CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedAn issue was discovered in openHiTLS 0.2.0 through 0.3.2. In the X.509 certificate chain...6.8 Medium
- red hat multicluster engine for kubernetes 2.10, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.17 +3 more +5 moreManagedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)9.9 Critical
- openvpnOpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be...2.0 Low
- rsyncproject rsyncrsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode7.6 High
- palo alto networks globalprotect app, paloaltonetworks globalprotect +1 moreGlobalProtect App: Improper Certificate Validation Bypass Vulnerability4.5 Medium
- apache httpclient, apache software foundation httpcomponents client +1 moreApache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)9.1 Critical
- sonicwall gmsAn insufficient certificate validation in a privileged communication workflow, was identified in...8.3 High
- adobe c2pa, c2pa-web, c2patool +3 more +5 moreCAI Content Credentials | Improper Certificate Validation (CWE-295)5.5 Medium
- gl.inet be9300, netgear be9300 firmware, mr60 +49 more +51 moreCommand injection vulnerability in certain NETGEAR Nighthawk and Orbi routers4.9 Medium
- ivanti endpoint managerCleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before...8.1 High
- red hat jboss enterprise application platform 7, jboss enterprise application platform 7.4 els on rhel 7, jboss enterprise application platform 7.4.25 +5 more +7 moreUndertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery7.4 High
- sap approuter, sap se business ai platform (approuter) +1 moreMultiple vulnerabilities in SAP Business AI Platform (Approuter)6.4 Medium
- ecovacs robotics android app "ecovacs pro", ios app "ecovacs pro" +1 moreAndroid and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may...2.3 Low
- ecovacs robotics deebot pro k1vac, deebot pro m1 +1 moreDEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled....2.3 Low
- ecovacs robotics deebot pro k1vac, deebot pro m1 +1 moreDEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications....6.0 Medium
- dell rvtoolsDell RVTools versions prior to 4.8.1, contains an improper certificate validation vulnerability...6.8 Medium
- lenovo xclarity orchestratorGlobal TLS Certificate Validation Bypass in Lenovo XClarity Orchestrator7.0 High
- pyca cryptographypython-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees6.9 Medium
- emlogEmlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php9.1 Critical
- tp-link omada ds1008x firmware, omada ds1016g firmware, omada ds1016ge firmware +109 more +111 moreImproper Certificate Validation in TP-Link Omada Cloud Communications7.7 High
- timlegge net::saml2, net\ +1 moreNet::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured7.5 High
- latvijas valsts radio un televīzijas centrs (lvrtc) eparakstītājs 3.0eParakstītājs 3.0 for Windows – remote code execution via unauthenticated auto-update7.3 High
- bouncycastle bouncy castle for java lts, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 more +4 moreStapled OCSP response accepted without binding to the checked certificate9.3 Critical
- bouncycastle bouncy castle for java lts, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 more +4 moreName Constraints bypass via trailing dot in rfc822Name and URI9.3 Critical
- freerdpFreeRDP before 3.29.0 TLS Certificate EKU Bypass9.3 Critical
- freerdpFreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass9.3 Critical
- freerdpFreeRDP before 3.29.0 Improper Certificate Hostname Validation9.3 Critical
- red hat ansible automation platform 2, ansible automation platform 2.6, ansible automation platform 2.6 for rhel 9 +1 more +3 moreAap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header8.2 High
- devolutions password managerImproper certificate validation in the Devolutions Server connection handling in Devolutions...7.4 High
- systerel s2opcImproper Certificate Validation in S2OPC5.6 Medium
- apache traffic serverApache Traffic Server: Certifier plugin trusts client SNI when generating certificates8.4 High
- apache traffic serverApache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification6.3 Medium
- ibm ts4500 cli toolTS4500 CLI tool addresses security vulnerability5.9 Medium
- ocaml mirage-crypto-ecAn issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA...6.2 Medium
- med-united epa4allepa4all Security Incident: Implement keystore based on Telematik TSL, implement hostname check and certificate check for lib-vau9.1 Critical
- med-united epa4allTLS Certificate Verification Disabled on CXF Transport Clients in epa4all8.1 High
- powerdns recursorRRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation7.5 High
- oracle webcenter contentVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web...8.0 High
- gitea open source git serverInternal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)7.5 High
- apache mina sshdApache MINA SSHD: SSH certificate options lack validations7.3 High
- libgit2libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Backend6.5 Medium
- garu dancer::plugin::auth::googleDancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled8.2 High
- kumahq kumakuma-dp connects to control plane without verifying TLS certificate when no CA is configured5.8 Medium
- kong inc. meshKong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured5.8 Medium
- kumahq kumaKuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured5.5 Medium
- kong inc. meshKong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured5.5 Medium
- asus routerAn Improper Validation of Integrity Check Value and Improper Certificate Validation in certain...9.5 Critical
dulwichDebian,python3-dulwichSUSE,python-dulwichAzure Linux +2 moreDulwich through 1.1.0 was found to be missing SSH host key verification in contrib...5.3 Medium- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 24h2 +10 more +12 moreWindows Cryptographic Services Security Feature Bypass Vulnerability4.2 Medium
- microsoft azure connected machine agentAzure Connected Machine Agent Elevation of Privilege Vulnerability8.8 High
- Show moreLoading…