Weaknesses of type CWE-295

857 results

Validação inadequada de certificado SSL/TLS

A aplicação falha em validar corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou de hosts diferentes. Isso permite ataques man-in-the-middle onde um atacante intercepta a comunicação sem ser detectado, comprometendo a confidencialidade e integridade dos dados.

Example

Uma app mobile que desativa a verificação de certificado para 'facilitar testes' acaba em produção; um atacante na mesma rede Wi-Fi intercepta requisições HTTPS para roubar tokens de autenticação ou dados sensíveis sem que a app perceba.

How to mitigate

Sempre validar o certificado do servidor (hostname, cadeia de certificados, data de validade), nunca desabilitar verificações em produção, e usar apenas bibliotecas atualizadas que implementam corretamente as regras de validação de TLS.

CVE-2025-22486HIGHFile Station 5EPSS 0.3%CVE-2025-40801CRITICALA vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), JT Bi-Directional TranslaEPSS 0.3%CVE-2025-30279HIGHFile Station 5EPSS 0.3%CVE-2025-29883HIGHFile Station 5EPSS 0.3%CVE-2022-42131MEDIUMCertain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers. This EPSS 0.3%CVE-2024-40702HIGHIBM Cognos Controller improper certificate validationEPSS 0.3%CVE-2025-54607HIGHAuthentication management vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerability may affect service confiEPSS 0.3%CVE-2025-11633MEDIUMTomofun Furbo 360/Furbo Mini HTTP Traffic collect_logs.sh upload_file_to_s3 certificate validationEPSS 0.3%CVE-2026-22093CRITICALAdversary-in-the-Middle (AitM) attack vulnerability in EVbee Service appEPSS 0.3%CVE-2026-35560CRITICALImproper certificate validation in identity provider connection components in Amazon Athena ODBC driverEPSS 0.3%CVE-2017-7932—An improper certificate validation issue was discovered in NXP i.MX 28 i.MX 50, i.MX 53, i.MX 7Solo i.MX 7Dual Vybrid VF3xx, Vybrid VF5xx, VEPSS 0.3%CVE-2026-55436HIGHCoder's AI Bridge Proxy skips TLS certificate verification in default configurationEPSS 0.3%CVE-2022-43892LOWIBM Security Verify Privilege information disclosureEPSS 0.3%CVE-2026-48934MEDIUMA flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supporteEPSS 0.3%CVE-2025-10699MEDIUMA vulnerability was reported in the Lenovo LeCloud client application that, under certain conditions, could allow information disclosure.EPSS 0.3%CVE-2023-50314MEDIUMIBM WebSphere Application Server Libery information disclosureEPSS 0.3%CVE-2022-48186MEDIUMA certificate validation vulnerability exists in the Baiying Android application which could lead to information disclosure.EPSS 0.3%CVE-2025-7390CRITICALBypass the client certificate trust check of an opc.https server while only secure communication is allowedEPSS 0.3%CVE-2026-44700HIGHElixir WebRTC: Missing DTLS peer fingerprint validation in ex_webrtc client-role handshakeEPSS 0.3%CVE-2026-53475CRITICALAssisted-migration-agent: tls verification disabled on all vcenter connectionsEPSS 0.3%