CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- eidetic-labs stigmemstigmem Federation Peer Registration Authentication Bypass9.1 Critical
- ex-aws ex aws snsex_aws_sns SigningCertURL not validated in verify_message/18.7 High
- erlang otp, erlang\/otp, red hat hardened images +3 more +5 morenameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification7.6 High
- erlang otp, erlang\/otp +1 moreOCSP responder certificate validity period not checked in public_key6.3 Medium
- erlang otp, erlang\/otp, red hat hardened images +3 more +5 moreNon-CA certificate accepted as intermediate issuer in public_key path validation7.0 High
- pavel-odintsov fastnetmonFastNetMon Community Edition through 1.2.9 does not verify TLS certificates on outbound HTTPS...7.4 High
- benoitc hackneyUnbounded body accumulation in HTTP/3 response loop in hackney8.2 High
- krajowa izba rozliczeniowa szafir sdkImproper Certificate Verification in Szafir SDK9.3 Critical
- lizardbyte sunshineSunshine: Authentication bypass via improper client certificate validation9.8 Critical
- ivanti secure access clientAn improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6...8.8 High
- dell powerflex manager, powerflex manager (appliance), powerflex manager (rack) +2 more +4 moreDell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Improper Certificate Validation...4.2 Medium
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/knownhosts, red hat assisted installer for red hat openshift container platform 2 +53 more +55 moreInvoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts9.1 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +62 more +64 moreInvoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh5.3 Medium
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +64 more +66 moreInvoking bypass of certificate restrictions in golang.org/x/crypto/ssh6.3 Medium
- open ises ticketsOpen ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in rm/incs/mobile_login.inc.php8.2 High
- open ises ticketsOpen ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in incs/login.inc.php8.2 High
- open ises ticketsOpen ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in incs/functions.inc.php8.2 High
- open ises ticketsOpen ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in ajax/reports.php8.2 High
tlsopamIn OCaml-TLS before 2.1.0, the server implementation does insufficient checks of the certificate...7.4 HightlsopamIn OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the certificate...9.1 Critical- dell live opticsDell Live Optics Windows and Personal Edition collectors contain an improper certificate...6.8 Medium
- com.oviva.telematik epa4all-clientepa4all-client: TLS Certificate Validation Disabled in Production8.1 High
github.com/arnika-project/arnikaGoarnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS6.3 Mediumgoshs.de/goshsGo,goshs.de/goshs/v2Go +1 moregoshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request7.4 High- fleetdm fleetFleet has a Windows MDM management endpoint authentication bypass8.2 High
- lettrelettre has TLS hostname verification disabled when using Boring TLS backend9.1 Critical
- cpanel, cpanel whm, wp squared +2 moreSSL verification is disabled in the DNS Cluster system. This could allow for a malicious server...8.2 High
- palo alto networks prisma access agentPrisma Access Agent: Improper Certificate Validation Vulnerability6.2 Medium
- palo alto networks prisma sd-wan ion, paloaltonetworks prisma sd-wan +1 morePrisma SD-WAN: Improper Certificate Validation Vulnerability5.2 Medium
- palo alto networks globalprotect app, paloaltonetworks globalprotect +1 moreGlobalProtect App: Certificate Validation Bypass Vulnerabilities4.9 Medium
- aria2 project aria2, aria2c +1 morearia2c Improper Certificate Validation4.8 Medium
- epg, inc. "kura sushi official app" for android, "kura sushi official app" for ios +1 more"Kura Sushi Official App" provided by EPG, Inc. is vulnerable to improper certificate validation....9.1 Critical
- com.oviva.telematik epa4all-clientepa4all-client: VAU Signature bypass8.1 High
- sigstore gitsigngitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits5.3 Medium
- anzory solidcam-gppl-ideSolidCAM-GPPL-IDE: Path traversal in `inc` directive enables file probing and NTLM-hash leak5.1 Medium
- open-telemetry opentelemetry-dotnet-contribOpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured6.5 Medium
- elixir-webrtc ex webrtcElixir WebRTC: Missing DTLS peer fingerprint validation in ex_webrtc client-role handshake8.7 High
- teluu pjsip, pjsip pjproject +1 moreGnuTLS backend silently skips certificate chain verification when verify_peer is false8.2 High
- ivanti endpoint manager mobileAn Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0...8.9 High
- ivanti endpoint manager mobileImproper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1...7.4 High
- premailer css parsercss_parser allows to MITM included https css urls5.8 Medium
org.opensearch.plugin:opensearch-securityMavenOpenSearch has ineffective TLS certificate hostname verification2.2 Low- misp misp-modulesUnsafe remote resource fetching in expansion misp-modules5.8 Medium
- suse harvesterHarvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS8.6 High
- netflix lemurLemur: LDAP TLS certificate verification globally disabled enables credential interception6.8 Medium
- eclipse vert.xVert.x has a DoS via unbounded server-side SNI SslContext cache growth6.9 Medium
- mikrotik routerosImproper certificate validation in multiple RouterOS services6.5 Medium
- apache thrift, red hat cryostat 4 on rhel 9, multicluster global hub +24 more +26 moreApache Thrift: TSSLTransportFactory.java hostname verification7.3 High
- pyload, pyload-ng project pyload-ng +1 morepyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification6.8 Medium
- linuxcontainers incusIncus OVN TLS verification accepts peer-supplied roots and permits endpoint impersonation2.3 Low
- Show moreLoading…