Weaknesses of type CWE-295

1,020 results

Validação inadequada de certificado SSL/TLS

A aplicação falha em validar corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou de hosts diferentes. Isso permite ataques man-in-the-middle onde um atacante intercepta a comunicação sem ser detectado, comprometendo a confidencialidade e integridade dos dados.

Example

Uma app mobile que desativa a verificação de certificado para 'facilitar testes' acaba em produção; um atacante na mesma rede Wi-Fi intercepta requisições HTTPS para roubar tokens de autenticação ou dados sensíveis sem que a app perceba.

How to mitigate

Sempre validar o certificado do servidor (hostname, cadeia de certificados, data de validade), nunca desabilitar verificações em produção, e usar apenas bibliotecas atualizadas que implementam corretamente as regras de validação de TLS.

CVE-2026-41714MEDIUMIn Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManagerEPSS 0.1%CVE-2026-8497HIGHImproper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on AndrEPSS 0.1%CVE-2026-77707MEDIUMTLS Certificate Validation Disabled for Keycloak Connections in HAVELSAN's Liman Render EngineEPSS 0.1%CVE-2026-121624HIGHNanosystems Supremo before 5.0.2.3874 Improper TLS Certificate ValidationEPSS 0.1%CVE-2024-32865MEDIUMexacqVison - TLS certificate validationEPSS 0.1%CVE-2026-78556HIGHA vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validEPSS 0.1%CVE-2026-2748HIGHS/MIME Certificate Subject WhitespaceEPSS 0.1%CVE-2025-26478LOWDell ECS version 3.8.1.4 and prior contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent netwoEPSS 0.1%CVE-2025-2183MEDIUMGlobalProtect App: Improper Certificate Validation Leads to Privilege EscalationEPSS 0.1%CVE-2025-8393HIGHDreame Technology iOS and Android Mobile Applications Improper Certificate ValidationEPSS 0.1%CVE-2026-102671MEDIUMJoyland AI WebView accepts invalid SSL certificatesEPSS 0.1%CVE-2026-89102HIGHOCSP stapling v2 multi accepts non-CA chain certificates as issuersEPSS 0.1%CVE-2026-13327HIGHImproper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positiEPSS 0.1%CVE-2021-22278MEDIUMCertificate verification vulnerability in Update Manager of PCM600 Engineering ToolEPSS 0.1%CVE-2026-20323HIGHCisco Secure Firewall Management Center and Secure Firewall Threat Defense Software sftunnel Unauthorized Authentication Bypass VulnerabilityEPSS 0.1%CVE-2026-18678MEDIUMKong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configuredEPSS 0.1%CVE-2026-45175HIGHIdira Endpoint Privilege Manager Agent: Security Control and Cryptographic Validation Bypass in Internal Agent Validation ProcessesEPSS 0.1%CVE-2025-65083LOWGoSign Desktop through 2.4.1 disables TLS certificate validation when configured to use a proxy server. This can be problematic if the GoSigEPSS 0.1%CVE-2026-89133MEDIUMNameConstraints not enforced across unconstrained intermediate CAEPSS 0.1%CVE-2026-8367MEDIUMaria2c Improper Certificate ValidationEPSS 0.1%