CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- redhat openshiftIt was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster...4.6 Medium
- pattersondental eaglesoftPatterson Application Service in Patterson Eaglesoft 18 through 21 accepts the same certificate...7.5 High
- 3xlogic infinias eidc32 firmwareMissing TLS certificate validation on 3xLogic Infinias eIDC32 devices through 3.4.125 allows an...7.5 High
- haxx curl, netapp active iq unified manager, clustered data ontap +19 more +21 morelibcurl-using applications can ask for a specific client certificate to be used in a transfer....7.5 High
- zohocorp manageengine assetexplorerDue to Manage Engine Asset Explorer Agent 1.0.34 not validating HTTPS certificates, an attacker...9.8 Critical
- zohocorp manageengine assetexplorerDue to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can...7.5 High
- arm mbed tls, debian linux +1 moreAn issue was discovered in Arm Mbed TLS before 2.24.0. It incorrectly uses a revocationDate check...5.3 Medium
- hashicorp consulHashicorp Consul Missing SSL Certificate Validation7.5 High
- golang go, fedoraproject fedora, netapp cloud insights telegraf +3 more +5 moreThe crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key...6.5 Medium
- wire, wireapp wire-ios-transport +1 moreCertificate pinning is not enforced on the web socket connection5.4 Medium
- siemens sinumerik analyse mycondition, sinumerik analyze myperformance, sinumerik analyze myperformance /oee-monitor +27 more +29 moreA vulnerability has been identified in SINUMERIK Analyse MyCondition (All versions), SINUMERIK...7.4 High
- nextcloud, kiteworks security-advisories +1 moreEnd-to-end encryption device setup did not verify public key5.7 Medium
- devolutions serverDevolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept...2.6 Low
- fossil-scm fossil, fedoraproject fedora +1 moreFossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS...7.5 High
- openvpn, openvpn 3 core library +1 moreOpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the...7.4 High
- getambassador emissary-ingressEmissary-Ingress (formerly Ambassador API Gateway) through 1.13.9 allows attackers to bypass...3.7 Low
- cisco catalyst center, digital network architecture center (dna center) +1 moreCisco DNA Center Certificate Validation Vulnerability7.4 High
- dell uefi bios https stack, alienware m15 r6 firmware, chengming 3990 firmware +126 more +128 moreDell UEFI BIOS https stack leveraged by the Dell BIOSConnect feature and Dell HTTPS Boot feature...5.9 Medium
- bitdefender antivirus plus, internet security, total security +2 moreImproper Certificate Validation vulnerability in the Online Threat Prevention module as used in...6.5 Medium
- cisco asyncos, web security appliance (wsa), email security appliance +1 more +3 moreCisco Email Security Appliance and Cisco Web Security Appliance Certificate Validation Vulnerability7.4 High
- nextcloud desktop, debian linux +1 morenextcloud-desktop - security update5.9 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, qualcomm apq8017 firmware, apq8053 firmware +97 more +99 moreWhile processing server certificate from IPSec server, certificate validation for subject...9.8 Critical
- atom tech inc. atom, atomtech smart life +1 moreThe ATOM (ATOM - Smart life App for Android versions prior to 1.8.1 and ATOM - Smart life App for...5.9 Medium
- dell emc networker, networker +1 moreDell EMC NetWorker, versions 18.x, 19.1.x, 19.2.x 19.3.x, 19.4, and 19.4.0.1 contain an Improper...7.1 High
- gitlabAll versions of GitLab CE/EE starting with 12.8 were affected by an issue in the handling of x509...2.6 Low
- fortinet fortiosAn improper following of a certificate's chain of trust vulnerability in FortiGate versions 6.4.0...6.5 Medium
- ui edgemax edgerouter firmwareA vulnerability found in EdgeMAX EdgeRouter V2.0.9 and earlier could allow a malicious actor to...7.5 High
- gnome libgrsslibgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds,...7.5 High
- nagios fusionIncorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of...9.8 Critical
- wp-cliImproper Certificate Validation in WP-CLI framework9.1 Critical
- mozilla firefoxA flaw in Mozilla's embedded certificate code might allow web sites to install root certificates...6.5 Medium
- elastic logstash, elasticsearch +1 moreIn Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw...3.7 Low
- prosody, debian linux, fedoraproject fedora +2 moreAn issue was discovered in Prosody before 0.11.9. The undocumented dialback_without_dialback...7.5 High
- nim-lang nim, embysupport security +1 moreNim stdlib httpClient does not validate peer certificates by default5.9 Medium
- paxtechnology paxstorePax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by an information disclosure...6.5 Medium
- d-link japan k.k. dap-1880ac, dlink dap-1880ac firmware +1 moreImproper following of a certificate's chain of trust vulnerability in DAP-1880AC firmware version...8.8 High
- xmlhttprequest-ssl project xmlhttprequest-sslImproper Certificate Validation in xmlhttprequest-ssl9.4 Critical
- hashicorp vaultHashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets...7.5 High
- hashicorp vaultHashiCorp Vault and Vault Enterprise 1.5.1 and newer, under certain circumstances, may exclude...7.5 High
- fibar group s.a fibaro home center, fibaro home center 2 firmware, home center lite firmware +2 moreFibaro Home Center Insufficient remote access server authorization5.9 Medium
- motorola mh702x, mh702x firmware +1 moreThe Motorola MH702x devices, prior to version 2.0.0.301, do not properly verify the server...8.1 High
- mongodb database tools, mongomirror +1 moreSpecific command line parameter might result in accepting invalid certificate4.2 Medium
- microfocus application automation toolsSSL/TLS certificate validation unconditionally disabled by Jenkins Micro Focus Application Automation Tools Plugin6.5 Medium
- proofpoint insider threat managementThe Proofpoint Insider Threat Management Agents (formerly ObserveIT Agent) for MacOS and Linux...7.4 High
- phpseclib, debian linux +1 moreImproper Certificate Validation in phpseclib7.5 High
- nim-lang nim, embysupport security +1 moreNimble falls back to insecure http url when fetching packages7.5 High
- nim-lang nim, embysupport security +1 moreNimble fails to validate certificates due to insecure httpClient defaults8.1 High
- openssl, fedoraproject fedora, freebsd +30 more +32 moreCA certificate check bypass with X509_V_FLAG_X509_STRICT7.4 High
- mifos mifos-mobileDisabled hostname verification and accepting self-signed certificates8.8 High
- cisco jabberCisco Jabber Desktop and Mobile Client Software Vulnerabilities9.9 Critical
- Show moreLoading…