Skip to content

CWE-295: Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

A kind of CWE-287 Improper Authentication.

From the CWE List. © The MITRE Corporation.

Newest

webkitgtkLate TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a...CVE-2015-23307.5 HighMarch 27, 2015
cisco adaptive security appliance software, adaptive security virtual appliance +1 moreThe Smart Call Home (SCH) implementation in Cisco ASA Software 8.2 before 8.2(5.50), 8.4 before 8...CVE-2014-33945.0 MediumOctober 10, 2014
openstack keystonemiddleware, python-keystoneclient +1 moreOpenStack keystonemiddleware does not verify certificateCVE-2014-7144Fix available4.3 MediumOctober 2, 2014
puppet, redhat linux +1 moreThe default vhost configuration file in Puppet before 3.6.2 does not include the...CVE-2014-3250Fix available6.5 MediumJune 30, 2014
gnu gnutls, debian linux, redhat enterprise linux +2 moreGnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a...CVE-2015-0294Fix available7.5 HighJune 3, 2014
libwww-perl lwp::protocol::https, lwp\ \ +1 moreThe libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket:...CVE-2014-3230Fix available5.9 MediumMay 7, 2014
igniterealtime smackThe ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not...CVE-2014-03635.8 MediumApril 30, 2014
mono-project mono, debian linux +1 moreThe TLS stack in Mono before 3.12.1 allows remote attackers to have unspecified impact via...CVE-2015-2320Fix available9.8 CriticalApril 10, 2014
mono-project monoThe TLS stack in Mono before 3.12.1 makes it easier for remote attackers to conduct cipher...CVE-2015-2319Fix available7.5 HighApril 10, 2014
mono-project mono, debian linux +1 moreThe TLS stack in Mono before 3.12.1 allows man-in-the-middle attackers to conduct message...CVE-2015-2318Fix available8.1 HighApril 10, 2014
apple iphone os, mac os x, tvos +2 moreThe SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the...CVE-2014-1266Public exploit7.4 HighFebruary 22, 2014
openstack swiftPython Swift client is vulnerable to Missing SSL Certificate CheckCVE-2013-6396Fix available5.8 MediumFebruary 18, 2014
mozilla firefox, seamonkey, thunderbird +9 more +11 moreMozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3,...CVE-2013-07764.0 MediumFebruary 19, 2013
fortinet fortigate-1000c, fortigate-100d, fortigate-110c +26 more +28 moreThe default configuration of Fortinet Fortigate UTM appliances uses the same Certification...CVE-2012-49485.3 MediumNovember 14, 2012
cerulean studios trillianTrillian 5.1.0.19 does not verify that the server hostname matches a domain name in the subject's...CVE-2012-58245.8 MediumNovember 4, 2012
mozilla zamboniThe contribution feature in Zamboni does not verify that the server hostname matches a domain...CVE-2012-58227.4 HighNovember 4, 2012
lynx, canonical ubuntu linux +1 moreLynx does not verify that the server's certificate is signed by a trusted certification authority...CVE-2012-58215.9 MediumNovember 4, 2012
filesanywhereFilesAnywhere does not verify that the server hostname matches a domain name in the subject's...CVE-2012-58197.4 HighNovember 4, 2012
amazon ec2 api tools java library, codehaus xfire +1 moreImproper Input Validation in XFireCVE-2012-58177.4 HighNovember 4, 2012
jpmorganchase chase mobileThe Chase mobile banking application for Android does not verify that the server hostname matches...CVE-2012-58105.9 MediumNovember 4, 2012
apache libcloudApache Libcloud vulnerable to certificate impersonationCVE-2012-3446Fix available5.9 MediumNovember 4, 2012
apache httpclient, canonical ubuntu linux +1 moreImproper Certificate Validation in Apache Commons HttpClientCVE-2012-5783Fix available5.8 MediumNovember 4, 2012
siemens simatic s7-1200 cpu 1211c firmware, simatic s7-1200 cpu 1212c firmware, simatic s7-1200 cpu 1212fc firmware +6 more +8 moreThe Siemens SIMATIC S7-1200 2.x PLC does not properly protect the private key of the SIMATIC...CVE-2012-30374.3 MediumSeptember 25, 2012
microsoft windows phone 7 firmwareMicrosoft Windows Phone 7 does not verify the domain name in the subject's Common Name (CN) field...CVE-2012-29935.9 MediumSeptember 18, 2012
apple iphone os, mac os x, safari +21 more +23 moreThe TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on...CVE-2015-4000Public exploitFix availableEPSS 99.9%3.7 LowAugust 30, 2012
google chromeGoogle Chrome before 18.0.1025.142 does not properly check X.509 certificates before use of a...CVE-2011-30615.8 MediumMarch 30, 2012
postgresql, debian linux, opensuse project opensuse +8 more +10 morePostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common...CVE-2012-08674.3 MediumFebruary 27, 2012
google chromeGoogle Chrome before 17.0.963.56 allows remote attackers to cause a denial of service ...CVE-2011-30244.3 MediumFebruary 16, 2012
google chromeGoogle Chrome before 14.0.835.163 does not perform an expected pin operation for a self-signed...CVE-2011-28746.8 MediumSeptember 17, 2011
apache libcloudApache Libcloud does not verify SSL certificates for HTTPS connectionsCVE-2010-4340Fix available4.3 MediumSeptember 11, 2011
apple mac os x, mac os x server +1 moreThe Certificate Trust Policy component in Apple Mac OS X before 10.6.8 does not perform CRL...CVE-2011-01995.9 MediumJune 24, 2011
cisco iosCisco IOS before 15.0(1)XA1 does not clear the public key cache upon a change to a certificate...CVE-2010-46854.0 MediumJanuary 7, 2011
apple mac os x, mac os x server +1 moreOpenSSL in Apple Mac OS X 10.6.x before 10.6.5 does not properly perform arithmetic, which allows...CVE-2010-13789.8 CriticalNovember 15, 2010
cerulean studios trillianCerulean Studios Trillian 3.1 Basic does not check SSL certificates during MSN authentication,...CVE-2009-48315.8 MediumApril 29, 2010
apache http server, gnu gnutls, mozilla nss +5 more +7 moreApache Tomcat affected by vulnerability in TLS and SSL protocolCVE-2009-3555Public exploitFix availableEPSS 87.3%5.8 MediumNovember 9, 2009
openldap, apple mac os x, fedoraproject fedora +2 morelibraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is...CVE-2009-3767Fix available4.3 MediumOctober 23, 2009
opera browserOpera before 10.00 does not check all intermediate X.509 certificates for revocation, which makes...CVE-2009-30467.5 HighSeptember 2, 2009
gnu gnutls, mozilla network security services, openssl +2 moreThe Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6...CVE-2009-2409Fix available5.1 MediumJuly 30, 2009
mozilla firefox, network security services, seamonkey +6 more +8 moreMozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before...CVE-2009-2408Fix available5.9 MediumJuly 30, 2009
isc bindInternet Systems Consortium (ISC) BIND 9.6.0 and earlier does not properly check the return value...CVE-2009-02657.5 HighJanuary 26, 2009
gnu gnutls, canonical ubuntu linux, debian linux +4 more +6 moreThe _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2...CVE-2008-4989Fix available5.9 MediumNovember 13, 2008
microsoft windows 2000The LDAP client on Microsoft Windows 2000 before Update Rollup 1 for SP4 accepts certificates...CVE-2005-31705.1 MediumOctober 6, 2005
oracle jre, sun java web start, jsse +2 moreX509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01...CVE-2003-12297.5 HighDecember 31, 2003
microsoft internet explorer, office, outlook express +6 more +8 moreThe (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust...CVE-2002-0862Public exploitEPSS 15.8%6.8 MediumSeptember 10, 2002