CVE-2025-54810: Authentication Bypass by Capture-replay

Cognex In-Sight Explorer and In-Sight Camera Firmware expose a proprietary protocol on TCP port 1069 to perform management operations such as modifying system properties. The user management functionality handles sensitive data such as registered usernames and passwords over an unencrypted channe...

CVE-2025-53703 DuraComm DP-10iN-100-MU Cleartext Transmission of Sensitive Information

DuraComm SPM-500 DP-10iN-100-MU transmits sensitive data without encryption over a channel that could be intercepted by attackers...

PT-2025-23419 · Mageia · Deluge

Limited unauthenticated file read in /flag. CVE-2025-46561 New version check over unencrypted channel. CVE-2025-46562 SSRF with information leak and limited unauthenticated file write. CVE-2025-46563 Unauthenticated file read in /js may lead to RCE. CVE-2025-46564 Mageia internal bug:...

Unsecured Authentication Attempt Detected (Medium)

A server allow for authentication using credentials in an unencrypted manner over unencrypted channel. Such credentials might be revealed to an attacker intercepting this traffic and used to gain access to data on the server. This plugin only works with Tenable.ot. Please visit...

Unsecured Authentication Attempt Detected (Low)

A server allow for authentication using credentials in an unencrypted manner over unencrypted channel. Such credentials might be revealed to an attacker intercepting this traffic and used to gain access to data on the server. This plugin only works with Tenable.ot. Please visit...

CVE-2022-32510

An issue was discovered on certain Nuki Home Solutions devices. The HTTP API exposed by a Bridge used an unencrypted channel to provide an administrative interface. A token can be easily eavesdropped by a malicious actor to impersonate a legitimate user and gain access to the full set of API...

CVE-2024-30142

HCL BigFix Compliance is affected by a missing secure flag on a cookie. If a secure flag is not set, cookies may be stolen by an attacker using XSS, resulting in unauthorized access or session cookies could be transferred over an unencrypted channel...

CVE-2024-30142 HCL BigFix Compliance is affected by a missing secure flag on a cookie

HCL BigFix Compliance is affected by a missing secure flag on a cookie. If a secure flag is not set, cookies may be stolen by an attacker using XSS, resulting in unauthorized access or session cookies could be transferred over an unencrypted channel...

CVE-2024-30142

HCL BigFix Compliance is affected by a missing secure flag on a cookie, enabling cookie theft via XSS and potentially unauthorized access or cookies transmitted over unencrypted channels. The CVE refers to vulnerability in product HCL BigFix Compliance (reported as 2024-30142) and is corroborated...

CVE-2024-30142 HCL BigFix Compliance is affected by a missing secure flag on a cookie

HCL BigFix Compliance is affected by a missing secure flag on a cookie. If a secure flag is not set, cookies may be stolen by an attacker using XSS, resulting in unauthorized access or session cookies could be transferred over an unencrypted channel...

CVE-2022-32510: Cleartext Transmission of Sensitive Information

An issue was discovered on certain Nuki Home Solutions devices. The HTTP API exposed by a Bridge used an unencrypted channel to provide an administrative interface. A token can be easily eavesdropped by a malicious actor to impersonate a legitimate user and gain access to the full set of API...

CVE-2022-32510

Certain Nuki Home Solutions devices are vulnerable due to an HTTP API exposed by a Bridge using an unencrypted channel for its administrative interface. This flaw allows a malicious actor to eavesdrop on a token , enabling them to impersonate a legitimate user and gain unauthorized access to the ...

PT-2024-11574 · Nuki Home Solutions · Nuki Bridge

Name of the Vulnerable Software and Affected Versions: Nuki Bridge versions 1.0.0 through 1.21.0 Nuki Bridge versions 2.0.0 through 2.13.1 Description: An issue was discovered on certain Nuki Home Solutions devices, where the HTTP API exposed by a Bridge used an unencrypted channel to provide an...

CVE-2023-31410

A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security TLS in the SICK EventCam App. This lack of encryption in the communication channel can lead to the unauthorized disclosure of sensitive information. The attack...

SICK EventCam 安全漏洞

SICK EventCam is an industrial photoelectric sensor from SICK. A security vulnerability exists in SICK EventCam, which stems from a lack of encryption in the communication channel, resulting in the disclosure of sensitive information. The vulnerability can be exploited by an attacker to eavesdrop...

The vulnerability of InHand Networks InRouter 302 and InRouter 615 microprogrammed software lies in the use of an unencrypted data transmission channel by default. This allows attackers to gain unauthorized access to protected information or execute arbitrary commands.

The vulnerability of InHand Networks InRouter 302 and InRouter 615 microprogrammed software lies in the use of an unencrypted data transmission channel by default. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information or execute arbitrary...

Cherwell Service Management 信息泄露漏洞

Cherwell Service Management is flexible, feature-rich ITSM software that is easy to use, configure, and maintain. An information disclosure vulnerability exists in Cherwell Service Management that stems from the product not effectively protecting the ASP.NETSessionid cookie. The vulnerability can...

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in jonschoning/espial

Description Implement both Secure flag and httponly flag in the application. Proof of Concept Impact The secure flag is an option that can be set by the application server when sending a new cookie to the user within an HTTP Response. The purpose of the secure flag is to prevent cookies from bein...

in khodakhah/nodcms

Description Clear Text submission of password through unencrypted channel Proof of Concept POST /en/login HTTP/1.1 Host: demo.nodcms.com User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:92.0 Gecko/20100101 Firefox/92.0 Accept: application/json, text/javascript, /; q=0.01 Accept-Language:...

CVE-2018-5482

NetApp SnapCenter Server prior to 4.1 does not set the secure flag for a sensitive cookie in an HTTPS session which can allow the transmission of the cookie in plain text over an unencrypted channel...