CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- apache tomcat, tomcat native, red hat enterprise linux 10 +10 more +12 moreApache Tomcat Native, Apache Tomcat: OCSP revocation bypass7.5 High
- apache tomcatApache Tomcat: Client certificate verification bypass due to virtual host mapping9.1 Critical
- alistgo alistAlist has Insecure TLS Config9.1 Critical
- asustor adm, data master +1 moreAn improper certificate validation vulnerability was found in a third-party NAT traversal module.6.3 Medium
- asustor adm, data master +1 moreAn improper certificate validation vulnerability was found in ADM while querying an external server for the device's WAN IP address.6.3 Medium
- asustor adm, data master +1 moreAn improper certificate validation vulnerability was found in ADM while sending HTTPS requests to the server.8.9 High
- asustor adm, data master +1 moreAn improper certificate validation vulnerability was found in ADM while updating the DDNS settings.8.9 High
- aws sagemaker python sdkTLS disabled by default in select aws/sagemaker-python-sdk configurations8.2 High
- aws sagemaker python sdkCleartext transmission of sensitive materials in aws/sagemaker-python-sdk8.5 High
- red hat satellite 6, satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +1 more +3 moreFog-kubevirt: fog-kubevirt: man-in-the-middle vulnerability due to disabled certificate validation8.1 High
- red hat satellite 6, satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +2 more +4 moreForeman-kubevirt: foreman_kubevirt: man-in-the-middle due to insecure default ssl verification8.1 High
- suse rancherRancher CLI skips TLS verification on Rancher CLI login command8.3 High
- brother industries, ltd. multiple mfpsMultiple MFPs provided by Brother Industries, Ltd. does not properly validate server certificates...6.3 Medium
- netgear r6230 firmware, r6260 firmware, r7000 firmware +7 more +9 moreFunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, does not...7.7 High
- phala-network dcap-qvldcap-qvl has Missing Verification for QE Identity9.3 Critical
- todesktop builderAn improper certificate validation vulnerability exists in ToDesktop Builder v0.32.1 This...9.8 Critical
- bosch infotainment system ecuMisconfigured SSL/TLS communication of Redbend service for Infotainment ECU6.5 Medium
- altium designerMissing Validation of Self-Signed Certificates in Altium Designer Allows Man-in-the-Middle Attacks5.3 Medium
- oracle graalvm, graalvm for jdk, jdk +32 more +34 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...7.5 High
- b&r industrial automation gmbh automation studioImproper Server Certificate Validation in Automation Studio9.1 Critical
- go standard library crypto/tls, golang go +1 moreUnexpected session resumption in crypto/tls10.0 Critical
- weblate wlcwlc can skip SSL verification2.5 Low
- mrvladus errandsErrands before 46.2.10 does not verify TLS certificates for CalDAV servers.8.2 High
- automai botmanagerAn issue in Automai BotManager v.25.2.0 allows a remote attacker to execute arbitrary code via...9.8 Critical
- curlOpenSSL partial chain store policy bypass5.3 Medium
- curlNo QUIC certificate pinning with GnuTLS5.9 Medium
- kde messagelibKDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe...3.4 Low
- hanwha vision co., ltd. qnv-c8012, hanwhavision knb-2000 firmware, knb-5000n firmware +254 more +256 moreInsufficient certificate validation6.3 Medium
- apache log4j, apache software foundation log4j core +1 moreApache Log4j Core: Missing TLS hostname verification in Socket appender6.3 Medium
- elastic elasticsearchElasticsearch Improper Authentication6.8 Medium
- line corporation client for ios, linecorp line +1 moreLINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS...7.7 High
- suse neuvectorNeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)8.8 High
- asustor adm, data master +1 moreAn improper certificates validation vulnerability was found in the Notification settings of ADM7.0 High
- meatmeetDue to a lack of certificate validation, all traffic from the mobile application can be...9.1 Critical
- aqara camera hub g3 firmware, hub m2 firmware, hub m3 firmware +2 moreAqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, Camera Hub G3 4.1.9_0027 fail...7.4 High
- aqara camera hub g3 firmware, hub m2 firmware, hub m3 firmware +2 moreAqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025...7.4 High
- siemens comos v10.6, jt bi-directional translator for step, nx v2412 +6 more +8 moreA vulnerability has been identified in COMOS V10.6 (All versions), COMOS V10.6 (All versions), JT...9.2 Critical
- siemens comos v10.6, nx v2412, nx v2506 +4 more +6 moreA vulnerability has been identified in COMOS V10.6 (All versions), COMOS V10.6 (All versions), NX...9.1 Critical
- traefikTraefik has Inverted TLS Verification Logic in its ingress-nginx Provider5.9 Medium
- go standard library crypto/x509, golang go +1 moreImproper application of excluded DNS name constraints when verifying wildcard names in crypto/x5096.5 Medium
- go standard library crypto/x509, golang go +1 moreExcessive resource consumption when printing error string for host certificate validation in crypto/x5097.5 High
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 moreImproper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server2.3 Low
- gl-inet gl-axt1800A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4...8.3 High
- kddi corporation 'デジラアプリ' app for iosImproper certificate validation vulnerability exists in 'デジラアプリ' App for iOS prior to ver.80.10...2.3 Low
- tinexta infocert gosign desktopGoSign Desktop through 2.4.1 disables TLS certificate validation when configured to use a proxy...3.2 Low
- zoom communications inc. workplace clients, zoom meeting software development kit, workplace desktop +1 more +3 moreZoom Workplace Clients - Improper Certificate Validation4.8 Medium
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: LDAP authentication flow vulnerable to TLS certificate verification bypass.7.5 High
- lenovo scanner proA vulnerability was reported in the Lenovo Scanner pro application during an internal security...6.0 Medium
- lenovo app store, browser, legion zone +1 more +3 moreA potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser...7.7 High
- siemens solid edge se2025A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 11)....8.7 High
- Show moreLoading…