CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft .net 11.0 runtime, visual studio 2022 version 17.14, visual studio 2026 version 18.10 +2 more.NET Framework Security Feature Bypass Vulnerability6.5 Medium
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data Improper Certificate Validation7.4 High
- netease cloud music for windowsNetEase Cloud Music TLS Certificate Validation Bypass9.1 Critical
- freerdpFreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp_http_request7.4 High
- hexpm hexHex trusts its bundled CA certificates when cacerts_path is set5.9 Medium
- sbabic swupdateSWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded Intermediates9.2 Critical
- hexpm hex corehex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 255.9 Medium
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 moreDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an...7.5 High
- microsoft partner centerMicrosoft Partner Center Elevation of Privilege Vulnerability10.0 Critical
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities5.6 Medium
- @fastify/reply-from@fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports7.4 High
- progressive robot ltd hmailserverImproper Certificate Validation in hMailServer5.9 Medium
- broadcom brocade active support connectivity gateway, brocade active support connectivity gateway +1 moreAn unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions...7.6 High
gnutlsAlpaquita,gnutls26Ubuntu,gnutls28Debian +1 more +3 moreImproper certificate validation in gnutls v3.8.13 causes the application to accept certificates...4.8 MediumgnutlsAzure Linux,gnutls26Ubuntu,gnutls28Debian +2 moreIncomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate...3.7 Low- dell system updateDell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation...7.6 High
- dell container storage modules (csm), container storage modules +1 moreDell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certificate...8.2 High
- microsoft msquicMsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL9.1 Critical
- maclof kubernetes-clientmaclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification9.1 Critical
- alexpechkarev google-mapsalexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer9.1 Critical
- defunkt gistGist RubyGem before 6.1.0 Disabled TLS Certificate Verification9.1 Critical
- go-pay gopaygopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client9.1 Critical
- cockpit-hq cockpitCockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php2.3 Low
- micro go-microgo-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper9.1 Critical
- legion of the bouncy castle inc. bc-javaMLS X.509 credential not bound to the LeafNode signature key9.2 Critical
- legion of the bouncy castle inc. bc-fja, bc-java, bc-lts-java +2 morePKIXCertPathReviewer does not apply X.509 name constraints to the target certificate8.7 High
- apache software foundation thriftApache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not match6.9 Medium
- apache software foundation thriftApache Thrift: Python ≥3.12 host-name check silently becomes a no-op6.9 Medium
- apache software foundation thriftApache Thrift: Perl TLS client disables certificate verification by default6.9 Medium
- havelsan inc. sef - ai chatbot platformInsecure TLS Certificate Validation in API Tool Runner in HAVELSAN's Sef - AI Chatbot Platform7.4 High
- bouncycastle bc-csharpName constraints bypass via trailing dot in rfc822Name, dNSName and URI hosts8.2 High
- bouncycastle bc-csharpName Constraints bypass: directoryName constraint matched at any position in the DN instead of as a prefix8.2 High
- bouncycastle bc-csharpURI name constraints checked against a mis-parsed host8.2 High
- owasp-modsecurity modsecurityModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download3.7 Low
- docker engine, moby +1 moreDocker Engine insecure-registry fallback via malicious DNS responses7.6 High
- joyland joyland.aiJoyland AI WebView accepts invalid SSL certificates6.9 Medium
- joyland joyland.aiJoyland AI accepts TLS certificates without validation6.9 Medium
- confluent confluent-kafkaConfluent Kafka Python Improper TLS Certificate Validation7.4 High
- @graphql-tools executor-legacy-ws, ardatan graphql-tools +1 moreGraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor7.4 High
- cato networks sdp clientCato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validation6.8 Medium
- apache software foundation plc4xApache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade9.2 Critical
- pgpool global development group pgpool-iiAn improper certificate validation vulnerability exists in Pgpool-II, which may allow an...6.9 Medium
- watchguard fireware, fireware os +1 moreFireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution9.2 Critical
- python urllib3urllib3: HTTPS proxy TLS configuration may be ignored or overridden7.6 High
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 moreDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to...6.4 Medium
- grpc grpc-node@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized7.4 High
- wolfsslOCSP stapling v2 multi accepts non-CA chain certificates as issuers8.3 High
- wolfsslNameConstraints not enforced across unconstrained intermediate CA6.3 Medium
- wolfsslSubject CN name-constraint check bypassed when non-DNS SAN present6.3 Medium
- wolfsslFailed X509_verify_cert leaves unverified CA in shared CertManager6.3 Medium
- Show moreLoading…