CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- casbin casdoorcasdoor's use of`ssh.InsecureIgnoreHostKey()` disables host key verification7.5 High
- filestashAn issue was discovered in filestash v0.4. The usage of the ssh.InsecureIgnoreHostKey() disables...5.3 Medium
- filestashFilestash skips TLS certificate verification process when sending out email verification codes5.9 Medium
- filestashFilestash configured to skip TLS certificate verification when using the FTPS protocol7.5 High
- beegoBeego privilege escalation vulnerability8.8 High
- lenovo tab k10An improper validation vulnerability was reported in the Lenovo Tab K10 that could allow a...2.8 Low
- isc storkIncorrect TLS certificate validation can lead to escalated privileges8.9 High
- electron, electron electron-builder +1 moreCode Signing Bypass on Windows in electron-updater < 6.3.0-alpha.67.5 High
- fortinet fortiadcAn improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2.0 through 7.2.3...7.2 High
- fortinet fortiadcAn improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2 all versions, 7...4.7 Medium
- fortinet fortiwebAn improper certificate validation vulnerability [CWE-295] in FortiWeb 7.2.0 through 7.2.1, 7.0...4.4 Medium
- s3browser s3 browserAn issue in S3Browser v.11.4.5 and v.10.9.9 and fixed in v.11.5.7 allows a remote attacker to...5.9 Medium
- samsung exynos modem 5300 firmwareA vulnerability in Samsung Exynos Modem 5300 allows a Man-in-the-Middle (MITM) attacker to...5.3 Medium
- botan project botanBotan has an Authorization Error due to Name Constraint Decoding Bug5.3 Medium
- google android, linuxfoundation yocto, mediatek mt2735 +36 more +38 moreIn gnss service, there is a possible escalation of privilege due to improper certificate...9.8 Critical
- ibm cognos analyticsIBM Cognos Analytics improper certificate validation5.9 Medium
- libreofficeTLS certificate are not properly verified when utilizing LibreOfficeKit10.0 Critical
- hitachi energy foxman-un, unem, hitachienergy foxman un +2 moreA vulnerability exists in the FOXMAN-UN/UNEM server that affects the message queueing mechanism...7.4 High
- ibm security verify access dockerIBM Security Verify Access privilege escalation7.7 High
- foxit reader, foxitsoftware foxit reader, foxit pdf editor +1 more +3 moreA privilege escalation vulnerability exists in the Foxit Reader 2024.2.0.25138. The vulnerability occurs due to improper certification validation of the updater executable before executing it. A low p…8.2 High
- tp-link tapo, tether +1 moreTP-Link Tether versions prior to 4.5.13 and TP-Link Tapo versions prior to 3.3.6 do not properly...4.8 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper...5.9 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +31 more +33 moreWindows Cryptographic Services Remote Code Execution Vulnerability8.1 High
- nuki bridge v1, bridge v2, smart lock v3 pro +2 moreAn issue was discovered on certain Nuki Home Solutions devices. Lack of certificate validation on...8.8 High
- f5 big-ip next central managerBIG-IP Next Central Manager vulnerability6.8 Medium
- bec technologies multiple routers, netgear rax50 firmware +1 moreNETGEAR Multiple Routers curl_post Improper Certificate Validation Remote Code Execution Vulnerability8.1 High
- ezviz cs-c6-21wfr-8EZVIZ CS-C6-21WFR-8 Davinci Application certificate validation3.7 Low
- hualai isc5Hualai Xiaofang iSC5 certificate validation3.7 Low
- apache airflow, apache software foundation airflow ftp provider, apache apache-airflow-providers-ftp +2 moreApache Airflow FTP Provider: FTP_TLS instance with unverified SSL context2.7 Low
- ibm aspera faspexIBM Aspera Faspex data manipulation3.6 Low
- cym1102 nginxwebui, nginxui nginx ui +1 morecym1102 nginxWebUI saveCmd handlePath certificate validation7.3 High
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar improper certificate validation5.9 Medium
- ibm security verify access appliance, security verify access +1 moreIBM Security Verify Access Appliance improper certificate validation7.5 High
- ibm security verify access appliance, security verify access +1 moreIBM Security Verify Access Appliance missing certificate validation7.5 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +30 more +32 moreWindows Cryptographic Services Remote Code Execution Vulnerability8.4 High
- pdf-xchange editor, pdf-tools +1 morePDF-XChange Editor Updater Improper Certificate Validation Remote Code Execution Vulnerability7.5 High
- google androidIn TBD of TBD, there is a possible confusion of OEM and DRM certificates due to improperly used...7.8 High
- serverpodServerpod client accepts any certificate7.4 High
- curl, apple macos, netapp active iq unified manager +14 more +16 moreQUIC certificate check bypass with wolfSSL6.3 Medium
- toyoko inn it solution co., ltd. inn official app for android, inn official app for ios, toyoko inn inn +2 moreThe Toyoko Inn official App for iOS versions prior to 1.13.0 and Toyoko Inn official App for...4.8 Medium
- apple macos, safari, ios and ipados +2 more +4 moreThis issue was addressed through improved state management. This issue is fixed in Safari 17.4,...4.3 Medium
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more +4 moreMongoDB Server may allow successful untrusted connection8.8 High
- jenkins delphix, jenkins project delphix plugin +1 moreJenkins Delphix Plugin has improper SSL/TLS certificate validation4.2 Medium
- jenkins delphix, jenkins project delphix plugin +1 moreJenkins Delphix Plugin has SSL/TLS certificate validation disabled by default5.3 Medium
- hashicorp vault, vault enterprise, openbao +2 moreVault Cert Auth Method Did Not Correctly Validate Non-CA Certificates8.1 High
- ibm cloud pak for security, qradar suite products, qradar suite +2 moreIBM QRadar Suite information dislosure5.9 Medium
- apache airflow mongo provider, apache-airflow-providers-mongo +1 moreApache Airflow Mongo Provider: Certificate validation isn't respected even if SSL is enabled for apache-airflow-providers-mongo9.1 Critical
- apache dolphinschedulerApache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil7.3 High
- fortinet fortiosAn improper certificate validation vulnerability in Fortinet FortiOS 7.0.0 - 7.0.13, 7.2.0 - 7.2...4.4 Medium
- sap cloud connectorImproper Certificate Validation in SAP Cloud Connector7.4 High
- Show moreLoading…