CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- cisco sd-wan solution, vedge 1000 firmware, vedge 100 firmware +3 more +5 moreCisco SD-WAN Solution Certificate Validation Vulnerability7.4 High
- opcfoundation ua-.net-legacy, ua-.netstandard +1 moreModerate severity vulnerability that affects OPCFoundation.NetStandard.Opc.Ua5.3 Medium
- ibm security guardiumIBM Security Guardium EcoSystem 10.5 does not validate, or incorrectly validates, a certificate...3.7 Low
- postmanAn information-disclosure issue was discovered in Postman through 6.3.0. It validates a server's...8.1 High
- pivotal spring amqp, spring amqp, pivotal software spring advanced message queuing protocol +1 more +3 moreTLS validation error5.9 Medium
- microsoft c sdk, c software development kit, java software development kit +2 moreA spoofing vulnerability exists for the Azure IoT Device Provisioning for the C SDK library using...5.6 Medium
- subsonic music streamerThe Subsonic Music Streamer application 4.4 for Android has Improper Certificate Validation of...5.9 Medium
- sap business one, business one android application +1 moreSAP Business One Android application, version 1.2, does not verify the certificate properly for...5.9 Medium
- apache activemq, oracle enterprise repository, flexcube private banking +2 moreImproper Certificate Validation in Apache activemq-client7.4 High
- mobyproject mobyDocker Authentication Bypass7.5 High
- kubernetes, red hat openshift +1 moreIt was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509...7.5 High
- line music corporation music for android, linecorp line music +1 moreThe LINE MUSIC for Android version 3.1.0 to versions prior to 3.6.5 does not verify X.509...7.4 High
- pulsesecure pulse secure desktop clientIn Pulse Secure Pulse Desktop Client 5.3RX before 5.3R5 and 9.0R1, there is a Privilege...6.8 Medium
- dsub for subsonic project for subsonicdaneren2005 DSub for Subsonic (Android client) version 5.4.1 contains a CWE-295: Improper...5.9 Medium
- pidgin, suse linux enterprise server +1 morePidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to...9.8 Critical
- mystrom wifi bulb firmware, wifi button firmware, wifi button plus firmware +3 more +5 moreAn issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi...8.1 High
- adobe creative cloudAdobe Creative Cloud Desktop Application before 4.6.1 has an improper certificate validation...9.8 Critical
- samsung, samsung sth-eth-250 firmware +1 moreAn exploitable information disclosure vulnerability exists in the crash handler of the hubCore...6.8 Medium
- red hat satelliteIt was found that Satellite 5 configured with SSL/TLS for the PostgreSQL backend failed to...5.4 Medium
- hi security lab virus cleaner - antivirus, booster, hisecuritylab virus cleaner +1 moreHi Security Virus Cleaner - Antivirus, Booster, 3.7.1.1329, 2017-09-13, Android application accepts all SSL certificates during SSL communication5.9 Medium
- ibm rational clearquestIBM Rational ClearQuest 8.0 through 8.0.1.9 and 9.0 through 9.0.1.3 (CQ OSLC linkages, EmailRelay...3.7 Low
- keycloak, redhat single sign-on +1 moreKeycloak Authentication Error5.4 Medium
- jenkins inedo buildmasterJenkins Inedo BuildMaster Plugin globally and unconditionally disabled SSL/TLS certificate validation7.4 High
- jenkins inedo progetJenkins Inedo ProGet Plugin globally and unconditionally disabled SSL/TLS certificate validation7.4 High
- jenkins tracetronic ecu-testJenkins TraceTronic ECU-TEST Plugin Man in the middle vulnerability7.4 High
- apache tomcat native, debian linux +1 moreApache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check...7.4 High
- apache tomcat native, debian linux +1 moreWhen using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not...7.4 High
- jenkins active directory, jenkins project active directory jenkins plugin +1 moreJenkins Active Directory Plugin did not verify certificate of AD server8.1 High
- jenkins jenkins-ssh-slaves-plugin, ssh slaves +1 moreJenkins SSH Build Agents Plugin did not verify host keys6.8 Medium
- rpm-ostree, rpm-ostree rpm-ostree-client, project atomic rpm-ostree, +1 more +3 moreIt was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG...5.3 Medium
- red hat openshift, redhat openshift container platform +1 moreA flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin....6.5 Medium
- [unknown] cloudforms, redhat cloudforms management engine +1 moreIt was found that CloudForms does not verify that the server hostname matches the domain name in...6.5 Medium
- dhc online shop, dhc corporation online shop app for android +1 moreThe DHC Online Shop App for Android version 3.2.0 and earlier does not verify X.509 certificates...7.4 High
- redwoodjs sdkOn the iOS platform, the ThreatMetrix SDK versions prior to 3.2 fail to validate SSL certificates provided by HTTPS connections, which may allow an attacker to perform a man-in-the-middle (MITM) attac…6.8 Medium
- apache tomcat, canonical ubuntu linux, debian linux +1 more +3 moreThe host name verification missing in Apache Tomcat7.5 High
- mitel shortel mobility client, shoretel mobility client andoid, mobility client ios +2 moreShoreTel Mobility Client for iOS and Android, version 9.1.3.109 and earlier, fails to properly validate SSL certificates provided by HTTPS connections7.5 High
- shein shein-fashion shopping onlineThe Shein Group Ltd. "SHEIN - Fashion Shopping" app -- aka shein fashion-shopping/id878577184 --...5.9 Medium
- komootThe komoot GmbH "Komoot - Cycling & Hiking Maps" app before 9.3.2 -- aka komoot-cycling-hiking...7.4 High
- shpock"Shpock Boot Sale & Classifieds" app before 3.17.0 -- aka shpock-boot-sale-classifieds...5.9 Medium
- microsoft .net core, .net framework, asp.net core +2 more +4 moreImproper Certificate Validation in Microsoft .NET Framework components5.5 Medium
- edirectoryCertificate Revocation Check failure3.5 Low
- motorola mbp853 firmwareThe Motorola MBP853 firmware does not correctly validate server certificates. This allows for a...7.4 High
- ibm mq, websphere mq +1 moreIBM WebSphere MQ 8.0 and 9.0 could allow a remote attacker to obtain sensitive information,...5.9 Medium
- jenkins collabnetJenkins CollabNet Plugin man in the middle vulnerability7.4 High
- arm mbed tlsARM mbedTLS version 2.7.0 and earlier contains a Ciphersuite Allows Incorrectly Signed...7.5 High
- busyboxBusybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet...8.1 High
- all nippon airways co., ltd ana app for ios, ana +1 moreThe ANA App for iOS version 4.0.22 and earlier does not verify X.509 certificates from SSL...7.4 High
- portswigger burp suite, tenable burp suite community edition +1 moreBurp Suite Community Edition 1.7.32 and 1.7.33 fail to validate the server certificate in a...7.4 High
- portswigger burp suitePortSwigger Burp Suite before 1.7.34 has Improper Certificate Validation of the Collaborator...5.9 Medium
- virustotalAn issue was discovered in VirusTotal. A maliciously crafted Universal/fat binary can evade third...7.8 High
- Show moreLoading…