CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- pidgin, debian linux +1 moreAn issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses...5.9 Medium
- hcl software verse for android, hcltech verse +1 moreAn SSL certificate host verification vulnerability affects HCL Verse for Android6.3 Medium
- haxx curl, debian linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +3 more +5 morelibcurl would reuse a previously created connection even when a TLS or SSHrelated option had been...7.5 High
- microsoft active directory, windows 10 version 1507, windows 10 version 1607 +25 more +27 moreActive Directory Domain Services Elevation of Privilege Vulnerability8.8 High
- parse-community parse-serverAuthentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter7.5 High
- openssl, netapp a250 firmware, a700s firmware +28 more +30 moreOCSP_basic_verify may incorrectly verify the response signing certificate5.3 Medium
- motorola device help android app, device help, ready for +1 more +3 moreVersions of Motorola Ready For and Motorola Device Help Android applications prior to 2021-04-08...6.8 Medium
- golang goCertificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when...7.5 High
- dell powerscale onefs, emc powerscale onefs +1 moreDell PowerScale OneFS, 8.2.x-9.3.x, contains a Improper Certificate Validation. A unauthenticated...7.5 High
- google android, mediatek, inc. mt6833, mt6853, mt6873, mt6877, mt6885, mt6893, mt8797 +1 moreIn ccu, there is a possible escalation of privilege due to a missing certificate validation. This...6.7 Medium
- mozilla thunderbirdWhen importing a revoked key that specified key compromise as the revocation reason, Thunderbird...5.4 Medium
- weechatWeeChat (aka Wee Enhanced Environment for Chat) 3.2 to 3.4 before 3.4.1 does not properly verify...4.3 Medium
ezsystems/ezplatform-admin-uiPackagistImproper Certificate Validation in node-sass affects eZ Platform5.3 Medium- google android, mediatek, inc. mt6580, mt6735, mt6737, mt6739, mt6753, mt6761, mt6765, mt6768, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6873, mt6877, mt6879, mt6883, mt6885, mt6889, mt6893, mt6895, mt6983, mt8666, mt8667, mt8675 +1 moreIn A-GPS, there is a possible man in the middle attack due to improper certificate validation....5.9 Medium
- jenkins proxmox, jenkins project proxmox plugin +1 moreSSL/TLS certificate validation globally disabled by Jenkins Proxmox Plugin7.5 High
- gitlabAn issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3...5.9 Medium
- 3cxThe client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for...9.1 Critical
- redhat kubeclientImproper Certificate Validation in kubeclient8.1 High
- owasp zed attack proxyImproper Certificate Validation in OWASP ZAP4.0 Medium
- cockpit-hq cockpit, redhat enterprise linux +1 moreA flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate...7.5 High
- siemens ruggedcom i800, ruggedcom i801, ruggedcom i802 +88 more +90 moreA vulnerability has been identified in RUGGEDCOM ROS M2100 (All versions < V5.6.0), RUGGEDCOM ROS...5.9 Medium
- hashicorp vault"Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under...6.5 Medium
- daj i-filter, i-filter browser \& cloud multiagent, digital arts inc. i-filter, i-filter browser & cloud multiagent for windows, and d-spa using i-filter +2 moreImproper check for certificate revocation in i-FILTER Ver.10.45R01 and earlier, i-FILTER Ver.9...3.7 Low
- vmware spring cloud gateway, oracle commerce guided search, communications cloud native core binding support function +3 more +5 moreIn spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable...5.5 Medium
- wolfsslIn wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual...7.5 High
- wolfsslIn wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication...6.5 Medium
- envoyproxy envoyIncorrect configuration handling allows TLS session re-use without re-validation in Envoy7.4 High
- envoyproxy envoyX.509 Extended Key Usage and Trust Purposes bypass in Envoy6.8 Medium
- envoyproxy envoyX.509 subjectAltName matching bypass in Envoy7.4 High
- libreoffice, fedoraproject fedora +1 moreIncorrect trust validation of signature with ambiguous KeyInfo children7.5 High
- pexip infinity connectPexip Infinity Connect before 1.8.0 mishandles TLS certificate validation. The allow list is not...9.8 Critical
- sigstore cosignImproper Certificate Validation in Cosign3.3 Low
- traefik, oracle communications unified inventory management +1 moreTraefik skips the router TLS configuration when the host header is an FQDN7.4 High
- hutoolImproper Certificate Validation in Hutool9.8 Critical
- mellium xmppImproper Validation of Certificate with Host Mismatch in mellium.im/xmpp/websocket5.9 Medium
- cisco small business rv160, rv260, rv340, and rv345 series routers, small business rv series router firmware, rv160 firmware +8 more +10 moreCisco Small Business RV Series Routers Vulnerabilities10.0 Critical
- google android, mediatek, inc. mt6580, mt6735, mt6739, mt6761, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6799, mt6833, mt6853, mt6873, mt6875, mt6877, mt6885, mt6891, mt6893 +1 moreIn Preloader XFLASH, there is a possible escalation of privilege due to an improper certificate...6.8 Medium
- schneider-electric clearscada, ecostruxure geo scada expert 2019, ecostruxure geo scada expert 2020 +2 moreA CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in...5.9 Medium
- schneider-electric clearscada, ecostruxure geo scada expert 2019, ecostruxure geo scada expert 2020 +2 moreA CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in...5.9 Medium
- sealevel seaconnect 370w firmwareA misconfiguration exists in the MQTTS functionality of Sealevel Systems, Inc. SeaConnect 370W v1...7.7 High
- europa technical specifications for digital covid certificatesThe EU Technical Specifications for Digital COVID Certificates before 1.1 mishandle certificate governance. A non-production public key certificate could have been used in production.9.8 Critical
- juniper junos, juniper networks junos os +1 moreJunos OS: Certificate validation is skipped when fetching system scripts from a HTTPS URL6.5 Medium
- nodejs node, node.js, debian linux +7 more +9 moreModerate: nodejs:14 security update5.3 Medium
- nodejs node, node.js, debian linux +7 more +9 moreNode.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names)...5.3 Medium
- nodejs node, node.js, oracle graalvm +6 more +8 moreAccepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to...7.4 High
- mozilla firefox, firefox esr, thunderbird +2 moreAfter accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the...6.5 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +27 more +29 moreWindows Certificate Spoofing Vulnerability7.8 High
- digitalbazaar forgeForge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store3.7 Low
- e2bn e2guardiane2guardian v5.4.x <= v5.4.3r is affected by missing SSL certificate validation in the SSL MITM...7.4 High
- fortinet forticlient, forticlient endpoint management server, forticlientems, forticlientwindows, forticlientlinux, forticlientmac +2 moreA combination of a use of hard-coded cryptographic key vulnerability [CWE-321] in FortiClientEMS...8.2 High
- Show moreLoading…