CWE-297: Improper Validation of Certificate with Host Mismatch
The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
A kind of CWE-923 Improper Restriction of Communication Channel to Intended Endpoints.
From the CWE List. © The MITRE Corporation.
Newest
- apache log4j, apache software foundation log4j core +1 moreApache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass6.3 Medium
- apache zookeeper, red hat amq broker 7.12.7, amq broker 7.13.5 +14 more +16 moreApache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager7.4 High
- apache rangerApache Ranger: Hostname verification bypass in NiFiRegistryClient5.3 Medium
- xiaomi technology co., ltd. galaxy fds android sdkXiaomi Galaxy FDS Android SDK <= 3.0.8 TLS Hostname Verification Disabled Enables MITM9.1 Critical
- apache uniffleApache Uniffle: Insecure SSL Configuration in Uniffle HTTP Client9.1 Critical
- curllibssh global known_hosts override5.3 Medium
- apache log4j, apache software foundation log4j core +1 moreApache Log4j Core: Missing TLS hostname verification in Socket appender6.3 Medium
- fortinet fortios, fortiproxy, fortipam +1 more +3 moreAn Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy...6.8 Medium
- avtech eagleeyes\(lite\)An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push...9.8 Critical
- akinsoft qr menu, akınsoft qr menü +1 moreHost Header Injection in Akinsoft's QR Menu7.3 High
- hotelrunner b2bHost Header Injection in HotelRunner's B2B4.6 Medium
- couchbase .net sdkCouchbase .NET SDK (client library) does not properly enable hostname verification for TLS certificates4.9 Medium
- fortinet forticlient, forticlientwindows +1 moreA improper validation of certificate with host mismatch in Fortinet FortiClientWindows version 7...4.4 Medium
- jruby, jruby jruby-openssl +1 moreJRuby-OpenSSL has hostname verification disabled by default5.7 Medium
- red hat build of keycloak, build of keycloak 26, build of keycloak 26.0 +2 more +4 moreOrg.keycloak.protocol.services: keycloak hostname verification8.2 High
- jetbrains toolbox, toolbox app +1 moreIn JetBrains Toolbox App before 2.6 host key verification was missing in SSH plugin4.2 Medium
- tecno com.transsnet.storeThe mobile application (com.transsnet.store) has a man-in-the-middle attack vulnerability, which...8.1 High
- ibm openpages with watsonIBM OpenPages improper certificate validation6.8 Medium
- ibm storage defender, storage defender - resiliency service +1 moreIBM Storage Defender improper certificate validation5.9 Medium
- progress openedgeClient connections using default TLS certificates from OpenEdge may bypass TLS host name validation7.2 High
- redhat kroxylicious, red hat streams for apache kafka, streams for apache kafka 2.8.0 +2 moreKroxylicious: missing upstream kafka tls hostname verification5.9 Medium
- adacore ada web servicesAn issue was discovered in Ada Web Server 20.0. When configured to use SSL (which is not the...7.4 High
- casbin casdoorcasdoor's use of`ssh.InsecureIgnoreHostKey()` disables host key verification7.5 High
- hitachi energy ecst, fox61x, foxcst +3 more +5 moreAllow attackers to intercept or falsify data exchanges between the client and the server6.8 Medium
bouncycastleDebian,io.root.org.bouncycastle:bcprov-jdk18onRoot,org.bouncycastle:bcpg-jdk14TuxCare +25 more +27 moreBouncy Castle Java Cryptography API vulnerable to DNS poisoning7.5 High- zitadelZITADEL's Improper Lockout Mechanism Leads to MFA Bypass6.5 Medium
- curl, curl libcurl, apple macos +10 more +12 moreTLS certificate check bypass with mbedTLS6.5 Medium
- kepware kepserverex, ge industrial gateway server, ptc keepserverex +6 more +8 moreImproper Validation of Certificate with Host Mismatch in PTC KEPServerEx7.5 High
- fortinet fortianalyzer, fortimanager, fortios +1 more +3 moreAn improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6...5.4 Medium
- hitachi device managerImproper Validation of Certificate Vulnerability in Hitachi Device Manager5.6 Medium
- dell networkerDell NetWorker, contains an Improper Validation of Certificate with Host Mismatch vulnerability...5.0 Medium
- palantir sls-loggingIt was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a...6.3 Medium
- palantir magritte-ftp, foundry magritte +1 moreIt was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a...6.3 Medium
- palantir gotham chat irc, gotham chat irc helper +1 moreGotham Chat IRC help does not validate hostnames in TLS certificates5.7 Medium
- palantir atlasdbIt was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a...6.3 Medium
- jenkins view26 test-reporting, jenkins project view26 test-reporting plugin +1 moreMissing hostname validation in Jenkins View26 Test-Reporting Plugin8.1 High
- jenkins smalltest, jenkins project smalltest plugin +1 moreJenkins SmallTest Plugin missing hostname validation8.1 High
- splunk, splunk cloud platform, enterprise +2 more +4 moreSplunk Enterprise lacked TLS host name validation8.1 High
- dell emc networker, networker +1 moreDell EMC NetWorker versions 19.1.x, 19.1.0.x, 19.1.1.x, 19.2.x, 19.2.0.x, 19.2.1.x 19.3.x, 19.3.0...3.7 Low
- apache sling commons messaging mailSMTPS server hostname not checked when making TLS connection to SMTPS server7.4 High
- sap cloud connectorPotentially, SAP Cloud Connector, version - 2.0 communication with the backend is accepted...6.8 Medium
- samba rsyncA flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate...7.4 High
- mifos mifos-mobileDisabled hostname verification and accepting self-signed certificates8.8 High
- teluu pjsip, pjsip pjproject +1 moreExisting TLS connections can be reused without checking remote hostname6.8 Medium
- apereo opencastDisabled Hostname Verification in OpenCast4.8 Medium
- gfi software helpdeskThe vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this...4.2 Medium
- keycloak, redhat openstack +1 moreImproper Certificate Validation and Improper Validation of Certificate with Host Mismatch in Keycloak5.3 Medium
- java-websocket project java-websocketImproper Validation of Certificate with Host Mismatch in Java-WebSocket9.0 Critical
- facebook osqueryIncorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to MITM osquery traffic in the absence of a configured root chain of trust.9.1 Critical
- gnupg, sks keyserver project keyserver, f5 traffix signaling delivery controller +2 more +4 moreInteraction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG...7.5 High
- Show moreLoading…