Fallos del tipo CWE-295

1017 resultados

Validação inadequada de certificados SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou de domínios diferentes. Isso permite ataques man-in-the-middle onde um atacante intercepta a comunicação mesmo com criptografia, comprometendo a confidencialidade e integridade dos dados.

Ejemplo

Uma API cliente ignora erros de validação de certificado (ex: desabilita verificação de hostname ou ignora exceções de certificado inválido) e faz requisições HTTPS para servidores externos. Um atacante na rede intercepta o tráfego, apresenta seu próprio certificado, e consegue ler dados sensíveis como tokens de autenticação ou credenciais.

Cómo mitigar

Sempre validar certificados: verificar hostname, data de validade e cadeia de confiança. Usar bibliotecas padrão do seu runtime (HttpClient do .NET, requests do Python, etc.) com validação ativada por padrão. Nunca desabilitar validação SSL/TLS em produção; se precisar em desenvolvimento, use variáveis de ambiente e revise criticamente o código antes de deploy.

CVE-2023-51837CRITICALYlianst MeshCentral 1.1.16 is vulnerable to Missing SSL Certificate Validation.EPSS 0.5%CVE-2022-32210—`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpeEPSS 0.5%CVE-2026-2590CRITICALImproper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop ManaEPSS 0.5%CVE-2024-29072HIGHA privilege escalation vulnerability exists in the Foxit Reader 2024.2.0.25138. The vulnerability occurs due to improper certification validEPSS 0.5%CVE-2022-43705CRITICALIn Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1EPSS 0.5%CVE-2026-34580CRITICALBotan has a certificate authentication bypass due to trust anchor confusionEPSS 0.5%CVE-2026-113470MEDIUMCryptographic issue in the Security Block-lists, Allow-lists, and other State componentEPSS 0.5%CVE-2026-9697HIGHundici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgentEPSS 0.5%CVE-2021-22138—In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When spEPSS 0.5%CVE-2023-30516MEDIUMJenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to DockeEPSS 0.5%CVE-2022-37437HIGHIngest Actions UI in Splunk Enterprise 9.0.0 disabled TLS certificate validationEPSS 0.5%CVE-2025-0501HIGHIssue affecting Amazon WorkSpaces Clients (when running PCoIP protocol)EPSS 0.5%CVE-2021-3898MEDIUMVersions of Motorola Ready For and Motorola Device Help Android applications prior to 2021-04-08 do not properly verify the server certificaEPSS 0.5%CVE-2025-29331CRITICALAn issue in MHSanaei 3x-ui before v.2.5.3 and before allows a remote attacker to execute arbitrary code via the management script x-ui passeEPSS 0.5%CVE-2023-23901MEDIUMImproper following of a certificate's chain of trust exists in SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, and SkyBridge BASIC MB-EPSS 0.5%CVE-2023-48427HIGHA vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected products do not properly validate the certificEPSS 0.5%CVE-2024-13956HIGHSSL Verification BypassEPSS 0.5%CVE-2024-45234HIGHAn issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync oEPSS 0.5%CVE-2020-6781MEDIUMImproper Certificate Validation in Bosch Smart Home System App for iOSEPSS 0.5%CVE-2024-2048HIGHVault Cert Auth Method Did Not Correctly Validate Non-CA CertificatesEPSS 0.5%