Fallos del tipo CWE-295

1020 resultados

Validação inadequada de certificados SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou de domínios diferentes. Isso permite ataques man-in-the-middle onde um atacante intercepta a comunicação mesmo com criptografia, comprometendo a confidencialidade e integridade dos dados.

Ejemplo

Uma API cliente ignora erros de validação de certificado (ex: desabilita verificação de hostname ou ignora exceções de certificado inválido) e faz requisições HTTPS para servidores externos. Um atacante na rede intercepta o tráfego, apresenta seu próprio certificado, e consegue ler dados sensíveis como tokens de autenticação ou credenciais.

Cómo mitigar

Sempre validar certificados: verificar hostname, data de validade e cadeia de confiança. Usar bibliotecas padrão do seu runtime (HttpClient do .NET, requests do Python, etc.) com validação ativada por padrão. Nunca desabilitar validação SSL/TLS em produção; se precisar em desenvolvimento, use variáveis de ambiente e revise criticamente o código antes de deploy.

CVE-2026-8480MEDIUMConnection possible to the Administration portal with a revoked certificateEPSS 0.1%CVE-2024-35140HIGHIBM Security Verify Access privilege escalationEPSS 0.1%CVE-2026-73587MEDIUMDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. AEPSS 0.1%CVE-2026-113618MEDIUMImproper Server Certificate Validation in ZSIRep Client LibraryEPSS 0.1%CVE-2026-81447MEDIUMDell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Certificate Validation vulnerability. An unauthenticaEPSS 0.1%CVE-2024-45205HIGHAn Improper Certificate Validation on the UniFi iOS App managing a standalone UniFi Access Point (not using UniFi Network Application) couldEPSS 0.1%CVE-2026-86474HIGHImproper Certificate Validation in the Firmware Download vulnerabilityEPSS 0.1%CVE-2025-44964LOWA lack of SSL certificate validation in BlueStacks v5.20 allows attackers to execute a man-it-the-middle attack and obtain sensitive informaEPSS 0.1%CVE-2026-84465HIGHZammad: S/MIME signature verification allows forged sender impersonationEPSS 0.1%CVE-2026-40992MEDIUMMail Auto-Configuration Does Not Enable SSL Hostname VerificationEPSS 0.1%CVE-2024-47477MEDIUMDell PowerFlex Manager, versions prior to 4.5.1.1, contain an improper certificate validation vulnerability. A remote unauthenticated attackEPSS 0.1%CVE-2026-6731MEDIUMX.509 name constraint bypass via Subject CN treated as a DNS nameEPSS 0.1%CVE-2026-20500MEDIUMIn Modem, there is a possible system crash due to improper input validation. This could lead to local denial of service with User execution EPSS 0.1%CVE-2025-20215MEDIUMCisco Webex Meeting Client Join Certificate Validation VulnerabilityEPSS 0.1%CVE-2026-102668MEDIUMJoyland AI accepts TLS certificates without validationEPSS 0.1%CVE-2026-29140HIGHS/MIME Signature Additional CertificateEPSS 0.1%CVE-2025-40896MEDIUMLack of TLS certificate validation when connecting Arc to a Guardian or CMC, in Arc before v2.2.0EPSS 0.1%CVE-2026-82157HIGHDell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contains an Improper Certificate Validation vulnerability. An unauthenticaEPSS 0.1%CVE-2026-27221MEDIUMAcrobat Reader | Improper Certificate Validation (CWE-295)EPSS 0.1%CVE-2026-44900HIGHepa4all-client: VAU Signature bypassEPSS 0.1%