CVE-2021-38142: Cleartext Transmission of Sensitive Information

Barco MirrorOp Windows Sender before 2.5.3.65 uses cleartext HTTP and thus allows rogue software upgrades. An attacker on the local network can achieve remote code execution on any computer that tries to update Windows Sender due to the fact that the upgrade mechanism is not secured is not...

GHSA-PQ6V-X7GP-7776 Source code is downloaded over cleartext HTTP in portaudio

An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP...

Source code is downloaded over cleartext HTTP in portaudio

An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP...

CVE-2020-36473

UCWeb UC 12.12.3.1219 through 12.12.3.1226 uses cleartext HTTP, and thus man-in-the-middle attackers can discover visited URLs...

Command injection

UCWeb UC 12.12.3.1219 through 12.12.3.1226 uses cleartext HTTP, and thus man-in-the-middle attackers can discover visited URLs...

CVE-2020-36473

CVE-2020-36473 affects UCWeb UC browser versions 12.12.3.1219–12.12.3.1226. The root cause is the use of plaintext HTTP, enabling man-in-the-middle attackers to discover the URLs visited by a user. All cited sources (NVD, Red Hat, CNNVD) confirm the affected product/version range and the resultin...

CVE-2020-36473

UCWeb UC 12.12.3.1219 through 12.12.3.1226 uses cleartext HTTP, and thus man-in-the-middle attackers can discover visited URLs...

PT-2021-12057

Name of the Vulnerable Software and Affected Versions: UCWeb UC versions 12.12.3.1219 through 12.12.3.1226 Description: The issue allows man-in-the-middle attackers to discover visited URLs because the software uses cleartext HTTP. Recommendations: For versions 12.12.3.1219 through 12.12.3.1226,...

CVE-2020-36473: Cleartext Storage of Sensitive Information

UCWeb UC 12.12.3.1219 through 12.12.3.1226 uses cleartext HTTP, and thus man-in-the-middle attackers can discover visited URLs...

CVE-2021-32612

The VeryFitPro com.veryfit2hr.second application 3.2.8 for Android does all communication with the backend API over cleartext HTTP. This includes logins, registrations, and password change requests. This allows information theft and account takeover via network sniffing...

CVE-2021-32612

The VeryFitPro com.veryfit2hr.second application 3.2.8 for Android does all communication with the backend API over cleartext HTTP. This includes logins, registrations, and password change requests. This allows information theft and account takeover via network sniffing...

CVE-2021-32612

The CVE-2021-32612 entry concerns the VeryFitPro Android app (package com.veryfit2hr.second, version 3.2.8). The connected sources confirm that the app performs all communication with the backend API over cleartext HTTP, including login, registration, and password-change requests. Root cause stat...

CVE-2021-32612

The VeryFitPro com.veryfit2hr.second application 3.2.8 for Android does all communication with the backend API over cleartext HTTP. This includes logins, registrations, and password change requests. This allows information theft and account takeover via network sniffing...

CVE-2021-32612: Cleartext Transmission of Sensitive Information

The VeryFitPro com.veryfit2hr.second application 3.2.8 for Android does all communication with the backend API over cleartext HTTP. This includes logins, registrations, and password change requests. This allows information theft and account takeover via network sniffing...

PT-2021-19807

Name of the Vulnerable Software and Affected Versions VeryFitPro version 3.2.8 Description The VeryFitPro application communicates with the backend API over cleartext HTTP, which includes logins, registrations, and password change requests. This allows information theft and account takeover via...

CVE-2021-3003

Agenzia delle Entrate Desktop Telematico 1.0.0 contacts the jws.agenziaentrate.it server over cleartext HTTP, which allows man-in-the-middle attackers to spoof product updates...

Design/Logic Flaw

Agenzia delle Entrate Desktop Telematico 1.0.0 contacts the jws.agenziaentrate.it server over cleartext HTTP, which allows man-in-the-middle attackers to spoof product updates...

CVE-2021-3003: Cleartext Transmission of Sensitive Information

Agenzia delle Entrate Desktop Telematico 1.0.0 contacts the jws.agenziaentrate.it server over cleartext HTTP, which allows man-in-the-middle attackers to spoof product updates...

PT-2021-18575

Name of the Vulnerable Software and Affected Versions Agenzia delle Entrate Desktop Telematico version 1.0.0 Description The issue allows man-in-the-middle attackers to spoof product updates because it contacts the jws.agenziaentrate.it server over cleartext HTTP. Recommendations For version 1.0....

CVE-2021-27574

An issue was discovered in Emote Remote Mouse through 4.0.0.0. It uses cleartext HTTP to check, and request, updates. Thus, attackers can machine-in-the-middle a victim to download a malicious binary in place of the real update, with no SSL errors or warnings...