CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft defender for iotMicrosoft Defender for IoT Remote Code Execution Vulnerability9.0 Critical
- apache sling commons messaging mailSMTPS server hostname not checked when making TLS connection to SMTPS server7.4 High
- siemens sinumerik edgeA vulnerability has been identified in SINUMERIK Edge (All versions < V3.2). The affected...7.4 High
- ibm spectrum protect plusThe IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x server connection to an IBM Spectrum...6.8 Medium
- pluck-cms pluckMissing SSL Certificate Validation issue exists in Pluck 4.7.15 in update_applet.php, which could...4.8 Medium
- debian linux, f5 nginx, fedoraproject fedora +2 more +4 moreALPACA is an application layer protocol content confusion attack, exploiting TLS servers...7.4 High
- codesys gitImproper Certificate Validation in CODESYS Git7.4 High
- amazon web services aws-c-io, amazon web services aws iot device sdk v2 for c++, aws iot device sdk v2 for java +4 more +6 moreMissing SNI validation and inconsistent CA override function behavior within AWS IoT Device SDKs on Apple devices6.3 Medium
- amazon web services aws-c-io, amazon web services aws iot device sdk v2 for c++, aws iot device sdk v2 for java +4 more +6 moreInconsistent CA override function behavior within AWS IoT Device SDKs on Unix systems6.3 Medium
- amazon web services aws iot device sdk v2 for c++, aws iot device sdk v2 for java, aws iot device sdk v2 for node.js +3 more +5 moreTLS hostname validation issues within AWS IoT Device SDKs on macOS6.3 Medium
- amazon web services aws iot device sdk v2 for c++, aws iot device sdk v2 for java, aws iot device sdk v2 for node.js +4 more +6 moreTLS hostname validation issues within AWS IoT Device SDKs on Windows6.3 Medium
- pgbouncer, debian linux, fedoraproject fedora +1 more +3 moreWhen PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can...8.1 High
- gallagher command centreImproper certificate validation vulnerability in SMTP Client allows man-in-the-middle attack to...8.1 High
- gallagher command centre mobile connect for android, command centre mobile connect +1 moreImproper validation of the cloud certificate chain in Mobile Connect allows man-in-the-middle...7.7 High
- gallagher command centre mobile client for android, command centre mobile client +1 moreImproper validation of the cloud certificate chain in Mobile Client allows man-in-the-middle...9.0 Critical
- amd 1st gen amd epyc™, 2nd gen amd epyc™, 3rd gen amd epyc™ +57 more +59 moreInsufficient validation of the AMD SEV Signing Key (ASK) in the SEND_START command in the SEV...5.5 Medium
- fort validator project validator, debian linux +1 moreFORT Validator versions prior to 1.5.2 will crash if an RPKI CA publishes an X.509 EE certificate...7.5 High
- fortinet fortiosAn improper validation of certificate with host mismatch [CWE-297] vulnerability in FortiOS...3.5 Low
- ibm infosphere information serverIBM InfoSphere Data Flow Designer Engine (IBM InfoSphere Information Server 11.7 ) component has...5.9 Medium
- abb pcm600, pcm600 update manager, update manager +2 moreCertificate verification vulnerability in Update Manager of PCM600 Engineering Tool6.7 Medium
- northern.tech cfengineCFEngine Enterprise 3.15.0 through 3.15.4 has Missing SSL Certificate Validation.6.5 Medium
- squid-cache squid, fedoraproject fedora +1 moreAn issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly classify certain certificates as trusted. This problem allo…7.5 High
- soda, inc. snkrdunk market place app for ios, soda-inc snkrdunk +1 moreThe SNKRDUNK Market Place App for iOS versions prior to 2.2.0 does not verify server certificate...7.4 High
- libreofficeContent Manipulation with Certificate Validation Attack5.2 Medium
- libreoffice, debian linux +1 moreTimestamp Manipulation with Signature Wrapping7.5 High
- libreoffice, debian linux +1 moreContent Manipulation with Double Certificate Attack7.5 High
- tibco activespaces, eftl, ftl +9 more +11 moreTIBCO FTL unvalidated SAN in client certificates7.5 High
- adobe experience managerAdobe Experience Manager Improper Certificate Validation Could Lead to Man In The Middle Attack5.9 Medium
- zoom meetings, zoom video communications inc client for meetings for windows +1 moreThe Zoom Client for Meetings for Windows in all versions before 5.3.0 fails to properly validate...9.8 Critical
- ibm security verify bridgeIBM Security Verify Bridge 1.0.5.0 could allow a user to obtain sensitive information due to...6.1 Medium
- ibm security verify bridgeIBM Security Verify Bridge 1.0.5.0 does not properly validate a certificate which could allow a...2.5 Low
- sap cloud connectorPotentially, SAP Cloud Connector, version - 2.0 communication with the backend is accepted...6.8 Medium
- apple ipados, ios and ipados, iphone os +2 moreA certificate validation issue was addressed. This issue is fixed in iOS 14.5 and iPadOS 14.5. An...5.3 Medium
- cloudflare octorpki, debian linux +1 moreOctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values7.5 High
- hashicorp nomadPrivilege escalation in Hashicorp Nomad8.8 High
- hashicorp consulHashiCorp Consul Privilege Escalation Vulnerability8.8 High
- puppet remediateThe mechanism which performs certificate validation was discovered to have a flaw that resulted...7.5 High
- arm mbed tls, debian linux, siemens logo\! cmr2020 firmware +5 more +7 moreAn issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS)....7.5 High
- arm mbed tlsAn issue was discovered in Mbed TLS before 2.24.0. The verification of X.509 certificates when...5.9 Medium
- gnome grilo, debian linux +1 moreIn GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the...5.9 Medium
- gnome libgfbgraph, fedoraproject fedora +1 moreIn GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification...5.9 Medium
- gnome libzapojit, fedoraproject fedora +1 moreIn GNOME libzapojit through 0.0.3, zpj-skydrive.c does not enable TLS certificate verification on...5.9 Medium
- gnome evolution-rssIn GNOME evolution-rss through 0.3.96, network-soup.c does not enable TLS certificate...5.9 Medium
- gnome libgda, fedoraproject fedora +1 moreIn GNOME libgda through 6.0.0, gda-web-provider.c does not enable TLS certificate verification on...5.9 Medium
- icinga, debian linux, icinga icinga2 +2 moreMissing TLS service certificate validation in GelfWriter, ElasticsearchWriter, InfluxdbWriter and Influxdb2Writer7.5 High
- nextcloud desktop, debian linux, kiteworks security-advisories +2 moreEnd-to-end encryption device setup did not verify public key6.5 Medium
- nodejs node, node.js, debian linux +6 more +8 moreIf the Node.js https API was used incorrectly and "undefined" was in passed for the ...5.3 Medium
- mitel micollabThe AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the...4.8 Medium
- 2n access unit 2.0 firmwareOn 2N Access Unit 2.0 2.31.0.40.5 devices, an attacker can pose as the web relay for a man-in-the...4.6 Medium
- acronis true image, cyber protect cloud, cyber protection agent +2 moreAcronis True Image prior to 2021 Update 4 for Windows, Acronis True Image prior to 2021 Update 5...8.1 High
- Show moreLoading…