Fallos del tipo CWE-295

856 resultados

Validação inadequada de certificados SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou de domínios diferentes. Isso permite ataques man-in-the-middle onde um atacante intercepta a comunicação mesmo com criptografia, comprometendo a confidencialidade e integridade dos dados.

Ejemplo

Uma API cliente ignora erros de validação de certificado (ex: desabilita verificação de hostname ou ignora exceções de certificado inválido) e faz requisições HTTPS para servidores externos. Um atacante na rede intercepta o tráfego, apresenta seu próprio certificado, e consegue ler dados sensíveis como tokens de autenticação ou credenciais.

Cómo mitigar

Sempre validar certificados: verificar hostname, data de validade e cadeia de confiança. Usar bibliotecas padrão do seu runtime (HttpClient do .NET, requests do Python, etc.) com validação ativada por padrão. Nunca desabilitar validação SSL/TLS em produção; se precisar em desenvolvimento, use variáveis de ambiente e revise criticamente o código antes de deploy.

CVE-2026-81518HIGHBI Connector Optional Client Certificate Verification Allows Unauthenticated ConnectionsEPSS 0.2%CVE-2026-84975HIGHPJSIP: TLS server identity (hostname) verification bypass via embedded NUL in certificate SubjectAltName (OpenSSL and GnuTLS backends)EPSS 0.2%CVE-2025-71063HIGHErrands before 46.2.10 does not verify TLS certificates for CalDAV servers.EPSS 0.2%CVE-2026-34073LOWcryptography has incomplete DNS name constraint enforcement on peer namesEPSS 0.2%CVE-2025-67601HIGHRancher CLI skips TLS verification on Rancher CLI login commandEPSS 0.2%CVE-2026-3822HIGHTaipower｜Taipower APP(Android) - Improper Certificate ValidationEPSS 0.2%CVE-2023-50179MEDIUMAn improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2 all versions, 7.1 all versions, 7.0 all versions may allowEPSS 0.2%CVE-2026-80164HIGHDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificEPSS 0.2%CVE-2026-78494HIGHDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificEPSS 0.1%CVE-2026-79644HIGHDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificEPSS 0.1%CVE-2026-24935MEDIUMAn improper certificate validation vulnerability was found in a third-party NAT traversal module.EPSS 0.1%CVE-2024-4762HIGHAn improper validation vulnerability was reported in the firmware update mechanism of LADM and LDCC that could allow a local attacker to escEPSS 0.1%CVE-2026-49457CRITICALQUIC has Broken TLS verificationEPSS 0.1%CVE-2026-15683HIGHLorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation VulnerabilityEPSS 0.1%CVE-2026-35207MEDIUMdeepinid plugin in dde-control-center is configured to skip TLS certificate verification when downloading avatar from remote serverEPSS 0.1%CVE-2026-4740HIGHRhacm: open cluster management (ocm): cross-cluster privilege escalation via improper kubernetes client certificate renewal validationEPSS 0.1%CVE-2026-50149MEDIUMContour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate EnabledEPSS 0.1%CVE-2026-85221HIGHMISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle AttacksEPSS 0.1%CVE-2026-84961HIGHundici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPoolEPSS 0.1%CVE-2026-44312MEDIUMcss_parser allows to MITM included https css urlsEPSS 0.1%