Fallos del tipo CWE-295

1020 resultados

Validação inadequada de certificados SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou de domínios diferentes. Isso permite ataques man-in-the-middle onde um atacante intercepta a comunicação mesmo com criptografia, comprometendo a confidencialidade e integridade dos dados.

Ejemplo

Uma API cliente ignora erros de validação de certificado (ex: desabilita verificação de hostname ou ignora exceções de certificado inválido) e faz requisições HTTPS para servidores externos. Um atacante na rede intercepta o tráfego, apresenta seu próprio certificado, e consegue ler dados sensíveis como tokens de autenticação ou credenciais.

Cómo mitigar

Sempre validar certificados: verificar hostname, data de validade e cadeia de confiança. Usar bibliotecas padrão do seu runtime (HttpClient do .NET, requests do Python, etc.) com validação ativada por padrão. Nunca desabilitar validação SSL/TLS em produção; se precisar em desenvolvimento, use variáveis de ambiente e revise criticamente o código antes de deploy.

CVE-2026-93600LOWrustls webpki Name Constraints URI Validation BypassEPSS 0.2%CVE-2026-93601LOWrustls webpki 0.101.0 before 0.103.12 Name Constraint BypassEPSS 0.2%CVE-2024-31853HIGHA vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.11). During establishment of a https connection to the TLS serveEPSS 0.2%CVE-2026-66404MEDIUMDEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on thEPSS 0.2%CVE-2022-39334LOWnextcloudcmd incorrectly trusts bad TLS certificatesEPSS 0.2%CVE-2023-38009MEDIUMIBM Cognos Analytics Mobile information disclosureEPSS 0.2%CVE-2024-31854HIGHA vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.11). During establishment of a https connection to the TLS serveEPSS 0.2%CVE-2026-88648LOWIn GnuTLS v3.8.13, an excluded msUPN/SRV otherName is never checked. NOTE: the Supplier does not consider this an actionable security vulnerEPSS 0.2%CVE-2021-20327MEDIUMMongoDB Node.js client side field level encryption library may not be validating KMS certificateEPSS 0.2%CVE-2025-36005MEDIUMIBM MQ Operator information disclosureEPSS 0.2%CVE-2026-123306HIGHIn JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runsEPSS 0.2%CVE-2025-35434LOWCISA Thorium does not validate TLS connections to ElasticsearchEPSS 0.2%CVE-2025-39205HIGHA vulnerability exists in the IEC 61850 in MicroSCADA X SYS600 product. The certificate validation of the TLS protocol allows remote Man-in-EPSS 0.2%CVE-2026-66154HIGHAn insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) aEPSS 0.2%CVE-2026-0277MEDIUMPrisma Access Agent: Improper Certificate Validation on iOSEPSS 0.2%CVE-2025-46551MEDIUMJRuby-OpenSSL has hostname verification disabled by defaultEPSS 0.2%CVE-2025-15557HIGHImproper Certificate Validation in TP-Link Tapo H100 and P100 Allows Man-in-the-Middle AttackEPSS 0.2%CVE-2023-50178HIGHAn improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2.0 through 7.2.3, 7.1 all versions, 7.0 all versions, 6.2 aEPSS 0.2%CVE-2026-106017MEDIUMImproper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage rEPSS 0.2%CVE-2026-0228LOWPAN-OS: Improper Validation of Terminal Server Agent CertificateEPSS 0.2%