CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- dell networking os10, smartfabric os10 +1 moreDell OS10, version 10.5.3.4, contains an Improper Certificate Validation vulnerability in Support...3.7 Low
- nheko-reborn nheko, fedoraproject fedora +1 morenheko vulnerable to secret poisoning using MITM on secret requests by the homeserver8.6 High
- velneo vclientVelneo vClient Improper authentication6.3 Medium
- apache pulsarDisabled Certificate Validation makes Broker, Proxy Admin Clients vulnerable to MITM attack5.9 Medium
- apache pulsarDisabled Hostname Verification makes Brokers, Proxies vulnerable to MITM attack5.9 Medium
- apache pulsarImproper Hostname Verification in Java Client and Proxy can expose authentication data via MITM5.9 Medium
- jenkins view26 test-reporting, jenkins project view26 test-reporting plugin +1 moreMissing hostname validation in Jenkins View26 Test-Reporting Plugin8.1 High
- jenkins smalltest, jenkins project smalltest plugin +1 moreJenkins SmallTest Plugin missing hostname validation8.1 High
- fabasoft cloud enterprise clientThe folioupdate service in Fabasoft Cloud Enterprise Client 22.4.0043 allows Local Privilege...7.8 High
- mozilla firefoxWhen a TLS Certificate error occurs on a domain protected by the HSTS header, the browser should...8.1 High
- primekey ejbcaAn issue was discovered in Keyfactor PrimeKey EJBCA before 7.9.0, related to possible...9.8 Critical
- freshworks freshservice agent, freshservice probe +1 moreFreshService macOS Agent < 4.4.0 and FreshServce Linux Agent < 3.4.0 are vulnerable to TLS Man-in...8.1 High
- python-scciclient project python-scciclient, debian linux +1 morepython-scciclient vulnerable to Man-in-the-middle (MITM) attacks7.4 High
- fedoraproject fedora, redhat ansible automation platform, openshift container platform +2 moreAn Improper Certificate Validation attack was found in Openshift. A re-encrypt Route with...6.5 Medium
- postgresqlOdyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is...5.9 Medium
- odyssey project odysseyOdyssey passes to server unencrypted bytes from man-in-the-middle When Odyssey is configured to...8.1 High
- keycloakKeycloak vulnerable to Improper Certificate Validation5.4 Medium
- opencryptokiA flaw was found in openCryptoki. The openCryptoki Soft token does not check if an EC key is...5.5 Medium
- splunk, splunk enterprise +1 moreIngest Actions UI in Splunk Enterprise 9.0.0 disabled TLS certificate validation7.4 High
- hj holdings, inc. 'hulu / フールー' app for ios, hjholdings hulu +1 more'Hulu / ????' App for iOS versions prior to 3.0.81 improperly verifies server certificates, which...4.8 Medium
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +9 more +11 moreTraffic intelligence feeds vulnerability CVE-2022-348654.8 Medium
- typelevel fs2mTLS client verification is skipped in fs2 on Node.js9.1 Critical
- teradici tera2 pcoip zero client firmwareWhen connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not...8.1 High
- jenkins git client, jenkins project git client plugin +1 moreJenkins Git client plugin 3.11.0 does not perform SSH host key verification8.1 High
- libreofficeExecution of Untrusted Macros Due to Improper Certificate Validation7.5 High
- cisco nexus dashboardCisco Nexus Dashboard SSL Certificate Validation Vulnerability7.4 High
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM 7.3, 7.4, and 7.5 does not preform proper certificate validation for some inter...5.9 Medium
- fortinet fortitokenandroid, fortinet fortitokenios, fortinet fortitokenwinapp, fortitoken mobile +1 moreA improper validation of certificate with host mismatch in Fortinet FortiTokenAndroid version 5.0...6.4 Medium
- debian linux, lemonldap-ng lemonldap\ +1 moreIn LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not...7.5 High
- argoproj argo cd, argo-cd +1 moreArgo CD's certificate verification is skipped for connections to OIDC providers8.3 High
- cisco expressway, telepresence video communication server, telepresence video communication server (vcs) expressway +2 moreCisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities9.0 Critical
- red hat cloudforms, redhat cloudforms management engine +1 moreA insecure configuration for certificate verification (http.verify_mode = OpenSSL::SSL:...9.1 Critical
- parse-community parse-serverAuthentication bypass in Parse Server Apple Game Center auth adapter8.6 High
- nodejs undiciProxyAgent vulnerable to MITM6.5 Medium
- splunk, splunk cloud platform, enterprise +2 more +4 moreSplunk Enterprise lacked TLS host name validation8.1 High
- splunk, splunk cloud platform, enterprise +2 moreSplunk Enterprise lacked TLS cert validation for Splunk-to-Splunk communication by default8.1 High
- splunk, splunk cloud platform, enterprise +2 more +4 moreSplunk Enterprise disabled TLS validation using the CA certificate stores in Python 3 libraries by default7.4 High
- dena mobaoku-auction \& flea market, dena co., ltd. mobaoku-auction & flea market app for ios +1 more'Mobaoku-Auction&Flea Market' App for iOS versions prior to 5.5.16 improperly verifies server...3.7 Low
- splunk, splunk enterprise, universal forwarder +2 moreSplunk Enterprise and Universal Forwarder CLI connections lacked TLS cert validation7.4 High
- couchbase sync gatewayCouchbase Sync Gateway admin credentials not verified when using X.509 client cert authentication9.8 Critical
- drupal saml sp 2.0 single sign on, xecuify drupal 7 miniorange saml sp, drupal 8 miniorange saml sp +1 more +3 moreminiOrange SAML Authentication Bypass9.8 Critical
- dell bsafe micro edition suite, bsafe micro-edition-suite, oracle http server +2 more +4 moreDell BSAFE Micro Edition Suite, versions prior to 4.5.1, contain an Improper Certificate...7.5 High
- mozilla thunderbirdWhen displaying the sender of an email, and the sender name contained the Braille Pattern Blank...6.5 Medium
- apple ipados, macos, tvos +3 more +5 moreA certificate parsing issue was addressed with improved checks. This issue is fixed in tvOS 15.5,...5.5 Medium
- dell emc networker, networker +1 moreDell EMC NetWorker versions 19.1.x, 19.1.0.x, 19.1.1.x, 19.2.x, 19.2.0.x, 19.2.1.x 19.3.x, 19.3.0...3.7 Low
- fortinet fortiosAn improper certificate validation vulnerability [CWE-295] in FortiOS 6.0.0 through 6.0.14, 6.2.0...5.4 Medium
- pion dtlsImproper Certificate Validation in Pion DTLS5.9 Medium
- zoom meetings, zoom video communications inc client for meetings for android, client for meetings for ios +3 more +5 moreInsufficient hostname validation during Clusterswitch message in Zoom Client for Meetings5.9 Medium
- ibm secure external authentication server, sterling secure proxy +1 moreIBM Sterling Secure Proxy 6.0.3 and IBM Secure External Authentication Server 6.0.3 does not...5.3 Medium
- htc mail, one, sense +2 moreHTC One/Sense Mail Client certificate validation4.8 Medium
- Show moreLoading…