Falhas do tipo CWE-295

856 resultados

Validação inadequada de certificado SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou emitidos por autoridades não confiáveis. Isso permite que um atacante em posição de intermediário (man-in-the-middle) intercepte a comunicação criptografada e acesse dados sensíveis que deveriam estar protegidos.

Exemplo

Uma aplicação mobile conecta a uma API via HTTPS mas ignora erros de validação de certificado (ou desabilita a verificação para 'facilitar testes'). Um atacante na mesma rede WiFi consegue interceptar requisições, roubar tokens de autenticação ou credenciais do usuário.

Como mitigar

Sempre validar o certificado do servidor (hostname, cadeia de confiança, data de validade). Em desenvolvimento, use certificados válidos mesmo em ambientes de teste; nunca desabilite validação em produção. Considere certificate pinning para APIs críticas, fixando o certificado esperado na aplicação.

CVE-2025-22486HIGHFile Station 5EPSS 0.3%CVE-2025-54607HIGHAuthentication management vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerability may affect service confiEPSS 0.3%CVE-2022-42131MEDIUMCertain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers. This EPSS 0.3%CVE-2024-40702HIGHIBM Cognos Controller improper certificate validationEPSS 0.3%CVE-2026-35560CRITICALImproper certificate validation in identity provider connection components in Amazon Athena ODBC driverEPSS 0.3%CVE-2025-11633MEDIUMTomofun Furbo 360/Furbo Mini HTTP Traffic collect_logs.sh upload_file_to_s3 certificate validationEPSS 0.3%CVE-2026-22093CRITICALAdversary-in-the-Middle (AitM) attack vulnerability in EVbee Service appEPSS 0.3%CVE-2017-7932—An improper certificate validation issue was discovered in NXP i.MX 28 i.MX 50, i.MX 53, i.MX 7Solo i.MX 7Dual Vybrid VF3xx, Vybrid VF5xx, VEPSS 0.3%CVE-2026-55436HIGHCoder's AI Bridge Proxy skips TLS certificate verification in default configurationEPSS 0.3%CVE-2026-48934MEDIUMA flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supporteEPSS 0.3%CVE-2022-43892LOWIBM Security Verify Privilege information disclosureEPSS 0.3%CVE-2025-10699MEDIUMA vulnerability was reported in the Lenovo LeCloud client application that, under certain conditions, could allow information disclosure.EPSS 0.3%CVE-2022-48186MEDIUMA certificate validation vulnerability exists in the Baiying Android application which could lead to information disclosure.EPSS 0.3%CVE-2023-50314MEDIUMIBM WebSphere Application Server Libery information disclosureEPSS 0.3%CVE-2025-7390CRITICALBypass the client certificate trust check of an opc.https server while only secure communication is allowedEPSS 0.3%CVE-2026-44700HIGHElixir WebRTC: Missing DTLS peer fingerprint validation in ex_webrtc client-role handshakeEPSS 0.3%CVE-2026-53475CRITICALAssisted-migration-agent: tls verification disabled on all vcenter connectionsEPSS 0.3%CVE-2023-4801HIGHITM MacOS Agent Improper Certificate ValidationEPSS 0.3%CVE-2026-1778HIGHTLS disabled by default in select aws/sagemaker-python-sdk configurationsEPSS 0.3%CVE-2026-32992HIGHSSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and captureEPSS 0.3%