CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2016 +8 more +10 moreActive Directory Domain Services Elevation of Privilege Vulnerability7.8 High
- fortinet forticlientemsA improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5,...6.7 Medium
app-store-server-libraryPyPIApple App Store Server Python Library: SignedDataVerifier accepts stale OCSP GOOD responses and can bypass certificate revocation checks6.9 Medium- lorex 2k indoor wi-fi security cameraLorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation Vulnerability7.5 High
- diracgrid diracDIRAC: Pilot code downloaded over unverified HTTPS connection8.1 High
- evbee serviceAdversary-in-the-Middle (AitM) attack vulnerability in EVbee Service app9.5 Critical
- yhirose cpp-httplibcpp-httplib: TLS certificate chain verification bypassed for IP-literal hosts on Mbed TLS and wolfSSL backends7.4 High
- palo alto networks prisma access agentPrisma Access Agent: Improper Certificate Validation on iOS5.7 Medium
- etcdetcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation6.5 Medium
- coderCoder's AI Bridge Proxy skips TLS certificate verification in default configuration7.4 High
- b&r industrial automation gmbh aprolImproper Certificate Validation9.1 Critical
- simplesamlphp saml2SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass8.7 High
- projectcontour contourContour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled6.5 Medium
- benoitc erlang quicQUIC has Broken TLS verification9.1 Critical
- stormshield network securityConnection possible to the Administration portal with a revoked certificate4.3 Medium
- cato networks sdp clientImproper XPC caller certificate validation and TOCTOU race condition in macOS PrivilegedHelperTool6.4 Medium
- wolfssliPAddress name constraints not enforced when WOLFSSL_IP_ALT_NAME is undefined5.7 Medium
- wolfsslOCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status6.3 Medium
- wolfsslCRL critical extension bypass in ParseCRL_Extensions1.0 Low
- wolfsslX.509 name constraint bypass via Subject CN treated as a DNS name6.0 Medium
- wolfsslWildcard DNS SAN bypasses CA name-constraint checks6.3 Medium
- wolfsslX.509 trust-chain bypass in wolfSSL_X509_verify_cert() via untrusted intermediate anchoring8.7 High
- wolfsslUn-negotiated Raw Public Key (RFC 7250) accepted in place of X.509, bypassing chain validation8.2 High
- wolfsslChain intermediate CA:TRUE without keyCertSign accepted as a signing CA (temporary CA exemption)6.3 Medium
- wolfsslX.509 trust-chain bypass via path-depth exhaustion in wolfSSL_X509_verify_cert()8.2 High
- wolfsslPartial-chain verification accepts untrusted intermediate as trust anchor6.0 Medium
- dell display and peripheral managerDell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper...7.3 High
- jenkins bitbucket push and pull request, jenkins project bitbucket push and pull request plugin +1 moreJenkins Bitbucket Push and Pull Request Plugin unconditionally disables SSL/TLS certificate validation4.8 Medium
- curlwrong STARTTLS connection reuse8.1 High
- curlproto-default skips SSH verification7.5 High
- curlNative CA trust persist9.1 Critical
- daytonaio daytonaDaytona: Git credential leak via git clone with TLS verification disabled5.9 Medium
- ibm db2, db2 on cloud pak for data and db2 warehouse on cloud pak for data, db2 warehouse +2 moreMultiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.6.0 Medium
- redhat openshift container platform, windows machine config operator, red hat openshift container platform 4 +4 more +6 moreWindows-machine-config-operator: windows-machine-config-operator: ssh host key not verified enables credential theft8.3 High
- dell powerflex managerDell PowerFlex Manager, versions prior to 4.5.1.1, contain an improper certificate validation...6.5 Medium
- canon eos network setting tool, canon inc. eos network setting tool for macos, eos network setting tool for windows +2 moreImproper validation of server certificates in Canon EOS Network Setting Tool Version 1.5.0 or...7.1 High
- canon eos network setting tool, canon inc. eos network setting tool for macos, eos network setting tool for windows +2 moreImproper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier7.1 High
- nodemailerNodemailer before 8.0.8 TLS Certificate Validation Bypass8.3 High
- cyberark software, a palo alto networks company vendor pam, paloaltonetworks idira privilege cloud connector +1 moreIdira Vendor PAM - Self-Hosted Connector: Potential Security Bypass due to Incomplete TLS Certificate Validation7.5 High
- cyberark software, a palo alto networks company idira endpoint privilege managerIdira Endpoint Privilege Manager Agent: Security Control and Cryptographic Validation Bypass in Internal Agent Validation Processes8.5 High
- spring boot, vmware spring boot +1 moreMail Auto-Configuration Does Not Enable SSL Hostname Verification5.0 Medium
- kubev2v assisted migration agentAssisted-migration-agent: tls verification disabled on all vcenter connections9.3 Critical
- systerel s2opcImproper Certificate Validation in S2OPC7.3 High
- spring amqp, vmware spring advanced message queuing protocol +1 moreIn Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager4.0 Medium
- opensslTrust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate5.3 Medium
- checkpoint quantum security gateway, spark firewalls +1 moreCertificate Validation Bypass in VPN Site-to-Site Connections Using IKEv17.4 High
- termixTermix has improper certificate validation in Electron desktop client that enables MITM credential/token theft8.0 High
- cloud foundry boshA network man-in-the-middle between nats-sync and the BOSH director can steal the director...7.1 High
- red hat openshift container platform 4, openstack platform 16.2, openstack platform 17.1 +1 more +3 moreOpenStack oslo.messaging does not verify RabbitMQ broker hostname during TLS handshake7.4 High
- apache airflowApache Airflow: No certificate validation on SMTP STARTTLS connections5.9 Medium
- Show moreLoading…