CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- mattermost serverMattermost Server has X.509 Improper Certificate Validation9.1 Critical
- cisco webex meetings, webex meetings server +1 moreCisco Webex Meetings Desktop App for Mac Update Feature Code Execution Vulnerability8.8 High
- ibm mqIBM MQ Appliance and IBM MQ AMQP Channels 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD do not correctly...5.3 Medium
- nutfindMissing SSL Certificate Validation in the Nutfind.com application through 3.9.12 for Android...5.9 Medium
- palo alto networks globalprotect app, paloaltonetworks globalprotect +1 moreGlobalProtect App: Missing certificate validation vulnerability can disclose pre-logon authentication cookie5.3 Medium
- google androidIn addOrUpdateNetworkInternal and related functions of WifiConfigManager.java, there is a...5.3 Medium
- couchbase server java sdkCouchbase Server Java SDK before 2.7.1.1 allows a potential attacker to forge an SSL certificate...7.5 High
- nodejs node.js, oracle banking extensibility workbench, blockchain platform +2 more +4 moreTLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and ...7.4 High
- djangoproject django, canonical ubuntu linux, debian linux +4 more +6 moreData leakage via cache key collision in Django5.9 Medium
- netgear r6120 firmware, r6220 firmware, r6350 firmware +11 more +13 moreCertain NETGEAR devices are affected by Missing SSL Certificate Validation. This affects R7000 1...5.9 Medium
- gnome balsa, glib-networking, broadcom fabric operating system +3 more +5 moreIn GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips...6.5 Medium
- axel project axel, fedoraproject fedora, opensuse backports sle +1 more +3 moreAn issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname...5.9 Medium
- qorelib/QoreSocket.cpp in Qore before 0.9.4.2 lacks hostname verification for X.509 certificates.5.9 Medium
- pichi project pichiThe boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification.5.9 Medium
- em-http-request project em-http-request, fedoraproject fedora +1 moreImproper Certificate Validation in EM-HTTP-Request7.4 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1709 +28 more +30 moreWindows Task Scheduler Security Feature Bypass Vulnerability5.3 Medium
- em-imap project em-imapImproper certificate validation in em-imap7.4 High
- keycloak, redhat openstack +1 moreImproper Certificate Validation and Improper Validation of Certificate with Host Mismatch in Keycloak5.3 Medium
- nextcloud mail, fedoraproject fedora +1 moreA missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack.7.0 High
- zephyrproject zephyrUpdateHub Module Explicitly Disables TLS Verification4.8 Medium
- zulipchat zulip desktopZulip Desktop before 5.2.0 has Missing SSL Certificate Validation because all validation was inadvertently disabled during an attempt to recognize the ignoreCerts option.9.8 Critical
- java-websocket project java-websocketImproper Validation of Certificate with Host Mismatch in Java-WebSocket9.0 Critical
- jenkins amazon ec2, jenkins project amazon ec2 plugin +1 moreLack of SSL/TLS certificate and hostname validation in Amazon EC2 Plugin5.6 Medium
- silver peak systems, inc. 1. unity edgeconnect, nx, vx 2. unity orchestrator 3. edgeconnect in aws, azure, gcp, silver-peak nx-1000 firmware, nx-10k firmware +22 more +24 moreThe certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validated6.0 Medium
- silver peak systems, inc. 1. unity edgeconnect, nx, vx 2. unity orchestrator, 3. edgeconnect in aws, azure, gcp, silver-peak nx-1000 firmware, nx-10k firmware +22 more +24 moreThe certificate used to identify Orchestrator to EdgeConnect devices is not validated6.0 Medium
- b&r automation studioIncomplete communication encryption and validation in B&R Automation Studio upgrade service6.5 Medium
- [kiali] kiali, redhat openshift service mesh +1 moreInsufficient Session Expiration in Kiali7.0 High
- apache iotdbImproper Certificate Validation in Apache IoTDB9.8 Critical
- apache log4j, debian linux, oracle communications application session controller +43 more +45 moreImproper validation of certificate with host mismatch in Apache Log4j SMTP appender3.7 Low
- f5 nginx controllerIn versions of NGINX Controller prior to 3.2.0, communication between NGINX Controller and NGINX...7.4 High
- mailstore serverIn MailStore Outlook Add-in (and Email Archive Outlook Add-in) through 12.1.2, the login process...5.9 Medium
- netgear r8900 firmware, r9000 firmware, rax120 firmware +1 more +3 moreNETGEAR R8900, R9000, RAX120, and XR700 devices before 2020-01-20 are affected by Transport Layer...7.5 High
- ibm qradar, qradar security information and event manager +1 moreIBM QRadar 7.3.0 to 7.3.3 Patch 2 does not validate, or incorrectly validates, a certificate...3.7 Low
- mongodb enterprise kubernetes operatorKubernetes Operator generates potentially insecure certificates6.4 Medium
- pulsesecure pulse connect secure, pulse policy secure +1 moreAn issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet...9.1 Critical
- apache netbeans, oracle graalvm +1 moreImproper Certificate Validation in Apache Netbeans9.1 Critical
- dell data protection central, emc data protection central, emc integrated data protection appliance +2 moreData Protection Central versions 1.0, 1.0.1, 18.1, 18.2, and 19.1 contains an Improper...7.5 High
- asustor exfat driverAn issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license...7.4 High
- entrustdatacard entelligence security providerEntrust Entelligence Security Provider (ESP) before 10.0.60 on Windows mishandles errors during...4.3 Medium
- golang go, debian linux, fedoraproject fedora +1 more +3 moreHelm uses crypto package vulnerable to panic from malformed X.509 certificate7.5 High
- citrix sd-wan center, netscaler sd-wan center +1 moreCitrix SD-WAN 10.2.x before 10.2.6 and 11.0.x before 11.0.3 has Missing SSL Certificate Validation.5.9 Medium
- traefik, traefik enterprise +1 moreTraefik has an Improper Certificate Handling issue7.5 High
- apache geodeApache Geode SSL endpoint verification vulnerability7.4 High
- facebook osqueryIncorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to MITM osquery traffic in the absence of a configured root chain of trust.9.1 Critical
- [red hat] networkmanager, debian linux +1 moreNetworkManager 0.9 and earlier allows local users to use other users' certificates or private...5.5 Medium
- avast antitrack, avg antitrack +1 moreAvast AntiTrack before 1.5.1.172 and AVG Antitrack before 2.0.0.178 proxies traffic to HTTPS...7.4 High
- cisco jabber im for android, intelligence proximity, jabber +6 more +8 moreCisco Intelligent Proximity SSL Certificate Validation Vulnerability7.4 High
- lua-openssl project lua-opensslopenssl_x509_check_host in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it...9.1 Critical
- lua-openssl project lua-opensslopenssl_x509_check_email in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because...9.1 Critical
- lua-openssl project lua-opensslopenssl_x509_check_ip_asc in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because...9.1 Critical
- Show moreLoading…