Fallos del tipo CWE-295

1017 resultados

Validação inadequada de certificados SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou de domínios diferentes. Isso permite ataques man-in-the-middle onde um atacante intercepta a comunicação mesmo com criptografia, comprometendo a confidencialidade e integridade dos dados.

Ejemplo

Uma API cliente ignora erros de validação de certificado (ex: desabilita verificação de hostname ou ignora exceções de certificado inválido) e faz requisições HTTPS para servidores externos. Um atacante na rede intercepta o tráfego, apresenta seu próprio certificado, e consegue ler dados sensíveis como tokens de autenticação ou credenciais.

Cómo mitigar

Sempre validar certificados: verificar hostname, data de validade e cadeia de confiança. Usar bibliotecas padrão do seu runtime (HttpClient do .NET, requests do Python, etc.) com validação ativada por padrão. Nunca desabilitar validação SSL/TLS em produção; se precisar em desenvolvimento, use variáveis de ambiente e revise criticamente o código antes de deploy.

CVE-2022-1632—An Improper Certificate Validation attack was found in Openshift. A re-encrypt Route with destinationCACertificate explicitly set to the defEPSS 0.4%CVE-2021-1354MEDIUMCisco Unified Computing System Central Software Improper Certificate Validation VulnerabilityEPSS 0.4%CVE-2023-49247—Permission verification vulnerability in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentiaEPSS 0.4%CVE-2022-40147—A vulnerability has been identified in Industrial Edge Management (All versions < V1.5.1). The affected software does not properly validate EPSS 0.4%CVE-2024-28161MEDIUMIn Jenkins Delphix Plugin 3.0.1, a global option for administrators to enable or disable SSL/TLS certificate validation for Data Control TowEPSS 0.4%CVE-2025-32878CRITICALAn issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a WLAN. This function is EPSS 0.4%CVE-2026-82208HIGHwolfSSL CA-cache hit overrides callbackEPSS 0.4%CVE-2021-1277HIGHCisco Data Center Network Manager Certificate Validation VulnerabilitiesEPSS 0.4%CVE-2021-22511—Improper Certificate Validation vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affectsEPSS 0.4%CVE-2021-1276HIGHCisco Data Center Network Manager Certificate Validation VulnerabilitiesEPSS 0.4%CVE-2024-43201HIGHPlanet Fitness Workouts mobile apps do not properly validate TLS certificatesEPSS 0.4%CVE-2025-65753HIGHAn issue in the TLS certification mechanism of Guardian Gryphon v01.06.0006.22 allows attackers to execute commands as root.EPSS 0.4%CVE-2021-23167HIGHImproper certificate validation vulnerability in SMTP Client allows man-in-the-middle attack to retrieve sensitive information from the CommEPSS 0.4%CVE-2026-86881CRITICALA certificate validation issue was addressed with improved certificate validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 aEPSS 0.4%CVE-2022-1197MEDIUMWhen importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the keyEPSS 0.4%CVE-2026-61668HIGHDIRAC: Pilot code downloaded over unverified HTTPS connectionEPSS 0.4%CVE-2025-10548MEDIUMMissing Certificate Validation in CleverControl Installer Allows Remote Code ExecutionEPSS 0.4%CVE-2022-1834MEDIUMWhen displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird EPSS 0.4%CVE-2022-45419MEDIUMIf the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server that used that certifiEPSS 0.4%CVE-2025-24471MEDIUMAn Improper Certificate Validation vulnerability [CWE-295] in FortiOS version 7.6.1 and below, version 7.4.7 and below may allow an EAP veriEPSS 0.4%