Fallos del tipo CWE-295

856 resultados

Validação inadequada de certificados SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou de domínios diferentes. Isso permite ataques man-in-the-middle onde um atacante intercepta a comunicação mesmo com criptografia, comprometendo a confidencialidade e integridade dos dados.

Ejemplo

Uma API cliente ignora erros de validação de certificado (ex: desabilita verificação de hostname ou ignora exceções de certificado inválido) e faz requisições HTTPS para servidores externos. Um atacante na rede intercepta o tráfego, apresenta seu próprio certificado, e consegue ler dados sensíveis como tokens de autenticação ou credenciais.

Cómo mitigar

Sempre validar certificados: verificar hostname, data de validade e cadeia de confiança. Usar bibliotecas padrão do seu runtime (HttpClient do .NET, requests do Python, etc.) com validação ativada por padrão. Nunca desabilitar validação SSL/TLS em produção; se precisar em desenvolvimento, use variáveis de ambiente e revise criticamente o código antes de deploy.

CVE-2026-39388LOWOpenBao's Certificate Authentication Allows Token Renewal With Different CertificateEPSS 0.1%CVE-2026-18257MEDIUMImproper Certificate Validation in S2OPCEPSS 0.1%CVE-2026-79967MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificEPSS 0.1%CVE-2025-30669MEDIUMZoom Workplace Clients - Improper Certificate ValidationEPSS 0.1%CVE-2026-39984MEDIUMSigstore Timestamp Authority has Improper Certificate Validation in verifierEPSS 0.1%CVE-2026-41859HIGHA network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secrEPSS 0.1%CVE-2026-31798MEDIUMJumpServer Improper Certificate Validation in Custom SMS API ClientEPSS 0.1%CVE-2026-84850MEDIUMImproper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 aEPSS 0.1%CVE-2024-38642LOWQuMagieEPSS 0.1%CVE-2026-18678MEDIUMKong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configuredEPSS 0.1%CVE-2026-41012HIGHBOSH vSphere CPI Improper Cert ValidationEPSS 0.1%CVE-2026-66406LOWDEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obEPSS 0.1%CVE-2026-44305MEDIUMLemur: LDAP TLS certificate verification globally disabled enables credential interceptionEPSS 0.1%CVE-2026-20500MEDIUMIn Modem, there is a possible system crash due to improper input validation. This could lead to local denial of service with User execution EPSS 0.1%CVE-2025-12893LOWImproper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB ServerEPSS 0.1%CVE-2026-87872MEDIUMCommunity.general: community.general: ocapi module_utils (ocapi_command, ocapi_info) hardcode validate_certs=false with no override, enabling tls man-in-the-middle and credential disclosureEPSS 0.1%CVE-2026-90452MEDIUMRequests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify tEPSS 0.1%CVE-2025-6026LOWAn improper certificate validation vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow a user capable ofEPSS 0.1%CVE-2026-54548LOWkas: Persistent SSH Host Key Checking DisablementEPSS 0.1%CVE-2026-46734HIGHDell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Certificate Validation vulnerability. A low priviEPSS 0.1%