Threats Tagged 'cwe-319'

The Botslab G980H dash camera firmware transmits sensitive information over unencrypted HTTP and RTSP connections. An attacker capable of intercepting communications on the device's WiFi network could obtain stored recordings, live video, location information, images, diagnostic logs, or other sensitive information exchanged between the device and its mobile application.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive information.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive information.

Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that were connected to the affected MQTT broker.

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques.

CVE-2026-54586 is a vulnerability in the MidnightBSD package manager mport prior to version 2.7.8. It involves cleartext transmission of sensitive information due to acceptance of non-HTTPS URLs for repository and package mirrors. This allows a network-positioned attacker to tamper with package index or download traffic, potentially compromising package selection or integrity. The issue is fixed in version 2.7.8.

AsyncHttpClient versions from 2.0.0 up to but not including 2.16.1, and from 3.0.0 up to but not including 3.0.12, have a vulnerability where HTTP proxy requests to HTTPS origins expose preemptive origin credentials in cleartext. This occurs because authorization headers are sent in the plaintext CONNECT request before the TLS tunnel is established, potentially exposing sensitive credentials to the proxy or observers on the client-to-proxy connection. The issue is fixed in versions 2.16.1 and 3.0.12.

AsyncHttpClient versions from 2.1.0 up to but not including 2.16.1 and from 3.0.0 up to but not including 3.0.12 allow proxy credentials to be exposed in cleartext. This occurs when using an authenticated SOCKS proxy, where the Proxy-Authorization header is attached to requests without verifying the proxy type, potentially exposing sensitive credentials to the origin server. The issue is fixed in versions 2.16.1 and 3.0.12.

CVE-2026-73174 is a high-severity vulnerability in the Advantech EKI-1242IEIMS device firmware version V1.06.01. It involves cleartext transmission of sensitive information via the edgserver management protocol, allowing a network-adjacent passive observer to intercept management traffic and recover sensitive device identity and network metadata.

Transmission of the home Wi-Fi credentials without encryption during the pairing process between the DuoxMe application and VEO and VEO-XS Wi-Fi monitors, in versions prior to 4.3.4 of the application and 01.50.001 of the monitor firmware, allows an attacker on the Wi-Fi Direct network to intercept the network password.