CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- fortinet fortianalyzer, fortimanager +1 moreAn improper certificate validation vulnerability [CWE-295] in FortiAnalyzer and FortiManager 7.2...6.8 Medium
- microchip maxview storage manager, siemens simatic ipc1047, simatic ipc1047e +7 more +9 moreA vulnerability has been identified in SIMATIC IPC1047 (All versions), SIMATIC IPC1047E (All...6.2 Medium
- pega synchronization engine, pegasystems rpa: synchronization engine +1 moreA user with a compromised configuration can start an unsigned binary as a service.7.5 High
- allegro bigflowAllegro Tech BigFlow vulnerable to Missing SSL Certificate Validation5.9 Medium
- nextcloud desktop, kiteworks security-advisories +1 moreNextcloud Desktop client does not verify received singed certificate in end-to-end encryption5.4 Medium
- netgear r6700v3, cbr40 firmware, lbr1020 firmware +22 more +24 moreThis vulnerability allows network-adjacent attackers to compromise the integrity of downloaded...5.0 Medium
- openssl, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +2 more +4 moreCertificate policy check not enabled5.3 Medium
- openssl, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +2 more +4 moreInvalid certificate policies in leaf certificates are silently ignored5.3 Medium
- componentspace samlComponentSpace.Saml2 4.4.0 Missing SSL Certificate Validation.9.8 Critical
- openssl, siemens bfcclient, simatic s7-1500 cpu 1518-4 pn/dp mfp +3 more +5 moreExcessive Resource Usage Verifying X.509 Policy Constraints7.5 High
- dell emc unisphere for powermax, emc unisphere for powermax virtual appliance, powermax os +1 more +3 moreDell EMC Unisphere for PowerMax versions before 9.1.0.27, Dell EMC Unisphere for PowerMax Virtual...7.4 High
- google android, android framework +1 moreIn WorkSource, there is a possible parcel mismatch. This could lead to local escalation of...7.8 High
- hitachi infrastructure analytics advisor, ops center analyzer +1 moreMan-in-the-middle attack Vulnerability in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer8.6 High
- fedoraproject fedora, red hat directory server +1 moreA flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the...5.5 Medium
- fortinet fortios, fortiproxy +1 moreAn improper certificate validation vulnerability [CWE-295] in FortiOS 7.2.0 through 7.2.3, 7.0.0...4.4 Medium
- palantir sls-loggingIt was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a...6.3 Medium
- palantir magritte-ftp, foundry magritte +1 moreIt was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a...6.3 Medium
- palantir gotham chat irc, gotham chat irc helper +1 moreGotham Chat IRC help does not validate hostnames in TLS certificates5.7 Medium
- palantir atlasdbIt was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a...6.3 Medium
- splunk add-on builder, cloudconnect sdk, cloudconnect software development kit +2 moreModular Input REST API Requests Connect via HTTP after Certificate Validation Failure in Splunk Add-on Builder and Splunk CloudConnect SDK4.8 Medium
- ichiranusa ichiran, betrend corporation and ichiran inc. ichiran app for ios and ichiran app for android +1 moreIchiran App for iOS versions prior to 3.1.0 and Ichiran App for Android versions prior to 3.1.0...5.9 Medium
- dell system updateDell System Update, version 2.0.0 and earlier, contains an Improper Certificate Validation in...6.5 Medium
- mozilla thunderbirdCertificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed...6.5 Medium
- bticino door entry for hometouchBTicino Door Entry HOMETOUCH for iOS 1.4.2 was discovered to be missing an SSL certificate.5.9 Medium
- cloudfoundry diego, cf-deployment +1 moreStarting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up...9.1 Critical
- rapid7 insightvm, nexpose +1 moreRapid7 Nexpose Certificate Validation Issue5.3 Medium
- dell powerscale onefs, emc powerscale onefs +1 moreDell PowerScale OneFS, versions 8.2.x-9.3.x, contains an Improper Certificate Validation...8.1 High
- selfwealthSelfwealth iOS mobile App 3.3.1 is vulnerable to Insecure App Transport Security (ATS) Settings.7.5 High
- schneider electric ecostruxure™ cybersecurity admin expert (cae), schneider-electric ecostruxure cybersecurity admin expert +1 moreA CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software...7.9 High
- debian linux, lemonldap-ng apache\ +1 moreIn Apache::Session::Browseable before 1.3.6, validity of the X.509 certificate is not checked by...8.1 High
- debian linux, lemonldap-ng apache\ +1 moreIn Apache::Session::LDAP before 0.5, validity of the X.509 certificate is not checked by default...8.1 High
- pyload, pyload pyload/pyload, pyload-ng project pyload-ng +2 moreImproper Certificate Validation in pyload/pyload7.4 High
- jruby jruby-openssljruby-openssl gem for JRuby fails to do proper certificate validation7.5 High
- dell cloud mobility for dell emc storage, cloud mobility for dell storage +1 moreCloud Mobility for Dell EMC Storage, versions 1.3.0.X and below contains an Improper Check for...7.0 High
- rydesharing rydeInformation disclosure due to an insecure hostname validation in the RYDE application 5.8.43 for...8.8 High
- apache bookkeeperApache BookKeeper: Java Client Uses Connection to Host that Failed Hostname Verification5.9 Medium
- slixmpp project slixmppSlixmpp lacks SSL Certificate hostname validation in XMLStream7.5 High
- traefikRoutes exposed with an empty TLSOption in traefik8.1 High
- nextcloud desktop, kiteworks security-advisories +1 morenextcloudcmd incorrectly trusts bad TLS certificates3.9 Low
- botan project botanCVE-2022-43705 affecting package botan2 2.14.0-29.1 Critical
- mozilla firefoxIf the user added a security exception for an invalid TLS certificate, opened an ongoing TLS...6.5 Medium
- jenkins ns-nd integration performance publisher, jenkins project ns-nd integration performance publisher plugin +1 moreJenkins NS-ND Integration Performance Publisher Plugin disables SSL/TLS certificate validation globally and unconditionally7.5 High
- liferay portal, digital experience platform +1 moreImproper Certificate Validation in Liferay Portal4.8 Medium
- jenkins ns-nd integration performance publisher, jenkins project ns-nd integration performance publisher plugin +1 moreSSL/TLS certificate validation unconditionally disabled by Jenkins NS-ND Integration Performance Publisher Plugin7.5 High
- apache pulsarApache Pulsar C++/Python OAuth Clients prior to 3.0.0 were vulnerable to an MITM attack due to Disabled Certificate Validation8.1 High
- cisco email security appliance, secure email +1 moreA vulnerability in Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an...7.5 High
- apple ipados, macos, tvos +2 more +4 moreA certificate validation issue existed in the handling of WKWebView. This issue was addressed...9.8 Critical
- hashicorp vaultHashiCorp Vault's revocation list not respected5.3 Medium
- siemens industrial edge managementA vulnerability has been identified in Industrial Edge Management (All versions < V1.5.1). The...7.4 High
- trend micro apex oneAn improper certification validation vulnerability in Trend Micro Apex One agents could allow a...7.8 High
- Show moreLoading…