CWE:

	Topic	Date	Author
Med.	Real Estate 7 WordPress v2.9.4 Multiple Vulnerabilities	13.01.2020	m0ze
High	Across DR-810 ROM-0 - Backup File Disclosure	12.01.2019	SajjadBnz
Med.	MensaMax 4.3 Hardcoded Encryption Key Disclosure	02.10.2018	Stefan Pietsch
Med.	Trend Micro ServerProtect Disclosure / CSRF / XSS	26.05.2017	Multiple
Med.	QNAP QTS 4.2.x XSS / Command Injection / Transport Issues	18.02.2017	Harry Sintonen
Med.	Intel Driver Update Utility 2.2.0.5 Man-In-The-Middle	20.01.2016	Core
Med.	ElasticSearch Cloud-Azure Insecure Transit	20.09.2015	Pedro Andujar

---

CVEMAP Search Results

CVE

Details

Description

2020-07-27

Low

CVE-2020-15954

Vendor: KDE Software: Kmail

KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use.

2020-07-22

Low

CVE-2020-4397

Vendor: IBM Software: Verify gateway

IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 transmits sensitive information in plain text which could be obtained by an attacker using man in the middle techniques. IBM X-Force ID: 179428.

2020-07-20

Low

CVE-2020-3442

Vendor: DUO Software: Duoconnect

2020-07-14

Low

CVE-2020-7592

Vendor: Siemens Software: Simatic hmi ...

A vulnerability has been identified in SIMATIC HMI Basic Panels 1st Generation (incl. SIPLUS variants) (All versions), SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions), SIMATIC HMI KTP700F Mobile Arctic (All versions), SIMATIC HMI Mobile Panels 2nd Generation (All versions), SIMATIC WinCC Runtime Advanced (All versions). Unencrypted communication between the configuration software and the respective device could allow an attacker to capture potential plain text communication and have access to sensitive information.

2020-07-09

Medium

CVE-2020-14171

Vendor: Atlassian Software: Bitbucket

Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted repository import requests via a Man-in-the-Middle (MITM) attack.

2020-07-02

Low

CVE-2020-2210

Vendor: Jenkins Software: Stash branch...

Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.

2020-06-23

Medium

CVE-2020-5594

Updating...

Mitsubishi Electric MELSEC iQ-R, iQ-F, Q, L, and FX series CPU modules all versions contain a vulnerability that allows cleartext transmission of sensitive information between CPU modules and GX Works3 and/or GX Works2 via unspecified vectors.

2020-05-13

Medium

CVE-2020-2013

Vendor: Paloaltonetworks Software: Pan-os

A cleartext transmission of sensitive information vulnerability in Palo Alto Networks PAN-OS Panorama that discloses an authenticated PAN-OS administrator's PAN-OS session cookie. When an administrator issues a context switch request into a managed firewall with an affected PAN-OS Panorama version, their PAN-OS session cookie is transmitted over cleartext to the firewall. An attacker with the ability to intercept this network traffic between the firewall and Panorama can access the administrator's account and further manipulate devices managed by Panorama. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.6; PAN-OS 9.1 versions earlier than 9.1.1; All version of PAN-OS 8.0;

2020-05-06

Medium

CVE-2020-4092

Vendor: Hcltech Software: Hcl nomad

"If port encryption is not enabled on the Domino Server, HCL Nomad on Android and iOS Platforms will communicate in clear text and does not currently have a user interface option to change the setting to request an encrypted communication channel with the Domino server. This can potentially expose sensitive information including but not limited to server names, user IDs and document content."

2020-04-22

Medium

CVE-2020-7488

Vendor: SE Software: Ecostruxure ...

A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could leak sensitive information transmitted between the software and the Modicon M218, M241, M251, and M258 controllers.

 

---

Copyright 2020, cxsecurity.com