Fallos del tipo CWE-295

1020 resultados

Validação inadequada de certificados SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou de domínios diferentes. Isso permite ataques man-in-the-middle onde um atacante intercepta a comunicação mesmo com criptografia, comprometendo a confidencialidade e integridade dos dados.

Ejemplo

Uma API cliente ignora erros de validação de certificado (ex: desabilita verificação de hostname ou ignora exceções de certificado inválido) e faz requisições HTTPS para servidores externos. Um atacante na rede intercepta o tráfego, apresenta seu próprio certificado, e consegue ler dados sensíveis como tokens de autenticação ou credenciais.

Cómo mitigar

Sempre validar certificados: verificar hostname, data de validade e cadeia de confiança. Usar bibliotecas padrão do seu runtime (HttpClient do .NET, requests do Python, etc.) com validação ativada por padrão. Nunca desabilitar validação SSL/TLS em produção; se precisar em desenvolvimento, use variáveis de ambiente e revise criticamente o código antes de deploy.

CVE-2026-32627HIGHcpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via ProxyEPSS 0.2%CVE-2026-95210MEDIUMGnuTLS v3.8.13 does not reject a critical keyUsage extension when it cannot be processed, such as when extnValue is an ASN.1 NULL (05 00) inEPSS 0.2%CVE-2026-106017MEDIUMImproper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage rEPSS 0.2%CVE-2025-15557HIGHImproper Certificate Validation in TP-Link Tapo H100 and P100 Allows Man-in-the-Middle AttackEPSS 0.2%CVE-2026-110281MEDIUMMultiple vulnerabilities that affects IBM Db2 Genius HubEPSS 0.2%CVE-2026-9036MEDIUMVulnerabilities exists in IBM Netezza SoftwareEPSS 0.2%CVE-2026-10592MEDIUMWildcard DNS SAN bypasses CA name-constraint checksEPSS 0.2%CVE-2026-27133MEDIUMStrimzi All CAs from CA chain will be trusted in Kafka Connect and Kafka MirrorMaker 2 target clustersEPSS 0.2%CVE-2026-103294MEDIUMCAI Content Credentials | Improper Certificate Validation (CWE-295)EPSS 0.2%CVE-2025-36290MEDIUMIBM Integrated Analytics System (IIAS) is affected by improper SSL/TLS certificate validation vulnerability in JWT service componentEPSS 0.2%CVE-2026-105223CRITICALmaclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate VerificationEPSS 0.2%CVE-2026-16107MEDIUMTS4500 CLI tool addresses security vulnerabilityEPSS 0.2%CVE-2025-54470HIGHNeuVector telemetry sender is vulnerable to MITM and DoSEPSS 0.2%CVE-2026-71885CRITICALMLS X.509 credential not bound to the LeafNode signature keyEPSS 0.2%CVE-2026-54342HIGHTLS Certificate Verification Disabled on CXF Transport Clients in epa4allEPSS 0.2%CVE-2026-86889MEDIUMA certificate validation issue was addressed with improved certificate validation. This issue is fixed in macOS Golden Gate 27, macOS SequoiEPSS 0.2%CVE-2026-81871MEDIUMOpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinningEPSS 0.2%CVE-2026-3100HIGHAn improper certificate validation vulnerability was found in the FTP Backup on the ADM.EPSS 0.2%CVE-2026-9259HIGHImproper validation of server certificates in Canon EOS Network Setting Tool Version 1.5.0 or earlierEPSS 0.2%CVE-2025-62371HIGHOpenSearch Data Prepper plugins trusts all SSL certificates by defaultEPSS 0.2%