Fallos del tipo CWE-295

856 resultados

Validação inadequada de certificados SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou de domínios diferentes. Isso permite ataques man-in-the-middle onde um atacante intercepta a comunicação mesmo com criptografia, comprometendo a confidencialidade e integridade dos dados.

Ejemplo

Uma API cliente ignora erros de validação de certificado (ex: desabilita verificação de hostname ou ignora exceções de certificado inválido) e faz requisições HTTPS para servidores externos. Um atacante na rede intercepta o tráfego, apresenta seu próprio certificado, e consegue ler dados sensíveis como tokens de autenticação ou credenciais.

Cómo mitigar

Sempre validar certificados: verificar hostname, data de validade e cadeia de confiança. Usar bibliotecas padrão do seu runtime (HttpClient do .NET, requests do Python, etc.) com validação ativada por padrão. Nunca desabilitar validação SSL/TLS em produção; se precisar em desenvolvimento, use variáveis de ambiente e revise criticamente o código antes de deploy.

CVE-2026-86889MEDIUMA certificate validation issue was addressed with improved certificate validation. This issue is fixed in macOS Golden Gate 27, macOS SequoiEPSS 0.2%CVE-2026-33753MEDIUMImproper Certificate Validation in rfc3161-clientEPSS 0.2%CVE-2025-33099MEDIUMIBM Concert Software information disclosureEPSS 0.2%CVE-2025-70043CRITICALAn issue pertaining to CWE-295: Improper Certificate Validation was discovered in Ayms node-To master. The application disables TLS/SSL certEPSS 0.2%CVE-2025-42611MEDIUMImproper certificate validation in multiple RouterOS servicesEPSS 0.2%CVE-2024-45641MEDIUMIBM Security ReaQta improper certificate validationEPSS 0.2%CVE-2021-26320—Insufficient validation of the AMD SEV Signing Key (ASK) in the SEND_START command in the SEV Firmware may allow a local authenticated attacEPSS 0.2%CVE-2026-49267MEDIUMApache Airflow: No certificate validation on SMTP STARTTLS connectionsEPSS 0.2%CVE-2026-78492HIGHDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificEPSS 0.2%CVE-2026-50578HIGHePA 3.x Integration: TLS Certificate Verification Universally DisabledEPSS 0.2%CVE-2026-54323MEDIUMDaytona: Git credential leak via git clone with TLS verification disabledEPSS 0.2%CVE-2025-52919MEDIUMIn Yealink RPS before 2025-05-26, the certificate upload function does not properly validate certificate content, potentially allowing invalEPSS 0.2%CVE-2026-50166MEDIUMKuma: kumactl connects to control plane without verifying TLS certificate when no CA is configuredEPSS 0.2%CVE-2026-69248MEDIUMpython-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtreesEPSS 0.2%CVE-2026-80125MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificEPSS 0.2%CVE-2025-68482MEDIUMA improper certificate validation vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyEPSS 0.2%CVE-2025-54470HIGHNeuVector telemetry sender is vulnerable to MITM and DoSEPSS 0.2%CVE-2026-5501HIGHImproper Certificate Signature Verification in X.509 Chain Validation Allows Forged Leaf CertificatesEPSS 0.2%CVE-2024-54147MEDIUMAltair GraphQL Client's desktop app does not validate HTTPS certificatesEPSS 0.2%CVE-2023-49567HIGHInsecure Trust of certificates using collision hash functions in Bitdefender Total Security HTTPS Scanning (VA-11239)EPSS 0.2%