Fallos del tipo CWE-295

1020 resultados

Validação inadequada de certificados SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou de domínios diferentes. Isso permite ataques man-in-the-middle onde um atacante intercepta a comunicação mesmo com criptografia, comprometendo a confidencialidade e integridade dos dados.

Ejemplo

Uma API cliente ignora erros de validação de certificado (ex: desabilita verificação de hostname ou ignora exceções de certificado inválido) e faz requisições HTTPS para servidores externos. Um atacante na rede intercepta o tráfego, apresenta seu próprio certificado, e consegue ler dados sensíveis como tokens de autenticação ou credenciais.

Cómo mitigar

Sempre validar certificados: verificar hostname, data de validade e cadeia de confiança. Usar bibliotecas padrão do seu runtime (HttpClient do .NET, requests do Python, etc.) com validação ativada por padrão. Nunca desabilitar validação SSL/TLS em produção; se precisar em desenvolvimento, use variáveis de ambiente e revise criticamente o código antes de deploy.

CVE-2026-105221CRITICALGist RubyGem before 6.1.0 Disabled TLS Certificate VerificationEPSS 0.2%CVE-2026-65118HIGHNVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successEPSS 0.2%CVE-2026-47074HIGHex_aws_sns SigningCertURL not validated in verify_message/1EPSS 0.2%CVE-2026-102476CRITICALIn Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiencyEPSS 0.2%CVE-2025-15573CRITICALMissing Certificate Validation for Solax Power Pocket WiFi models MQTT Cloud ConnectionEPSS 0.2%CVE-2025-10495HIGHA potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applicationEPSS 0.2%CVE-2026-45388CRITICALIn OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the certificate provided by the server, which allows impersEPSS 0.2%CVE-2024-27440MEDIUMThe Toyoko Inn official App for iOS versions prior to 1.13.0 and Toyoko Inn official App for Android versions prior 1.3.14 don't properly veEPSS 0.2%CVE-2025-15612MEDIUMWazuh Provisioning Scripts / Build Infrastructure Improper Certificate Validation leading to MITM and RCEEPSS 0.2%CVE-2026-23776HIGHDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release verEPSS 0.2%CVE-2026-6900CRITICALImproper Certificate ValidationEPSS 0.2%CVE-2025-66491MEDIUMTraefik has Inverted TLS Verification Logic in its ingress-nginx ProviderEPSS 0.2%CVE-2026-80122HIGHDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificEPSS 0.2%CVE-2026-59836MEDIUMA improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1, FortiCliEPSS 0.2%CVE-2026-96453HIGHOrg.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificatesEPSS 0.2%CVE-2026-24932HIGHAn improper certificate validation vulnerability was found in ADM while updating the DDNS settings.EPSS 0.2%CVE-2025-69412LOWKDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API (aka phishing API), which miEPSS 0.2%CVE-2026-79734MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificEPSS 0.2%CVE-2026-24933HIGHAn improper certificate validation vulnerability was found in ADM while sending HTTPS requests to the server.EPSS 0.2%CVE-2025-64649MEDIUMMultiple Vulnerabilities in IBM Concert SoftwareEPSS 0.2%