CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- yelp osxcollectorYelp OSXCollector Improper Certificate Validation7.8 High
- google santaAn issue was discovered in Google Santa and molcodesignchecker. A maliciously crafted Universal...7.8 High
- objective-see knockknock, lulu, procinfo +2 more +4 moreAn issue was discovered in Objective-See KnockKnock, LuLu, TaskExplorer, WhatsYourSign, and...7.8 High
- f-secure xfenceAn issue was discovered in F-Secure XFENCE and Little Flocker. A maliciously crafted Universal...7.8 High
- apollotechnologiesinc momentum axel 720p firmwareAn issue was discovered on Momentum Axel 720P 5.1.8 devices. There is Authenticated Custom...4.4 Medium
- cisco anyconnect secure mobility clientA vulnerability in the certificate management subsystem of Cisco AnyConnect Network Access...4.8 Medium
- webkitgtk webkitgtk\+WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of...7.5 High
- socket engine.io-client, hackerone engine.io-client node module +1 moreInsecure Defaults Allow MITM Over TLS in engine.io-client5.9 Medium
- electron-packager project electron-packager, hackerone electron-packager node module +1 moreSSL Validation Defaults to False in electron-packager5.9 Medium
- adobe creative cloudAdobe Creative Cloud Desktop Application versions 4.4.1.298 and earlier have an exploitable...9.8 Critical
- cisco identity services engineA vulnerability in the Extensible Authentication Protocol-Transport Layer Security (EAP-TLS)...8.6 High
- t-joy kinepass, t-joy co.,ltd. kinepass app +1 moreThe KINEPASS App for Android Ver 3.1.1 and earlier, and for iOS Ver 3.1.2 and earlier do not...5.9 Medium
- microsoft c sdk, c# sdk, java sdk +3 more +5 moreA spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library...5.6 Medium
- siemens siveillance vms video, siemens ag siveillance vms video for android, siveillance vms video for ios +1 moreA vulnerability has been identified in Siveillance VMS Video for Android (All versions < V12.1a ...7.4 High
- paypalWebHybridClient.java in PayPal 5.3 and earlier for Android ignores SSL errors, which allows man...7.4 High
- cisco adaptive security appliance software, secure firewall threat defense +1 moreA vulnerability in the Secure Sockets Layer (SSL) Virtual Private Network (VPN) Client...7.5 High
- mikrotik routerosAn issue was discovered in MikroTik RouterOS 6.41.4. Missing OpenVPN server certificate...8.1 High
- f5 big-ip (afm, asm), big-ip advanced firewall manager, big-ip application security manager +2 moreX509 certificate verification was not correctly implemented in the IP Intelligence Subscription...5.4 Medium
- redhat rhn-client-toolsrhnreg_ks in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Gluster Storage 2.1...5.9 Medium
- glamo inc. iremoconwifi app for android, glamo iremocon wifi +1 moreThe iRemoconWiFi App for Android version 4.1.7 and earlier does not verify X.509 certificates...7.4 High
- jenkins vsphereJenkins vSphere Plugin disables SSL/TLS certificate validation by default5.6 Medium
- apple tv, watchos, iphone os +1 more +3 moreAn issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10...5.9 Medium
- apple iphone osAn issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves...5.9 Medium
- botan project botanBotan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept...9.8 Critical
- ibm bigfix remote controlIBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 improperly allows self...5.9 Medium
- philips intellispace portalPhilips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have a self-signed SSL certificate...7.5 High
- philips intellispace portalPhilips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an untrusted SSL certificate...7.5 High
- philips intellispace portalPhilips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an SSL incorrect hostname...7.5 High
- openbsd libresslThe int_x509_param_set_hosts function in lib/libcrypto/x509/x509_vpm.c in LibreSSL 2.7.0 before 2...7.4 High
- f5 big-ip (ltm, aam, afm, analytics, apm, asm, dns, edge gateway, gtm, link controller, pem, webaccelerator, websafe), big-ip access policy manager, big-ip advanced firewall manager +11 more +13 moreOn F5 BIG-IP versions 13.0.0 - 13.1.0.3, attackers may be able to disrupt services on the BIG-IP...7.5 High
- trend micro email encryption gatewayAn unvalidated software update vulnerability in Trend Micro Email Encryption Gateway 5.5 could...8.1 High
- trend micro email encryption gatewayAn Insecure Update via HTTP vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow...6.5 Medium
- tiny-json-http project tiny-json-httptiny-json-http missing SSL certificate validation8.1 High
- foreman hammer cli, redhat satellite, satellite capsule +2 morehammer_cli_foreman Improper Certificate Validation vulnerability8.1 High
- titanhq webtitan gatewayTitanHQ WebTitan Gateway has incorrect certificate validation for the TLS interception feature.7.5 High
- suse portusThe Djelibeybi configuration examples for use of NGINX in SUSE Portus 2.3, when applied to...8.8 High
- schneider electric se pelco sarix professional, schneider-electric ibp1110-1er firmware, ibp219-1er firmware +18 more +20 moreA vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions...7.5 High
- edirectoryFix for NetIQ shell code upload8.8 High
- elinks, twibright links +1 moreELinks 0.12 and Twibright Links 2.3 have Missing SSL Certificate Validation.5.9 Medium
- line corporation for ios, linecorp line +1 moreLINE for iOS version 7.1.3 to 7.1.5 does not verify X.509 certificates from SSL servers, which...5.9 Medium
- maharaMahara 16.10 before 16.10.7, 17.04 before 17.04.5, and 17.10 before 17.10.2 are vulnerable to...5.9 Medium
- huawei ar120-s firmware, ar1200-s firmware, ar1200 firmware +26 more +28 moreHuawei AR120-S V200R005C32, V200R006C10, V200R007C00, V200R008C20, AR1200 V200R005C20,...9.8 Critical
- huawei ar3200 firmware, te40 firmware, te50 firmware +2 more +4 moreHuawei AR3200 V200R008C20, V200R008C30, TE40 V600R006C00, TE50 V600R006C00, TE60 V600R006C00 have...7.5 High
- smiths-medical medfusion 4000 wireless syringe infusion pumpAn Improper Certificate Validation issue was discovered in Smiths Medical Medfusion 4000 Wireless...5.9 Medium
- schneider-electric igss mobileA security misconfiguration vulnerability exists in Schneider Electric's IGSS Mobile application...5.9 Medium
- omninova vobot firmwareVOBOT CLOCK before 0.99.30 devices do not verify X.509 certificates from SSL servers, which...8.1 High
- pulsesecure desktop linux clientThe GUI component (aka PulseUI) in Pulse Secure Desktop Linux clients before PULSE5.2R9.2 and 5.3...6.5 Medium
- apache tomcat native, debian linux +1 moreWhen parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2...5.9 Medium
- jenkinsImproper Certificate Validation in Jenkins5.9 Medium
- matrixsslMatrixSSL version 3.7.2 adopts a collision-prone OID comparison logic resulting in possible...5.3 Medium
- Show moreLoading…