Falhas do tipo CWE-295

1.017 resultados

Validação inadequada de certificado SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou emitidos por autoridades não confiáveis. Isso permite que um atacante em posição de intermediário (man-in-the-middle) intercepte a comunicação criptografada e acesse dados sensíveis que deveriam estar protegidos.

Exemplo

Uma aplicação mobile conecta a uma API via HTTPS mas ignora erros de validação de certificado (ou desabilita a verificação para 'facilitar testes'). Um atacante na mesma rede WiFi consegue interceptar requisições, roubar tokens de autenticação ou credenciais do usuário.

Como mitigar

Sempre validar o certificado do servidor (hostname, cadeia de confiança, data de validade). Em desenvolvimento, use certificados válidos mesmo em ambientes de teste; nunca desabilite validação em produção. Considere certificate pinning para APIs críticas, fixando o certificado esperado na aplicação.

CVE-2022-1632—An Improper Certificate Validation attack was found in Openshift. A re-encrypt Route with destinationCACertificate explicitly set to the defEPSS 0.4%CVE-2021-1354MEDIUMCisco Unified Computing System Central Software Improper Certificate Validation VulnerabilityEPSS 0.4%CVE-2023-49247—Permission verification vulnerability in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentiaEPSS 0.4%CVE-2022-40147—A vulnerability has been identified in Industrial Edge Management (All versions < V1.5.1). The affected software does not properly validate EPSS 0.4%CVE-2024-28161MEDIUMIn Jenkins Delphix Plugin 3.0.1, a global option for administrators to enable or disable SSL/TLS certificate validation for Data Control TowEPSS 0.4%CVE-2025-32878CRITICALAn issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a WLAN. This function is EPSS 0.4%CVE-2026-82208HIGHwolfSSL CA-cache hit overrides callbackEPSS 0.4%CVE-2021-1277HIGHCisco Data Center Network Manager Certificate Validation VulnerabilitiesEPSS 0.4%CVE-2021-22511—Improper Certificate Validation vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affectsEPSS 0.4%CVE-2021-1276HIGHCisco Data Center Network Manager Certificate Validation VulnerabilitiesEPSS 0.4%CVE-2024-43201HIGHPlanet Fitness Workouts mobile apps do not properly validate TLS certificatesEPSS 0.4%CVE-2025-65753HIGHAn issue in the TLS certification mechanism of Guardian Gryphon v01.06.0006.22 allows attackers to execute commands as root.EPSS 0.4%CVE-2021-23167HIGHImproper certificate validation vulnerability in SMTP Client allows man-in-the-middle attack to retrieve sensitive information from the CommEPSS 0.4%CVE-2026-86881CRITICALA certificate validation issue was addressed with improved certificate validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 aEPSS 0.4%CVE-2022-1197MEDIUMWhen importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the keyEPSS 0.4%CVE-2026-61668HIGHDIRAC: Pilot code downloaded over unverified HTTPS connectionEPSS 0.4%CVE-2025-10548MEDIUMMissing Certificate Validation in CleverControl Installer Allows Remote Code ExecutionEPSS 0.4%CVE-2022-1834MEDIUMWhen displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird EPSS 0.4%CVE-2022-45419MEDIUMIf the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server that used that certifiEPSS 0.4%CVE-2025-24471MEDIUMAn Improper Certificate Validation vulnerability [CWE-295] in FortiOS version 7.6.1 and below, version 7.4.7 and below may allow an EAP veriEPSS 0.4%