2019 N/A· v4 6.6 MEDIUM· v3 6.9 MEDIUM· v2 An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, and because of password-based authentication, they are vulnerable to replay...Show more An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, and because of password-based authentication, they are vulnerable to replay attacks.Show less
CVE-2019-12967 1Themooltipass 1Moolticute Jun 17, 2026 Oct 22, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Stephan Mooltipass Moolticute through 0.42.1 (and possibly earlier versions) has Incorrect Access Control.
CVE-2019-17393 1Tomedo 1Server Jun 17, 2026 Oct 18, 2019 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 The Customer's Tomedo Server in Version 1.7.3 communicates to the Vendor Tomedo Server via HTTP (in cleartext) that can be sniffed by unauthorized actors. Basic authentication is used for the authentication, making it po...Show more The Customer's Tomedo Server in Version 1.7.3 communicates to the Vendor Tomedo Server via HTTP (in cleartext) that can be sniffed by unauthorized actors. Basic authentication is used for the authentication, making it possible to base64 decode the sniffed credentials and discover the username and password.Show less
CVE-2019-15626 1Trendmicro 1Deep Security Jun 17, 2026 Oct 17, 2019 N/A· v4 7.5 HIGH· v3 4.3 MEDIUM· v2 The Deep Security Manager application (Versions 10.0, 11.0 and 12.0), when configured in a certain way, may transmit initial LDAP communication in clear text. This may result in confidentiality impact but does not impact...Show more The Deep Security Manager application (Versions 10.0, 11.0 and 12.0), when configured in a certain way, may transmit initial LDAP communication in clear text. This may result in confidentiality impact but does not impact integrity or availability.Show less
CVE-2019-17356 1Infinitestudio 1Infinite Design Jun 17, 2026 Oct 15, 2019 N/A· v4 6.5 MEDIUM· v3 3.3 LOW· v2 The Infinite Design application 3.4.12 for Android sends a username and password via TCP without any encryption during login, as demonstrated by sniffing of a public Wi-Fi network.
CVE-2019-9532 1Cobham 1Explorer 710 Firmware Jun 17, 2026 Oct 10, 2019 N/A· v4 7.8 HIGH· v3 2.1 LOW· v2 The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext. This could allow an unauthenticated, local attacker to intercept the password and gain access to the po...Show more The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext. This could allow an unauthenticated, local attacker to intercept the password and gain access to the portal.Show less
CVE-2019-0069 1Juniper 1Junos Jun 17, 2026 Oct 9, 2019 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 On EX4600, QFX5100 Series, NFX Series, QFX10K Series, QFX5110, QFX5200 Series, QFX5110, QFX5200, QFX10K Series, vSRX, SRX1500, SRX4000 Series, vSRX, SRX1500, SRX4000, QFX5110, QFX5200, QFX10K Series, when the user uses c...Show more On EX4600, QFX5100 Series, NFX Series, QFX10K Series, QFX5110, QFX5200 Series, QFX5110, QFX5200, QFX10K Series, vSRX, SRX1500, SRX4000 Series, vSRX, SRX1500, SRX4000, QFX5110, QFX5200, QFX10K Series, when the user uses console management port to authenticate, the credentials used during device authentication are written to a log file in clear text. This issue does not affect users that are logging-in using telnet, SSH or J-web to the management IP. This issue affects ACX, NFX, SRX, EX and QFX platforms with the Linux Host OS architecture, it does not affect other SRX and EX platforms that do not use the Linux Host OS architecture. This issue affects Juniper Networks Junos OS: 15.1X49 versions prior to 15.1X49-D110 on vSRX, SRX1500, SRX4000 Series; 15.1X53 versions prior to 15.1X53-D234 on QFX5110, QFX5200 Series; 15.1X53 versions prior to 15.1X53-D68 on QFX10K Series; 17.1 versions prior to 17.1R2-S8, 17.1R3, on QFX5110, QFX5200, QFX10K Series; 17.2 versions prior to 17.2R1-S7, 17.2R2-S6, 17.2R3 on QFX5110, QFX5200, QFX10K Series; 17.3 versions prior to 17.3R2 on vSRX, SRX1500, SRX4000, QFX5110, QFX5200, QFX10K Series; 14.1X53 versions prior to 14.1X53-D47 on ACX5000, EX4600, QFX5100 Series; 15.1 versions prior to 15.1R7 on ACX5000, EX4600, QFX5100 Series; 16.1R7 versions prior to 16.1R7 on ACX5000, EX4600, QFX5100 Series; 17.1 versions prior to 17.1R2-S10, 17.1R3 on ACX5000, EX4600, QFX5100 Series; 17.2 versions prior to 17.2R3 on ACX5000, EX4600, QFX5100 Series; 17.3 versions prior to 17.3R3 on ACX5000, EX4600, QFX5100 Series; 17.4 versions prior to 17.4R2 on ACX5000, EX4600, QFX5100 Series; 18.1 versions prior to 18.1R2 on ACX5000, EX4600, QFX5100 Series; 15.1X53 versions prior to 15.1X53-D496 on NFX Series, 17.2 versions prior to 17.2R3-S1 on NFX Series; 17.3 versions prior to 17.3R3-S4 on NFX Series; 17.4 versions prior to 17.4R2-S4, 17.4R3 on NFX Series, 18.1 versions prior to 18.1R3-S4 on NFX Series; 18.2 versions prior to 18.2R2-S3, 18.2R3 on NFX Series; 18.3 versions prior to 18.3R1-S3, 18.3R2 on NFX Series; 18.4 versions prior to 18.4R1-S1, 18.4R2 on NFX Series.Show less
CVE-2019-14808 1Renpho 1Renpho Jun 17, 2026 Oct 9, 2019 N/A· v4 6.8 MEDIUM· v3 4.0 MEDIUM· v2 An issue was discovered in the RENPHO application 3.0.0 for iOS. It transmits JSON data unencrypted to a server without an integrity check, if a user changes personal data in his profile tab (e.g., exposure of his birthd...Show more An issue was discovered in the RENPHO application 3.0.0 for iOS. It transmits JSON data unencrypted to a server without an integrity check, if a user changes personal data in his profile tab (e.g., exposure of his birthday) or logs into his account (i.e., exposure of credentials).Show less
CVE-2019-17218 1Vzug 1Combi Stream Mslq Firmware Jun 17, 2026 Oct 6, 2019 N/A· v4 9.1 CRITICAL· v3 5.0 MEDIUM· v2 An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. By default, the communication to the web service is unencrypted via http. An attacker is able to intercept and sniff comm...Show more An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. By default, the communication to the web service is unencrypted via http. An attacker is able to intercept and sniff communication to the web service.Show less
CVE-2019-14959 1Jetbrains 1Toolbox Jun 17, 2026 Oct 2, 2019 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 JetBrains Toolbox before 1.15.5605 was resolving an internal URL via a cleartext http connection.
CVE-2019-0231 1Apache 1Mina Jun 17, 2026 Oct 1, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0...Show more Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This issue affects: Apache MINA.Show less
CVE-2019-14954 1Jetbrains 1Intellij Idea Jun 17, 2026 Oct 1, 2019 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http connection.
CVE-2019-10435 1Jenkins 1Sourcegear Vault Jun 17, 2026 Oct 1, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.
CVE-2019-10434 1Jenkins 1Ldap Email Jun 17, 2026 Oct 1, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
CVE-2019-4280 1Ibm 1Sterling File Gateway Jun 17, 2026 Sep 30, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 displays sensitive information in HTTP requests which could be used in further attacks against the system. IBM X-Force ID: 160503.
CVE-2019-16924 1Nuvending 1Nulock Jun 17, 2026 Sep 27, 2019 N/A· v4 8.8 HIGH· v3 3.3 LOW· v2 The Nulock application 1.5.0 for mobile devices sends a cleartext password over Bluetooth, which allows remote attackers (after sniffing the network) to take control of the lock.
CVE-2019-11739 1Mozilla 1Thunderbird Jun 17, 2026 Sep 27, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird < 68.1 and Thunderbird < 60.9.
CVE-2019-6652 1F5 1Big Iq Centralized Management Jun 17, 2026 Sep 25, 2019 N/A· v4 6.5 MEDIUM· v3 6.4 MEDIUM· v2 In BIG-IQ 6.0.0-6.1.0, services for stats do not require authentication nor do they implement any form of Transport Layer Security (TLS).
CVE-2019-10428 1Jenkins 1Aqua Security Scanner Jun 17, 2026 Sep 25, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
CVE-2019-10427 1Jenkins 1Aqua Microscanner Jun 17, 2026 Sep 25, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Jenkins Aqua MicroScanner Plugin 1.0.7 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

Previous 1...383940...47 Next