Falhas do tipo CWE-295

1.017 resultados

Validação inadequada de certificado SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou emitidos por autoridades não confiáveis. Isso permite que um atacante em posição de intermediário (man-in-the-middle) intercepte a comunicação criptografada e acesse dados sensíveis que deveriam estar protegidos.

Exemplo

Uma aplicação mobile conecta a uma API via HTTPS mas ignora erros de validação de certificado (ou desabilita a verificação para 'facilitar testes'). Um atacante na mesma rede WiFi consegue interceptar requisições, roubar tokens de autenticação ou credenciais do usuário.

Como mitigar

Sempre validar o certificado do servidor (hostname, cadeia de confiança, data de validade). Em desenvolvimento, use certificados válidos mesmo em ambientes de teste; nunca desabilite validação em produção. Considere certificate pinning para APIs críticas, fixando o certificado esperado na aplicação.

CVE-2026-25961HIGHSumatraPDF Update MITM -> Arbitrary Code ExecutionEPSS 0.4%CVE-2022-34865MEDIUMTraffic intelligence feeds vulnerability CVE-2022-34865EPSS 0.4%CVE-2017-14806LOWInsecure handling of repodata and packages in SUSE Studio onliteEPSS 0.4%CVE-2020-36658HIGHIn Apache::Session::LDAP before 0.5, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, beEPSS 0.4%CVE-2022-34394LOWDell OS10, version 10.5.3.4, contains an Improper Certificate Validation vulnerability in Support Assist. A remote unauthenticated attacker EPSS 0.4%CVE-2022-45391HIGHJenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier globally and unconditionally disables SSL/TLS certificate and hEPSS 0.4%CVE-2022-38666HIGHJenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificate and hostname validEPSS 0.4%CVE-2023-1409MEDIUMCertificate validation issue in MongoDB Server running on Windows or macOSEPSS 0.4%CVE-2016-6562—ShoreTel Mobility Client for iOS and Android, version 9.1.3.109 and earlier, fails to properly validate SSL certificates provided by HTTPS connectionsEPSS 0.4%CVE-2021-20328MEDIUMMongoDB Java driver client-side field level encryption not verifying KMS host nameEPSS 0.4%CVE-2023-25392MEDIUMAllegro Tech BigFlow <1.6 is vulnerable to Missing SSL Certificate Validation.EPSS 0.4%CVE-2026-59818MEDIUMetcd: gRPC client listener does not enforce `--client-crl-file` certificate revocationEPSS 0.4%CVE-2026-8763CRITICALName Constraints bypass via trailing dot in rfc822Name and URIEPSS 0.4%CVE-2024-5261CRITICALTLS certificate are not properly verified when utilizing LibreOfficeKitEPSS 0.4%CVE-2026-18141HIGHAap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http headerEPSS 0.4%CVE-2020-36659HIGHIn Apache::Session::Browseable before 1.3.6, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backEPSS 0.4%CVE-2023-1664MEDIUMA flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverseEPSS 0.4%CVE-2024-22030HIGHRancher agents can be hijacked by taking over the Rancher Server URLEPSS 0.4%CVE-2017-3190—Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificaEPSS 0.4%CVE-2026-42013HIGHGnutls: gnutls: certificate validation bypass due to oversized subject alternative nameEPSS 0.4%