Weakness (CWE)
CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
How to prevent it (2 mitigations)
-
Architecture and Design, Implementation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
-
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
Source: MITRE CWE-295
71 results · Clear filters · Feed
-
Low 2.5
wlc can skip SSL verification
wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.
-
Low 3.4
KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API (aka ph…
-
Low 3.2
GoSign Desktop through 2.4.1 disables TLS certificate validation when configured to use a proxy server. This can be pro…
-
Low 3.1
An improper certificate validation vulnerability was reported in the Lenovo Universal Device Client (UDC) that could al…
-
Low 3.7
Tomofun Furbo 360/Furbo Mini HTTP Traffic collect_logs.sh upload_file_to_s3 certificate validation
A vulnerability was identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is the function upload_file_to_s3 of the file collect_logs.sh of the component HTTP Traffic Handler. The manipulation leads to improper certificate validation. The atta…
-
Low 2.7
Dragonfly Manager makes requests to external endpoints with disabled TLS authentication
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The Manager disables TLS certificate verification in HTTP clients. The clients are not configurable, so users have no way to re-enable the verification. A M…
-
Low 3.9
A lack of SSL certificate validation in BlueStacks v5.20 allows attackers to execute a man-it-the-middle attack and obt…
-
Low 3.7
Comodo Internet Security Premium Update certificate validation
A vulnerability classified as critical has been found in Comodo Internet Security Premium 12.3.4.8162. This affects an unknown part of the component Update Handler. The manipulation leads to improper certificate validation. It is possible to initiate the atta…
-
Low 3.1
Dell ECS version 3.8.1.4 and prior contain an Improper Certificate Validation vulnerability. An unauthenticated attacke…
-
Low 2.1
HCL BigFix Web Reports is susceptible to a Man-In-The-Middle (MITM) attack
HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in its handling of SSL certificate validation. This scenario presents a possibility of man-in-the-middle (MITM) attacks and data exposure as, if exploited, this vulnerability coul…
-
Low 2.8
HCL BigFix Patch Download Plug-ins are affected by an insecure protocol support
BigFix Patch Download Plug-ins are affected by an insecure protocol support. The application can allow improper handling of SSL certificates validation.
-
Low 2.7
An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated, privileged a…
-
Low 3.8
lxd has a restricted TLS certificate privilege escalation when in PKI mode
Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured.
-
Low 3.8
lxd CA certificate sign check bypass
Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.
-
Low 1.0
QuMagie
An improper certificate validation vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow local network users to compromise the security of the system via unspecified vectors. We have already fixed the vulnerability in …
-
Low 3.8
Ecosystem Agent Insufficient Transport Layer Security
Ecosystem Agent version 4 < 4.1.5.2597 and Ecosystem Agent version 5 < 5.1.4.2473 did not properly validate SSL/TLS certificates, which could allow a malicious actor to perform a Man-in-the-Middle and intercept traffic between the agent and N-able servers fro…
-
Low 2.8
An improper validation vulnerability was reported in the Lenovo Tab K10 that could allow a specially crafted applicatio…
-
Low 3.7
EZVIZ CS-C6-21WFR-8 Davinci Application certificate validation
A vulnerability was found in EZVIZ CS-C6-21WFR-8 5.2.7 Build 170628. It has been classified as problematic. This affects an unknown part of the component Davinci Application. The manipulation leads to improper certificate validation. It is possible to initiat…
-
Low 3.7
Hualai Xiaofang iSC5 certificate validation
A vulnerability was found in Hualai Xiaofang iSC5 3.2.2_112 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improper certificate validation. The attack may be launched remotely. The complexity of …
-
Low 2.7
Apache Airflow FTP Provider: FTP_TLS instance with unverified SSL context
Improper Certificate Validation vulnerability in Apache Airflow FTP Provider. The FTP hook lacks complete certificate validation in FTP_TLS connections, which can potentially be leveraged. Implementing proper certificate validation by passing context=ssl.crea…
-
Low 3.7
IBM Security Verify Privilege information disclosure
IBM Security Verify Privilege On-Premises 11.5 does not validate, or incorrectly validates, a certificate which could disclose sensitive information which could aid further attacks against the system. IBM X-Force ID: 240455.
-
Low 2.7
Dell VxRail, versions prior to 7.0.450, contain an improper certificate validation vulnerability. A high privileged rem…
-
Low 3.7
Jenkins SAML Single Sign On(SSO) Plugin unconditionally disables SSL/TLS certificate validation
Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercep…
-
Low 3.9
nextcloudcmd incorrectly trusts bad TLS certificates
Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates, which may enable a Man-in-the-middle attack …
-
Low 3.7
Dell OS10, version 10.5.3.4, contains an Improper Certificate Validation vulnerability in Support Assist. A remote unau…
-
Low 3.3
Improper Certificate Validation in Cosign
Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This re…
-
Low 3.7CVE-2020-9488 Public exploit
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.…
-
Low 3.7
Insecure handling of repodata and packages in SUSE Studio onlite
A Improper Certificate Validation vulnerability in susestudio-common of SUSE Studio onsite allows remote attackers to MITM connections to the repositories, which allows the modification of packages received over these connections. This issue affects: SUSE Stu…
-
Low —
SSL Validation Defaults to False in electron-packager
electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages. along with Electron. The `--strict-ssl` command line option in electron-packager >= 5.2.1 <= 6.0.0 || >=6.0.0 <= 6.0.2 defaults to false if not explic…
-
Low 3.7
Urllib3 Incorrect Certificate Validation
Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middl…
-
Low 3.7
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pr…