Fallos del tipo CWE-295

1020 resultados

Validação inadequada de certificados SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou de domínios diferentes. Isso permite ataques man-in-the-middle onde um atacante intercepta a comunicação mesmo com criptografia, comprometendo a confidencialidade e integridade dos dados.

Ejemplo

Uma API cliente ignora erros de validação de certificado (ex: desabilita verificação de hostname ou ignora exceções de certificado inválido) e faz requisições HTTPS para servidores externos. Um atacante na rede intercepta o tráfego, apresenta seu próprio certificado, e consegue ler dados sensíveis como tokens de autenticação ou credenciais.

Cómo mitigar

Sempre validar certificados: verificar hostname, data de validade e cadeia de confiança. Usar bibliotecas padrão do seu runtime (HttpClient do .NET, requests do Python, etc.) com validação ativada por padrão. Nunca desabilitar validação SSL/TLS em produção; se precisar em desenvolvimento, use variáveis de ambiente e revise criticamente o código antes de deploy.

CVE-2025-53869MEDIUMMultiple MFPs provided by Brother Industries, Ltd. does not properly validate server certificates, which may allow a man-in-the-middle attacEPSS 0.2%CVE-2024-6219LOWMark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restEPSS 0.2%CVE-2026-102508CRITICALApache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgradeEPSS 0.2%CVE-2026-57289MEDIUMJenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for coEPSS 0.2%CVE-2024-48865HIGHQTS, QuTS heroEPSS 0.2%CVE-2026-109423CRITICALNetEase Cloud Music TLS Certificate Validation BypassEPSS 0.2%CVE-2026-61813LOWModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::downloadEPSS 0.2%CVE-2026-18257MEDIUMImproper Certificate Validation in S2OPCEPSS 0.2%CVE-2026-79967MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificEPSS 0.2%CVE-2026-35207MEDIUMdeepinid plugin in dde-control-center is configured to skip TLS certificate verification when downloading avatar from remote serverEPSS 0.2%CVE-2026-22250LOWwlc can skip SSL verificationEPSS 0.2%CVE-2026-24935MEDIUMAn improper certificate validation vulnerability was found in a third-party NAT traversal module.EPSS 0.2%CVE-2026-48437MEDIUMCAI Content Credentials | Improper Certificate Validation (CWE-295)EPSS 0.2%CVE-2025-8476HIGHAlpine iLX-507 TIDAL Improper Certificate Validation VulnerabilityEPSS 0.2%CVE-2026-85087MEDIUMApache Thrift: Python ≥3.12 host-name check silently becomes a no-opEPSS 0.2%CVE-2026-2368HIGHAn improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of interceptinEPSS 0.2%CVE-2023-50179MEDIUMAn improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2 all versions, 7.1 all versions, 7.0 all versions may allowEPSS 0.2%CVE-2026-4396HIGHImproper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attacker to perform a man-in-EPSS 0.2%CVE-2026-92868MEDIUMAn improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificaEPSS 0.2%CVE-2026-87733MEDIUMAn issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets acceEPSS 0.2%