Fallos del tipo CWE-295

1020 resultados

Validação inadequada de certificados SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou de domínios diferentes. Isso permite ataques man-in-the-middle onde um atacante intercepta a comunicação mesmo com criptografia, comprometendo a confidencialidade e integridade dos dados.

Ejemplo

Uma API cliente ignora erros de validação de certificado (ex: desabilita verificação de hostname ou ignora exceções de certificado inválido) e faz requisições HTTPS para servidores externos. Um atacante na rede intercepta o tráfego, apresenta seu próprio certificado, e consegue ler dados sensíveis como tokens de autenticação ou credenciais.

Cómo mitigar

Sempre validar certificados: verificar hostname, data de validade e cadeia de confiança. Usar bibliotecas padrão do seu runtime (HttpClient do .NET, requests do Python, etc.) com validação ativada por padrão. Nunca desabilitar validação SSL/TLS em produção; se precisar em desenvolvimento, use variáveis de ambiente e revise criticamente o código antes de deploy.

CVE-2026-107587MEDIUMImproper Certificate Validation in hMailServerEPSS 0.2%CVE-2024-47241MEDIUMDell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.24, contains an Improper Certificate Validation vulnerability. A low priEPSS 0.2%CVE-2025-20126MEDIUMCisco ThousandEyes Endpoint Agent Certificate Validation VulnerabilityEPSS 0.2%CVE-2026-45745HIGHTermix has improper certificate validation in Electron desktop client that enables MITM credential/token theftEPSS 0.2%CVE-2025-12047MEDIUMA vulnerability was reported in the Lenovo Scanner pro application during an internal security assessment that, under certain circumstances,EPSS 0.2%CVE-2025-12943MEDIUMImproper certificate validation in firmware update logic in NETGEAR RAX30 and RAXE300EPSS 0.2%CVE-2026-71889HIGHPKIXCertPathReviewer does not apply X.509 name constraints to the target certificateEPSS 0.2%CVE-2025-67601HIGHRancher CLI skips TLS verification on Rancher CLI login commandEPSS 0.2%CVE-2026-106036MEDIUMImproper certificate validation in SzafirEPSS 0.2%CVE-2026-121392CRITICALFreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificateEPSS 0.2%CVE-2026-24934MEDIUMAn improper certificate validation vulnerability was found in ADM while querying an external server for the device's WAN IP address.EPSS 0.2%CVE-2021-21559HIGHDell EMC NetWorker, versions 18.x, 19.1.x, 19.2.x 19.3.x, 19.4, and 19.4.0.1 contain an Improper Certificate Validation vulnerability in theEPSS 0.2%CVE-2026-66410LOWAndroid and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered.EPSS 0.2%CVE-2024-9160MEDIUMSecurity Misconfiguration in Forge module PEADMEPSS 0.2%CVE-2026-32884MEDIUMBotan: Case-Insensitive CN Values Bypass DNS excludedSubtrees Name Constraints (RFC 5280 Violation)EPSS 0.2%CVE-2026-119189MEDIUMForge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsageEPSS 0.2%CVE-2024-40590MEDIUMAn improper certificate validation vulnerability [CWE-295] in FortiPortal version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, vEPSS 0.2%CVE-2025-23118MEDIUMAn Improper Certificate Validation vulnerability could allow an authenticated malicious actor with access to UniFi Protect Cameras adjacent EPSS 0.2%CVE-2026-48697HIGHFastNetMon Community Edition through 1.2.9 does not verify TLS certificates on outbound HTTPS connections. The execute_web_request_secure() EPSS 0.2%CVE-2022-23649LOWImproper Certificate Validation in CosignEPSS 0.2%