Weaknesses of type CWE-295

857 results

Validação inadequada de certificado SSL/TLS

A aplicação falha em validar corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou de hosts diferentes. Isso permite ataques man-in-the-middle onde um atacante intercepta a comunicação sem ser detectado, comprometendo a confidencialidade e integridade dos dados.

Example

Uma app mobile que desativa a verificação de certificado para 'facilitar testes' acaba em produção; um atacante na mesma rede Wi-Fi intercepta requisições HTTPS para roubar tokens de autenticação ou dados sensíveis sem que a app perceba.

How to mitigate

Sempre validar o certificado do servidor (hostname, cadeia de certificados, data de validade), nunca desabilitar verificações em produção, e usar apenas bibliotecas atualizadas que implementam corretamente as regras de validação de TLS.

CVE-2026-71290CRITICALApache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)EPSS 0.2%CVE-2025-11619HIGHImproper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to EPSS 0.2%CVE-2025-13034MEDIUMNo QUIC certificate pinning with GnuTLSEPSS 0.2%CVE-2024-31955MEDIUMAn issue was discovered in Samsung eMMC with KLMAG2GE4A and KLM8G1WEMB firmware. Code bypass through Electromagnetic Fault Injection allows EPSS 0.2%CVE-2024-6472HIGHAbility to trust not validated macro signatures removed in high security modeEPSS 0.2%CVE-2026-6860MEDIUMA TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard nameEPSS 0.2%CVE-2023-33861MEDIUMIBM Security ReaQta improper certificate validationEPSS 0.2%CVE-2024-7206HIGHFirmware extraction and Hardware SSL Pinning BypassEPSS 0.2%CVE-2023-6055HIGHImproper Certificate Validation in Bitdefender Total Security HTTPS Scanning (VA-11158)EPSS 0.2%CVE-2025-7395CRITICALDomain Name Validation Bypass with Apple Native Certificate ValidationEPSS 0.2%CVE-2026-61668HIGHDIRAC: Pilot code downloaded over unverified HTTPS connectionEPSS 0.2%CVE-2026-11310HIGHX.509 trust-chain bypass in wolfSSL_X509_verify_cert() via untrusted intermediate anchoringEPSS 0.2%CVE-2025-30277HIGHQsync CentralEPSS 0.2%CVE-2026-15078HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.2%CVE-2025-30278HIGHQsync CentralEPSS 0.2%CVE-2026-55960HIGHUn-negotiated Raw Public Key (RFC 7250) accepted in place of X.509, bypassing chain validationEPSS 0.2%CVE-2026-11999HIGHX.509 trust-chain bypass via path-depth exhaustion in wolfSSL_X509_verify_cert()EPSS 0.2%CVE-2025-9293HIGHInsufficient Certificate Validation in Multiple Mobile Applications Allows Man in the Middle InterceptionEPSS 0.2%CVE-2024-33612MEDIUMBIG-IP Next Central Manager vulnerabilityEPSS 0.2%CVE-2024-11621HIGHMissing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modifEPSS 0.2%