CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- ibm api connect Multiple Vulnerabilities in IBM API Connect 6.8 Medium
- ibm api connect Multiple Vulnerabilities in IBM API Connect 8.0 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 8.7 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 8.0 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 6.8 Medium
- randombit botan Botan: directoryName nameConstraint bypass via multi-AVA RDN flattening in matches_dn 2.1 Low
- kamsoft zsirep client library Improper Server Certificate Validation in ZSIRep Client Library 5.3 Medium
- jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added... 7.4 High
- tpc software matchpoint Incorrect validation of TLS certificates in the MatchPoint Android app 9.1 Critical
- signalwire freeswitch FreeSWITCH: DTLS-SRTP peer certificate is not bound to the SDP fingerprint when FreeSWITCH is the DTLS server 7.4 High
- red hat amq broker 7, build of keycloak 26.4, build of keycloak 26.4.17 +8 more +10 more Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates 8.0 High
- jopenlibs vault-java-driver vault-java-driver: SslConfig silently disables requested TLS verification 7.4 High
- samsung exynos 1080, samsung semiconductor exynos 9110, exynos modem 5123 +2 more +4 more An attacker may send a malicious IMS message to the target device, potentially leading to... No score
- kyverno Kyverno before 1.19.2 Cosign Identity Check Bypass via Empty SAN Certificates 7.2 High
- shenzhen shine industrial co., ltd. vitafit VitaFit Android < 2.8.1.0 Insecure TLS Certificate Validation 8.7 High
- ibm db2 genius hub Multiple vulnerabilities that affects IBM Db2 Genius Hub 5.9 Medium
- watchguard authpoint authentication gateway WatchGuard AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle Attacks 9.1 Critical
- tata motors ira 2.0, ira.ev +1 more Security Misconfiguration Vulnerability in Tata Motors iRA and iRA.ev mobile application 8.5 High
- bluecats reveal, tanium asset, comply +10 more +12 more Tanium addressed an improper certificate validation vulnerability in multiple products 7.4 High
- hewlett packard enterprise (hpe) virtual intranet access (via) Unauthenticated Improper Certificate Validation leads to Authentication Bypass in HPE Networking Virtual Intranet Access (VIA) 8.1 High
- nanosystems supremo Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation 7.6 High
- elastic docker images Improper Certificate Validation in Elastic Docker Images Leading to Interception of TLS Connections 7.4 High
- mlogclub bbs-go bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Service 8.3 High
- freerdp FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate 9.1 Critical
- dell alienware command center (awcc) Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper... 6.4 Medium
- marketcalls openalgo OpenAlgo 1.0.0.29 before 2.0.3.1 Improper Certificate Validation in SMTP Connections 6.0 Medium
- microsoft visual studio 2017 version 15.9, visual studio 2019 version 16.11, visual studio 2022 version 17.14 +1 more +3 more Visual Studio Spoofing Vulnerability 7.4 High
- No product listed Konflux-ci: ui proxy skips backend tls verification on non-openshift clusters, leaking a token that can impersonate anyone 8.0 High
-
pypa/gh-action-pypi-publishGitHub Actions pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI 9.3 Critical - jetbrains clion, datagrip, goland +8 more +10 more In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the... 9.0 Critical
- canonical lxd Improper certificate validation in the HTTPS listener in LXD 10.0 Critical
- litespeed technologies openlitespeed OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch 8.2 High
- delinea privilege manager Delinea Privilege Manager agent unauthenticated remote code execution vulnerability 8.7 High
- digitalbazaar forge Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13 7.4 High
- digitalbazaar forge Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage 5.9 Medium
- unclecode crawl4ai Crawl4AI before 0.9.5 Improper Certificate Validation via Hard-coded Chromium Flags 8.3 High
- krajowa izba rozliczeniowa szafir Improper certificate validation in Szafir 6.9 Medium
- apache software foundation qpid proton c Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors. 9.1 Critical
- checkmk gmbh checkmk Trust of compromised eMudhra root CA in bundled CA stores 7.1 High
- mongodb database tools The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs 7.6 High
- karingx clashmi ClashMi through 1.0.32.1801 Disabled TLS Certificate Validation Enables Update MITM 7.7 High
- progress software telerik document processing libraries Improper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessing 7.5 High
- acronis cyber protect 17 Sensitive information disclosure due to missing SSL certificate verification affecting one... 6.8 Medium
- tanium cx-stream, endpoint configuration toolset solution +1 more Tanium addressed an improper certificate validation vulnerability in Stream Client Extension. 6.5 Medium
- eclipse foundation iofog Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials 9.1 Critical
- eaton easysoft Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network... 5.9 Medium
- moxa remote connect suite (mrc client) Unauthenticated server-supplied OpenVPN configuration in Moxa Remote Connect Suite (MRC Client) 7.6 High
- apple ipados, macos, visionos +2 more +4 more A logic issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and... 5.5 Medium
- forescout secureconnector Insecure TLS Fingerprint Validation in ForeScout SecureConnector Configuration Enables Remote Code Execution 7.7 High
- mongodb inc mongosh MongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAs 7.6 High
- Show olderLoading…