Weaknesses of type CWE-295

1,020 results

Validação inadequada de certificado SSL/TLS

A aplicação falha em validar corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou de hosts diferentes. Isso permite ataques man-in-the-middle onde um atacante intercepta a comunicação sem ser detectado, comprometendo a confidencialidade e integridade dos dados.

Example

Uma app mobile que desativa a verificação de certificado para 'facilitar testes' acaba em produção; um atacante na mesma rede Wi-Fi intercepta requisições HTTPS para roubar tokens de autenticação ou dados sensíveis sem que a app perceba.

How to mitigate

Sempre validar o certificado do servidor (hostname, cadeia de certificados, data de validade), nunca desabilitar verificações em produção, e usar apenas bibliotecas atualizadas que implementam corretamente as regras de validação de TLS.

CVE-2026-4740HIGHRhacm: open cluster management (ocm): cross-cluster privilege escalation via improper kubernetes client certificate renewal validationEPSS 0.2%CVE-2026-108013MEDIUMHCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID)EPSS 0.2%CVE-2026-66406LOWDEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obEPSS 0.2%CVE-2025-13833HIGHInsecure TLS Fingerprint Validation in ForeScout SecureConnector Configuration Enables Remote Code ExecutionEPSS 0.1%CVE-2026-33248MEDIUMNATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matchingEPSS 0.1%CVE-2025-70044MEDIUMAn issue pertaining to CWE-295: Improper Certificate Validation was discovered in fofolee uTools-quickcommand 5.0.3.EPSS 0.1%CVE-2024-4762HIGHAn improper validation vulnerability was reported in the firmware update mechanism of LADM and LDCC that could allow a local attacker to escEPSS 0.1%CVE-2026-15683HIGHLorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation VulnerabilityEPSS 0.1%CVE-2026-17309HIGHMultiple Vulnerabilities in IBM API ConnectEPSS 0.1%CVE-2026-4434HIGHImproper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-the-middle attack viEPSS 0.1%CVE-2026-44312MEDIUMcss_parser allows to MITM included https css urlsEPSS 0.1%CVE-2025-64432MEDIUMKubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation LayerEPSS 0.1%CVE-2026-17308MEDIUMMultiple Vulnerabilities in IBM API ConnectEPSS 0.1%CVE-2026-107318HIGH@fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transportsEPSS 0.1%CVE-2025-60022LOWImproper certificate validation vulnerability exists in 'デジラアプリ' App for iOS prior to ver.80.10.00. If this vulnerability is exploited, a maEPSS 0.1%CVE-2026-115930HIGHMongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAsEPSS 0.1%CVE-2026-116641HIGHThe DB Tools trust certificates issued by recoverable eMudhra intermediate CAsEPSS 0.1%CVE-2026-44305MEDIUMLemur: LDAP TLS certificate verification globally disabled enables credential interceptionEPSS 0.1%CVE-2025-58781MEDIUMWTW-EAGLE App does not properly validate server certificates, which may allow a man-in-the-middle attacker to monitor encrypted traffic.EPSS 0.1%CVE-2025-30000MEDIUMA vulnerability has been identified in Siemens License Server (SLS) (All versions < V4.3). The affected application does not properly restriEPSS 0.1%