CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- nissan securities co., ltd. access cx app for android, nissan securities access cx, nissan securities co., ltd. access cx app for ios +2 moreThe Access CX App for Android prior to 2.0.0.1 and for iOS prior to 2.0.2 does not verify X.509...5.9 Medium
- cybozu remote service managerRemote Service Manager 3.0.0 to 3.1.4 fails to verify client certificates, which may allow remote...4.2 Medium
- openbsd libresslLibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied...5.3 Medium
- oracle vm virtualboxVulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core)...8.8 High
- pivotal software cloud foundry, cloud foundry elastic runtime, cloud foundry uaa +1 more +3 moreCloud Foundry vulnerable to Improper Certificate Validation5.9 Medium
- grandstream waveThe com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android...5.9 Medium
- jetstarJetstar App for iOS before 3.0.0 does not verify X.509 certificates from SSL servers, which...5.9 Medium
- the hyakugo bank 105 bankThe 105 BANK app 1.0 and 1.1 for Android and 1.0 for iOS does not verify X.509 certificates from...5.9 Medium
- ntt photoptPhotopt for Android before 2.0.1 does not verify SSL certificates.5.9 Medium
- cybozu kintoneKintone mobile for Android 1.0.0 through 1.0.5 does not verify SSL server certificates.5.9 Medium
- toshiba coordinate plusCoordinate Plus App for Android 1.0.2 and earlier and Coordinate Plus App for iOS 1.0.2 and...5.9 Medium
- aeon waonWAON "Service Application" for Android 1.4.1 and earlier does not verify SSL certificates.5.9 Medium
- akindo-sushiro sushiroSushiro App for iOS 2.1.16 and earlier and Sushiro App for Android 2.1.16.1 and earlier do not...5.9 Medium
- dmm ppv play playerDMM Movie Player App for Android before 1.2.1, and DMM Movie Player App for iPhone/iPad before 2...5.9 Medium
- tokyostarbank tokyo star bankTokyo Star bank App for Android before 1.4 and Tokyo Star bank App for iOS before 1.4 do not...5.9 Medium
- photosynth akerunAkerun - Smart Lock Robot App for iOS before 1.2.4 does not verify SSL certificates.8.1 High
- dmm dmmfx demo trade, dmmfx trade, gaitamejapan fx trade +2 moreDMMFX Trade for Android 1.5.0 and earlier, DMMFX DEMO Trade for Android 1.5.0 and earlier, and...5.9 Medium
- [unknown] curl, haxx libcurl +1 moreIn curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session...4.8 Medium
- apache cxfImproper Certificate Validation in Apache CXF5.3 Medium
- google chromeGoogle Chrome caches TLS sessions before certificate validation occurs.6.5 Medium
- docomo shoplatShoplat App for iOS 1.10.00 through 1.18.00 does not properly verify SSL certificates.7.5 High
- botan project botanbotan 1.11.x before 1.11.22 improperly handles wildcard matching against hostnames, which might...9.8 Critical
- apple musicThe Apple Music (aka com.apple.android.music) application before 2.0 for Android does not verify...4.8 Medium
- starscream project starscreamWebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because of incorrect...7.5 High
- starscream project starscreamWebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because pinning occurs in...7.5 High
- pulpproject pulpPulp before 2.3.0 uses the same the same certificate authority key and certificate for all...7.5 High
- trendmicro mobile securityThere is Missing SSL Certificate Validation in the Trend Micro Enterprise Mobile Security Android...5.9 Medium
- modx revolutionThe (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier do...8.1 High
- arm mbed tlsAn exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code...8.1 High
- microsoft lync for macMicrosoft Lync for Mac 2011 fails to properly validate certificates, allowing remote attackers to...7.5 High
- security-framework project security-frameworkImproper Certificate Validation in security-framework5.3 Medium
- eset endpoint antivirus, endpoint security +1 moreThe esets_daemon service in ESET Endpoint Antivirus for macOS before 6.4.168.0 and Endpoint...5.9 Medium
- curlcurl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks...4.3 Medium
- apple watchos, iphone os, mac os x +2 moreAn issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10...7.5 High
- squareup okhttp, okhttp3 +1 moreImproper Certificate Validation in OkHttp5.9 Medium
- python urllib3Urllib3 Incorrect Certificate Validation3.7 Low
- haxx curlThe verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when...8.1 High
- canonical ubuntu linux, debian advanced package tool +1 moreThe apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu...5.9 Medium
- netapp plug-inNetApp Plug-in for Symantec NetBackup prior to version 2.0.1 makes use of a non-unique server...5.6 Medium
- mozilla firefox, firefox esr +1 moreAdd-on updates failed to verify that the add-on ID inside the signed package matched the ID of...5.9 Medium
- rust-openssl project rust-opensslImproper Certificate Validation in openssl8.1 High
- gnome shotwell, redhat enterprise linux +1 moreShotwell version 0.22.0 (and possibly other versions) is vulnerable to a TLS/SSL certification...3.7 Low
- ietf transport layer security, netapp clustered data ontap antivirus connector, data ontap edge +10 more +12 moreThe TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and...8.1 High
- dell bsafe, bsafe ssl-c, bsafe ssl-j +2 moreEMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3, RSA BSAFE...7.5 High
- freeradius, suse linux enterprise server, linux enterprise software development kit +2 moreFreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of...7.5 High
- mariadb, oracle mysql, debian linux +9 more +11 moreOracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and...5.9 Medium
- shibboleth identity provider, opensaml java +1 moreImproper Certificate Validation in Shibboleth Identity Provider and OpenSAML4.3 Medium
- thycotic secret serverThe Thycotic Password Manager Secret Server application through 2.3 for iOS does not verify X.509...5.8 Medium
- w1.fi wpa supplicantwpa_supplicant 2.0-16 does not properly check certificate subject name, which allows remote...5.9 Medium
- openstack keystonemiddleware, python-keystoneclient, canonical ubuntu linux +2 moreOpenStack keystonemiddleware and python-keystoneclient vulnerable to man-in-the-middle attacks4.3 Medium
- Show moreLoading…