Weaknesses of type CWE-295

853 results

Validação inadequada de certificado SSL/TLS

A aplicação falha em validar corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou de hosts diferentes. Isso permite ataques man-in-the-middle onde um atacante intercepta a comunicação sem ser detectado, comprometendo a confidencialidade e integridade dos dados.

Example

Uma app mobile que desativa a verificação de certificado para 'facilitar testes' acaba em produção; um atacante na mesma rede Wi-Fi intercepta requisições HTTPS para roubar tokens de autenticação ou dados sensíveis sem que a app perceba.

How to mitigate

Sempre validar o certificado do servidor (hostname, cadeia de certificados, data de validade), nunca desabilitar verificações em produção, e usar apenas bibliotecas atualizadas que implementam corretamente as regras de validação de TLS.

CVE-2026-7821HIGHImproper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to EPSS 0.5%CVE-2024-25140CRITICALA default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with EnhanEPSS 0.5%CVE-2022-45100HIGH Dell PowerScale OneFS, versions 8.2.x-9.3.x, contains an Improper Certificate Validation vulnerability. An remote unauthenticated attacker EPSS 0.5%CVE-2024-1351HIGHMongoDB Server may allow successful untrusted connectionEPSS 0.5%CVE-2026-30840HIGHWallos: Server-Side Request Forgery (SSRF) in Notification TestersEPSS 0.5%CVE-2026-47632HIGHAzure Connected Machine Agent Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2021-29495MEDIUMNim stdlib httpClient does not validate peer certificates by defaultEPSS 0.5%CVE-2020-29504HIGH Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain a Missing RequEPSS 0.5%CVE-2021-31892—A vulnerability has been identified in SINUMERIK Analyse MyCondition (All versions), SINUMERIK Analyze MyPerformance (All versions), SINUMEREPSS 0.5%CVE-2017-7513MEDIUMIt was found that Satellite 5 configured with SSL/TLS for the PostgreSQL backend failed to correctly validate X.509 server certificate host EPSS 0.5%CVE-2007-5967—A flaw in Mozilla's embedded certificate code might allow web sites to install root certificates on devices without user approval.EPSS 0.5%CVE-2021-42027—A vulnerability has been identified in SINUMERIK Edge (All versions < V3.2). The affected software does not properly validate the server cerEPSS 0.5%CVE-2025-6032HIGHPodman: podman missing tls verificationEPSS 0.5%CVE-2026-42011HIGHGnutls: gnutls: security bypass due to incorrect name constraint handlingEPSS 0.5%CVE-2022-45197HIGHSlixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of SlixmEPSS 0.5%CVE-2025-34235CRITICALVasion Print (formerly PrinterLogic) Weak SSL/TLS Certificate Validation RCEEPSS 0.5%CVE-2023-51837CRITICALYlianst MeshCentral 1.1.16 is vulnerable to Missing SSL Certificate Validation.EPSS 0.5%CVE-2024-29072HIGHA privilege escalation vulnerability exists in the Foxit Reader 2024.2.0.25138. The vulnerability occurs due to improper certification validEPSS 0.5%CVE-2024-54846MEDIUMAn issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the EC private key and access sensitive data or execute a man-in-tEPSS 0.5%CVE-2024-54847MEDIUMAn issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to access the Diffie-Hellman (DH) parameters and access sensitive data or exEPSS 0.5%