CWE-295: Improper Certificate Validation, page 26
Filter
The product does not validate, or incorrectly validates, a certificate.
What the weakness is: CWE-295 at MITRE
Ask an AI about CWE-295
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-295: Improper Certificate Validation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/295.html and https://cve.bz/cve/cwe/295?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 6.5CVE-2011-2669EPSS 0.6%
Mozilla Firefox prior to 3.6 has a DoS vulnerability due to an issue in the validation of certificates.
- 5.9CVE-2020-3940EPSS 0.8%
VMware Workspace ONE SDK and dependent mobile application updates address sensitive information disclosure vulnerability.
- 7.5CVE-2020-1929EPSS 1.0%
The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust verification. However this configuration is not respected and the certificate verification disables trust verification in every case. This ex…
- 5.9CVE-2012-1316EPSS 0.6%
Cisco IronPort Web Security Appliance does not check for certificate revocation which could lead to MITM attacks
- 8.1CVE-2020-0601KEVExploitEPSS 89%
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious…
- 5.9CVE-2014-0161EPSS 0.4%
ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-…
- 5.9CVE-2014-0104EPSS 0.8%
In fence-agents before 4.0.17 does not verify remote SSL certificates in the fence_cisco_ucs.py script which can potentially allow for man-in-the-middle attackers to spoof SSL servers via arbitrary SSL certificates.
- 7.5CVE-2013-0264EPSS 0.5%
An import error was introduced in Cumin in the code refactoring in r5310. Server certificate validation is always disabled when connecting to Aviary servers, even if the installed packages on a system support it.
- 7.4CVE-2019-6032EPSS 0.5%
The NTV News24 prior to Ver.3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- 7.4CVE-2019-6687EPSS 0.5%
On versions 15.0.0-15.0.1.1, the BIG-IP ASM Cloud Security Services profile uses a built-in verification mechanism that fails to properly authenticate the X.509 certificate of remote endpoints.
- 7.1CVE-2019-16561EPSS 0.5%
Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins master JVM.
- 8.2CVE-2019-16558EPSS 0.6%
Jenkins Spira Importer Plugin 3.2.3 and earlier disables SSL/TLS certificate validation for the Jenkins master JVM.
- 5.4CVE-2018-11751EPSS 0.6%
Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0.
- 9.8CVE-2019-18826EPSS 0.7%
Barco ClickShare Button R9861500D01 devices before 1.9.0 have Improper Following of a Certificate's Chain of Trust. The embedded 'dongle_bridge' program used to expose the functionalities of the ClickShare Button to a USB host, does not pr…
- 7.5CVE-2014-3495EPSS 0.9%
duplicity 0.6.24 has improper verification of SSL certificates
- 5.9CVE-2019-11554EPSS 0.5%
The Audible application through 2.34.0 for Android has Missing SSL Certificate Validation for Adobe SDKs, allowing MITM attackers to cause a denial of service.
- 9.8CVE-2019-14910EPSS 1.1%
A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case user authentication succeeds even if invalid password has e…
- 5.3CVE-2011-2207EPSS 1.2%
dirmngr before 2.1.0 improperly handles certain system calls, which allows remote attackers to cause a denial of service (DOS) via a specially-crafted certificate.
- 7.5CVE-2019-19271EPSS 1.3%
An issue was discovered in tls_verify_crl in ProFTPD before 1.3.6. A wrong iteration variable, used when checking a client certificate against CRL entries (installed by a system administrator), can cause some CRL entries to be ignored, and…
- 7.5CVE-2019-19270EPSS 1.1%
An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. Failure to check for the appropriate field of a CRL entry (checking twice for subject, rather than once for subject and once for issuer) prevents some valid CRLs from bei…
- 7.5CVE-2012-5518EPSS 0.7%
vdsm: certificate generation upon node creation allowing vdsm to start and serve requests from anyone who has a matching key (and certificate)
- 7.5CVE-2014-2902EPSS 0.8%
wolfssl before 3.2.0 does not properly authorize CA certificate for signing other certificates.
- 7.5CVE-2014-2901EPSS 0.7%
wolfssl before 3.2.0 does not properly issue certificates for a server's hostname.
- 7.5CVE-2012-6071EPSS 1.3%
nuSOAP before 0.7.3-5 does not properly check the hostname of a cert.
- 5.9CVE-2019-5102EPSS 0.8%
An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, the server's SSL certificate is checked but no action is taken when the certifica…
- 5.9CVE-2019-5101EPSS 0.8%
An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, the server's SSL certificate is checked but no action is taken when the certifica…
- 9.8CVE-2010-4533EPSS 1.0%
offlineimap before 6.3.4 added support for SSL server certificate validation but it is still possible to use SSL v2 protocol, which is a flawed protocol with multiple security deficiencies.
- 5.9CVE-2010-4532EPSS 0.6%
offlineimap before 6.3.2 does not check for SSL server certificate validation when "ssl = yes" option is specified which can allow man-in-the-middle attacks.
- 5.9CVE-2014-8167EPSS 0.7%
vdsm and vdsclient does not validate certficate hostname from another vdsm which could facilitate a man-in-the-middle attack
- 7.5CVE-2014-7143EPSS 2.6%
Python Twisted 14.0 trustRoot is not respected in HTTP client
- 3.1CVE-2009-3552EPSS 0.4%
In RHEV-M VDC 2.2.0, it was found that the SSL certificate was not verified when using the client-side Red Hat Enterprise Virtualization Manager interface (a Windows Presentation Foundation (WPF) XAML browser application) to connect to the…
- 7.4CVE-2019-16209EPSS 0.7%
A vulnerability, in The ReportsTrustManager class of Brocade SANnav versions before v2.0, could allow an attacker to perform a man-in-the-middle attack against Secure Sockets Layer(SSL)connections.
- 7.7CVE-2019-3685EPSS 0.7%
Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client binary
- 5.9CVE-2013-2255EPSS 1.0%
HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates.
- 9.8CVE-2019-18633EPSS 0.8%
European Commission eIDAS-Node Integration Package before 2.3.1 has Missing Certificate Validation because a certain ExplicitKeyTrustEvaluator return value is not checked. NOTE: only 2.1 is confirmed to be affected.
- 9.8CVE-2019-18632EPSS 0.8%
European Commission eIDAS-Node Integration Package before 2.3.1 allows Certificate Faking because an attacker can sign a manipulated SAML response with a forged certificate.
- 9.8CVE-2018-21029EPSS 3.1%
systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication (SNI) is not sent, and there is no hostname validation with the GnuTLS backend. NOTE: This has been disputed…
- 5.9CVE-2010-4237EPSS 0.8%
Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate signed by a Certificate Authority to perform a man-in-the-middle attack.
- 5.9CVE-2019-5538EPSS 0.7%
Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vCenter Server Appliance (6.7 before 6.7u3a and 6.5 before 6.5u3d) may allow a mal…
- 5.9CVE-2019-5537EPSS 0.7%
Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vCenter Server Appliance (6.7 before 6.7u3a and 6.5 before 6.5u3d) may allow a mal…
- 5.9CVE-2019-11674EPSS 0.4%
Man-in-the-middle vulnerability in Micro Focus Self Service Password Reset, affecting all versions prior to 4.4.0.4. The vulnerability could exploit invalid certificate validation and may result in a man-in-the-middle attack.
- 8.2CVE-2019-10446EPSS 1.0%
Jenkins Cadence vManager Plugin 2.7.0 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM.
- 6.5CVE-2019-10444EPSS 0.8%
Jenkins Bumblebee HP ALM Plugin 4.1.3 and earlier unconditionally disabled SSL/TLS and hostname verification for connections to HP ALM.
- 7.4CVE-2019-14823EPSS 0.9%
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not p…
- 7.4CVE-2019-0054EPSS 0.6%
An Improper Certificate Validation weakness in the SRX Series Application Identification (app-id) signature update client of Juniper Networks Junos OS allows an attacker to perform Man-in-the-Middle (MitM) attacks which may compromise the …
- 5.9CVE-2019-5506EPSS 0.8%
Clustered Data ONTAP versions 9.0 and higher do not enforce hostname verification under certain circumstances making them susceptible to impersonation via man-in-the-middle attacks.
- 7.4CVE-2019-16263EPSS 1.0%
The Twitter Kit framework through 3.4.2 for iOS does not properly validate the api.twitter.com SSL certificate. Although the certificate chain must contain one of a set of pinned certificates, there are certain implementation errors such a…
- 7.5CVE-2019-15042EPSS 0.7%
An issue was discovered in JetBrains TeamCity 2018.2.4. It had no SSL certificate validation for some external https connections. This was fixed in TeamCity 2019.1.
- 5.9CVE-2019-1231EPSS 2.3%
An information disclosure vulnerability exists in the way Rome SDK handles server SSL/TLS certificate validation, aka 'Rome SDK Information Disclosure Vulnerability'.
- 7.5CVE-2019-11497EPSS 0.7%
In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entered as part of the reference creation, XDCR did not parse and check the certificate signature. It then accepted the invalid certificate and attempted to use it t…