CWE-319

Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext trans

The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't e

MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level atta

A lack of authentication and authorization mechanisms in the Bluetooth Low Energy (BLE) communication protocol of SRK Po

Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted,

Cleartext Transmission of Sensitive Information vulnerability in Pan Software & Information Technologies Ltd. PanCafe Pr

AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenti

A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device mo

Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext.

QiHang Media Web Digital Signage 3.0.9 contains a sensitive information disclosure vulnerability that allows remote atta

iDS6 DSSPro Digital Signage System 6.2 contains a sensitive information disclosure vulnerability that allows remote atta

Cleartext Transmission of Sensitive Information vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Sn

Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains a Cleartext Transmi

The embedded web interface of the device does not support HTTPS/TLS for authentication and uses HTTP Basic Authenticati

In Microsoft Exchange through 2019, Exchange ActiveSync (EAS) configurations on on-premises servers may transmit sensiti

Cleartext Transmission of Sensitive Information vulnerability in rustdesk-client RustDesk Client rustdesk-client on Wind

An issue pertaining to CWE-319: Cleartext Transmission of Sensitive Information was discovered in Nexusoft NexusInterfac

Cleartext transmission of sensitive information in Azure IoT Explorer allows an unauthorized attacker to disclose inform

Missing authentication for critical function in Azure IoT Explorer allows an unauthorized attacker to disclose informati

Edimax GS-5008PL firmware version 1.00.54 and prior use cleartext HTTP for the web management interface without implemen

Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.1, the Hub-based unlock flow expli

The PaperCut NG/MF (specifically, the embedded application for Konica Minolta devices) is vulnerable to session hijackin

Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to `ssl_verify` in o

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the password re

Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids. If the communication channel to the sta

Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done u

NVIDIA Isaac Launchable for Linux contains a vulnerability where sensitive information is transmitted in clear text. A s

TP-Link has identified a vulnerability in Tapo L535E v1.0 and v3.0, Tapo P300 v1.0, and Tapo D100C v1.0, where Bluetooth

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applicati

The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p(

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2025.5.0, The

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource:

openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting

A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web manag

Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw in Deno's Node.js tls compatib

The Amazon SageMaker Python SDK before v3.2.0 and v2.256.0 includes the ModelBuilder HMAC signing key in the cleartext r

The Process Optimization application suite leverages connection channels/protocols that by-default are not encrypted an

ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automa

Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords and filtering rules

A physical attack vulnerability exists in certain Moxa industrial computers using TPM-backed LUKS full-disk encryption o

Open WebUI Cleartext Transmission of Credentials Information Disclosure Vulnerability. This vulnerability allows network

Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains a Cleartext Transmi

A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior versi

In multiple functions of btm_ble_sec.cc, there is a possible unencrypted communication due to Invalid error handling. Th

IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to exposure of sensitive information via JSON

A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOA

Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on‑path attackers to sniff credentials and ses

A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side F

An attacker within BLE communication range can passively intercept wireless traffic and obtain sensitive health-related

@hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Authorization, Cookie,