CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- ibm storage virtualizeIBM Storage Virtualize improper certificate validation5.9 Medium
- ibm security verify access, security verify access appliance, security verify access docker +2 moreIBM Security Verify Access man in the middle8.2 High
- ibm security verify access, security verify access appliance, security verify access docker +2 moreIBM Security Verify Access man in the middle7.5 High
- rustdeskA default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under...9.8 Critical
- hashicorp boundary, boundary enterprise +1 moreBoundary Vulnerable to Session Hijacking Through TLS Certificate Tampering8.0 High
- dell bsafe crypto-c micro edition, bsafe micro edition suite, bsafe crypto-c-micro-edition +1 more +3 moreDell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite,...7.4 High
- zscaler zia, secure internet and saas access +1 moreBypass of ZIA domain fronting detection module through evasion technique5.1 Medium
- areal sas topkapi vision (server), areal-topkapi vision server +1 moreImproper Certificate Validation in AREAL Topkapi Vision (Server)6.5 Medium
- curlOCSP verification bypass with TLS session reuse5.3 Medium
- meshcentralYlianst MeshCentral Missing SSL Certificate Validation9.8 Critical
- splicecom maximiser soft pbxSpliceCom Maximiser Soft PBX v1.5 and before was discovered to utilize a default SSL certificate....5.3 Medium
- splicecom ipcs, ipcs2 +1 moreA lack of SSL certificate validation in Splicecom iPCS (iOS App) v1.3.4, iPCS2 (iOS App) v2.8 and...5.9 Medium
- lenovo vantageA privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local...7.8 High
- cohesity dataplatformCohesity DataProtect 6.8.1 and 6.6.0d was discovered to have a incorrect access control...6.5 Medium
- snowflake connector, snowflakedb snowflake-connector-net +1 moreSnowflake Connector .NET does not properly check the Certificate Revocation List (CRL)6.0 Medium
- eset security, endpoint antivirus, endpoint security +19 more +21 moreImproper following of a certificate's chain of trust in ESET security products7.5 High
- hitachi energy rtu500 scripting interfaceA vulnerability exists in the component RTU500 Scripting interface. When a client connects to a...7.4 High
- gitlabImproper Certificate Validation in GitLab7.4 High
- siemens sinec insA vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected...8.1 High
- beyondtrust privilege management for windowsAn issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. If the...7.8 High
- zammadAn issue was discovered in Zammad before 6.2.0. In several subsystems, SSL/TLS was used to...5.9 Medium
- huawei emui, harmonyos +1 morePermission verification vulnerability in distributed scenarios. Successful exploitation of this...7.5 High
- kepware kepserverex, ge industrial gateway server, ptc keepserverex +6 more +8 moreImproper Validation of Certificate with Host Mismatch in PTC KEPServerEx7.5 High
- precisionbridge precision bridgePrecision Bridge PrecisionBridge.exe (aka the thick client) before 7.3.21 allows an integrity...9.1 Critical
- dell unity, unity operating environment, unity xt operating environment +1 more +3 moreDell Unity prior to 5.3 contains a 'man in the middle' vulnerability in the vmadapter component....8.6 High
- localstackMissing SSL certificate validation in localstack7.4 High
- httpieHTTPie allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack7.4 High
- samsung android, samsung mobile devices +1 moreImproper Certificate Validation in FotaAgent prior to SMR Nov-2023 Release1 allows remote...5.9 Medium
- squid-cache squidSQUID-2023:4 Denial of Service in SSL Certificate validation8.6 High
- google androidIn ca-certificates, there is a possible way to read encrypted TLS data due to untrusted...7.5 High
- turing edge\+ evc5fd, edge\+ evc5fd firmware +1 moreAn issue in Turing Video Turing Edge+ EVC5FD v.1.38.6 allows remote attacker to execute arbitrary...9.8 Critical
- google androidIn UWB Google, there is a possible way for a malicious app to masquerade as system app com...7.8 High
- elastic apm server, beats, agent +1 more +3 moreBeats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue5.9 Medium
- networknt light-oauth2light-oauth2 missing public key verification5.9 Medium
- openvpn connectOpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows...5.9 Medium
- ibm security verify privilege, security verify privilege on-premises +1 moreIBM Security Verify Privilege information disclosure3.7 Low
- ibm security verify privilege, security verify privilege on-premises +1 moreIBM Security Verify Privilege improper authentication5.0 Medium
- otrs, otrs ag ((otrs)) community edition, otrs community edition community edition +2 moreSSL Certificates are not checked for E-Mail Handling8.7 High
- hp thinupdateA potential security vulnerability has been identified in the HP ThinUpdate utility (also known...7.5 High
- line corporation client for ios, linecorp line +1 moreLack of TLS certificate verification in log transmission of a financial module within LINE Client...4.8 Medium
- nettyNetty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks7.4 High
- jetbrains ktorIn JetBrains Ktor before 2.3.5 server certificates were not verified6.8 Medium
- infinispan hot rod, red hat data grid 8.4.6, redhat data grid +2 moreHotrod-client: hot rod client does not enable hostname validation when using tls that lead to a mitm attack7.4 High
- apple ipados, macos, ios and ipados +2 more +4 moreA certificate validation issue was addressed. This issue is fixed in iOS 16.7 and iPadOS 16.7, OS...5.5 Medium
- minitool power data recoveryMiniTool Power Data Recovery 11.6 contains an insecure installation process that allows attackers...8.1 High
- minitool movie makerMiniTool Movie Maker 6.1.0 contains an insecure installation process that allows attackers to...8.1 High
- minitool shadowmakerMiniTool Movie Maker 4.1 contains an insecure installation process that allows attackers to...8.1 High
- minitool power data recoveryMiniTool Power Data Recovery 11.5 contains an insecure in-app payment system that allows...5.9 Medium
- minitool partition wizardMiniTool Partition Wizard 12.8 contains an insecure update mechanism that allows attackers to...8.1 High
- minitool partition wizardMiniTool Partition Wizard 12.8 contains an insecure installation mechanism that allows attackers...8.1 High
- Show moreLoading…