Weakness (CWE)

CWE-295: Improper Certificate Validation

Base Draft

The product does not validate, or incorrectly validates, a certificate.

How to prevent it (2 mitigations)

Architecture and Design, Implementation

Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation

If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.

Source: MITRE CWE-295

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

High 7.8

CVE-2023-20963 Exploited Public exploit

In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional…

Android

Mar 24, 2023
KEV Apr 13, 2023
High 8.8

CVE-2022-26923 Exploited Public exploit EPSS 84%

Active Directory Domain Services Elevation of Privilege Vulnerability

Active Directory Domain Services Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

May 10, 2022
KEV Aug 18, 2022
High 8.1

CVE-2020-0601 Exploited Public exploit EPSS 89%

Certificate validation bypass on Windows in crypto/x509

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making …

Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows Alpine Go

Jan 14, 2020
KEV Nov 3, 2021