Fallos del tipo CWE-295

1020 resultados

Validação inadequada de certificados SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou de domínios diferentes. Isso permite ataques man-in-the-middle onde um atacante intercepta a comunicação mesmo com criptografia, comprometendo a confidencialidade e integridade dos dados.

Ejemplo

Uma API cliente ignora erros de validação de certificado (ex: desabilita verificação de hostname ou ignora exceções de certificado inválido) e faz requisições HTTPS para servidores externos. Um atacante na rede intercepta o tráfego, apresenta seu próprio certificado, e consegue ler dados sensíveis como tokens de autenticação ou credenciais.

Cómo mitigar

Sempre validar certificados: verificar hostname, data de validade e cadeia de confiança. Usar bibliotecas padrão do seu runtime (HttpClient do .NET, requests do Python, etc.) com validação ativada por padrão. Nunca desabilitar validação SSL/TLS em produção; se precisar em desenvolvimento, use variáveis de ambiente e revise criticamente o código antes de deploy.

CVE-2026-33308MEDIUMmod_gnutls missing key purpose check in client certificate verificationEPSS 0.2%CVE-2025-71261HIGHHarvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOSEPSS 0.2%CVE-2026-63577HIGHName Constraints bypass: directoryName constraint matched at any position in the DN instead of as a prefixEPSS 0.2%CVE-2026-109399CRITICALSWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded IntermediatesEPSS 0.2%CVE-2026-103503MEDIUMHex trusts its bundled CA certificates when cacerts_path is setEPSS 0.2%CVE-2025-40800CRITICALA vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), NX V2412 (All versions < EPSS 0.2%CVE-2026-44213MEDIUMOpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configuredEPSS 0.2%CVE-2026-32144HIGHOCSP designated-responder authorization bypass via missing signature verificationEPSS 0.2%CVE-2024-41256MEDIUMDefault configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification EPSS 0.2%CVE-2026-0872LOWImproper Certificate Validation vulnerability in Thales SafeNet Agent for Windows LogonEPSS 0.2%CVE-2026-97687HIGHurllib3: HTTPS proxy TLS configuration may be ignored or overriddenEPSS 0.2%CVE-2024-30134MEDIUMHCL Traveler for Microsoft Outlook (HTMO) is susceptible to an application modification vulnerabilityEPSS 0.2%CVE-2026-22696CRITICALdcap-qvl has Missing Verification for QE IdentityEPSS 0.2%CVE-2026-90651HIGHSocket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. WheEPSS 0.2%CVE-2026-48248HIGHOpen ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in incs/login.inc.phpEPSS 0.2%CVE-2025-23091MEDIUMAn Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man-EPSS 0.2%CVE-2026-78483MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificEPSS 0.2%CVE-2025-62375MEDIUMgo-witness Improper Verification of AWS EC2 Identity DocumentsEPSS 0.2%CVE-2026-108184HIGHImproper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure vEPSS 0.2%CVE-2026-78489MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificEPSS 0.2%