Weaknesses of type CWE-295

1,020 results

Validação inadequada de certificado SSL/TLS

A aplicação falha em validar corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou de hosts diferentes. Isso permite ataques man-in-the-middle onde um atacante intercepta a comunicação sem ser detectado, comprometendo a confidencialidade e integridade dos dados.

Example

Uma app mobile que desativa a verificação de certificado para 'facilitar testes' acaba em produção; um atacante na mesma rede Wi-Fi intercepta requisições HTTPS para roubar tokens de autenticação ou dados sensíveis sem que a app perceba.

How to mitigate

Sempre validar o certificado do servidor (hostname, cadeia de certificados, data de validade), nunca desabilitar verificações em produção, e usar apenas bibliotecas atualizadas que implementam corretamente as regras de validação de TLS.

CVE-2024-35140HIGHIBM Security Verify Access privilege escalationEPSS 0.1%CVE-2026-73587MEDIUMDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. AEPSS 0.1%CVE-2026-8480MEDIUMConnection possible to the Administration portal with a revoked certificateEPSS 0.1%CVE-2026-86474HIGHImproper Certificate Validation in the Firmware Download vulnerabilityEPSS 0.1%CVE-2026-81447MEDIUMDell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Certificate Validation vulnerability. An unauthenticaEPSS 0.1%CVE-2026-113618MEDIUMImproper Server Certificate Validation in ZSIRep Client LibraryEPSS 0.1%CVE-2024-45205HIGHAn Improper Certificate Validation on the UniFi iOS App managing a standalone UniFi Access Point (not using UniFi Network Application) couldEPSS 0.1%CVE-2026-6731MEDIUMX.509 name constraint bypass via Subject CN treated as a DNS nameEPSS 0.1%CVE-2025-44964LOWA lack of SSL certificate validation in BlueStacks v5.20 allows attackers to execute a man-it-the-middle attack and obtain sensitive informaEPSS 0.1%CVE-2026-84465HIGHZammad: S/MIME signature verification allows forged sender impersonationEPSS 0.1%CVE-2026-20500MEDIUMIn Modem, there is a possible system crash due to improper input validation. This could lead to local denial of service with User execution EPSS 0.1%CVE-2024-47477MEDIUMDell PowerFlex Manager, versions prior to 4.5.1.1, contain an improper certificate validation vulnerability. A remote unauthenticated attackEPSS 0.1%CVE-2026-40992MEDIUMMail Auto-Configuration Does Not Enable SSL Hostname VerificationEPSS 0.1%CVE-2025-20215MEDIUMCisco Webex Meeting Client Join Certificate Validation VulnerabilityEPSS 0.1%CVE-2026-102668MEDIUMJoyland AI accepts TLS certificates without validationEPSS 0.1%CVE-2026-29140HIGHS/MIME Signature Additional CertificateEPSS 0.1%CVE-2026-27221MEDIUMAcrobat Reader | Improper Certificate Validation (CWE-295)EPSS 0.1%CVE-2026-44900HIGHepa4all-client: VAU Signature bypassEPSS 0.1%CVE-2026-82157HIGHDell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contains an Improper Certificate Validation vulnerability. An unauthenticaEPSS 0.1%CVE-2025-40896MEDIUMLack of TLS certificate validation when connecting Arc to a Guardian or CMC, in Arc before v2.2.0EPSS 0.1%