Falhas do tipo CWE-295

1.017 resultados

Validação inadequada de certificado SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou emitidos por autoridades não confiáveis. Isso permite que um atacante em posição de intermediário (man-in-the-middle) intercepte a comunicação criptografada e acesse dados sensíveis que deveriam estar protegidos.

Exemplo

Uma aplicação mobile conecta a uma API via HTTPS mas ignora erros de validação de certificado (ou desabilita a verificação para 'facilitar testes'). Um atacante na mesma rede WiFi consegue interceptar requisições, roubar tokens de autenticação ou credenciais do usuário.

Como mitigar

Sempre validar o certificado do servidor (hostname, cadeia de confiança, data de validade). Em desenvolvimento, use certificados válidos mesmo em ambientes de teste; nunca desabilite validação em produção. Considere certificate pinning para APIs críticas, fixando o certificado esperado na aplicação.

CVE-2026-42769MEDIUMTrust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdateEPSS 0.5%CVE-2025-34199CRITICALVasion Print (formerly PrinterLogic) Insecure SSL Verification Allows Man-in-the-Middle AttacksEPSS 0.5%CVE-2021-21571MEDIUMDell UEFI BIOS https stack leveraged by the Dell BIOSConnect feature and Dell HTTPS Boot feature contains an improper certificate validationEPSS 0.5%CVE-2019-3841HIGHKubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into EPSS 0.5%CVE-2022-46153HIGHRoutes exposed with an empty TLSOption in traefikEPSS 0.5%CVE-2025-46070CRITICALAn issue in Automai BotManager v.25.2.0 allows a remote attacker to execute arbitrary code via the BotManager.exe componentEPSS 0.5%CVE-2022-21657MEDIUMX.509 Extended Key Usage and Trust Purposes bypass in EnvoyEPSS 0.5%CVE-2022-41316MEDIUMHashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role'sEPSS 0.5%CVE-2023-2422MEDIUMKeycloak: oauth client impersonationEPSS 0.5%CVE-2026-20184CRITICALCisco Webex Meetings Certificate Validation VulnerabilityEPSS 0.5%CVE-2024-3738HIGHcym1102 nginxWebUI saveCmd handlePath certificate validationEPSS 0.5%CVE-2026-30840HIGHWallos: Server-Side Request Forgery (SSRF) in Notification TestersEPSS 0.5%CVE-2025-6032HIGHPodman: podman missing tls verificationEPSS 0.5%CVE-2022-45197HIGHSlixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of SlixmEPSS 0.5%CVE-2023-22367MEDIUMIchiran App for iOS versions prior to 3.1.0 and Ichiran App for Android versions prior to 3.1.0 improperly verify server certificates, whichEPSS 0.5%CVE-2026-87866CRITICALwolfSSL public-key pinning bypassEPSS 0.5%CVE-2026-7821HIGHImproper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to EPSS 0.5%CVE-2025-0500HIGHIssue affecting Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV clientsEPSS 0.5%CVE-2024-25140CRITICALA default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with EnhanEPSS 0.5%CVE-2026-65084HIGHNVIDIA NemoClaw for Linux contains a vulnerability in its deployment process, where an attacker could cause improper certificate validation.EPSS 0.5%