Falhas do tipo CWE-295

1.020 resultados

Validação inadequada de certificado SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou emitidos por autoridades não confiáveis. Isso permite que um atacante em posição de intermediário (man-in-the-middle) intercepte a comunicação criptografada e acesse dados sensíveis que deveriam estar protegidos.

Exemplo

Uma aplicação mobile conecta a uma API via HTTPS mas ignora erros de validação de certificado (ou desabilita a verificação para 'facilitar testes'). Um atacante na mesma rede WiFi consegue interceptar requisições, roubar tokens de autenticação ou credenciais do usuário.

Como mitigar

Sempre validar o certificado do servidor (hostname, cadeia de confiança, data de validade). Em desenvolvimento, use certificados válidos mesmo em ambientes de teste; nunca desabilite validação em produção. Considere certificate pinning para APIs críticas, fixando o certificado esperado na aplicação.

CVE-2022-3913MEDIUMRapid7 Nexpose Certificate Validation IssueEPSS 0.3%CVE-2024-6001HIGHAn improper certificate validation vulnerability was reported in LADM that could allow a network attacker with the ability to redirect an upEPSS 0.3%CVE-2024-1052HIGHBoundary Vulnerable to Session Hijacking Through TLS Certificate TamperingEPSS 0.3%CVE-2025-70029HIGHAn issue in Sunbird-Ed SunbirdEd-portal v1.13.4 allows attackers to obtain sensitive information. The application disables TLS/SSL certificaEPSS 0.3%CVE-2026-112105MEDIUMGlitterWare Passy TLS main.dart MyHttpOverrides certificate validationEPSS 0.3%CVE-2023-50356MEDIUMImproper Certificate Validation in AREAL Topkapi Vision (Server)EPSS 0.3%CVE-2026-100123HIGHCAI Content Credentials | Improper Certificate Validation (CWE-295)EPSS 0.3%CVE-2026-100122HIGHCAI Content Credentials | Improper Certificate Validation (CWE-295)EPSS 0.3%CVE-2026-100121HIGHCAI Content Credentials | Improper Certificate Validation (CWE-295)EPSS 0.3%CVE-2021-21548HIGH Dell EMC Unisphere for PowerMax versions before 9.1.0.27, Dell EMC Unisphere for PowerMax Virtual Appliance versions before 9.1.0.27, and PEPSS 0.3%CVE-2026-121638CRITICALWatchGuard AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle AttacksEPSS 0.3%CVE-2026-84081HIGHIBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.3%CVE-2026-1531HIGHForeman-kubevirt: foreman_kubevirt: man-in-the-middle due to insecure default ssl verificationEPSS 0.3%CVE-2025-7095MEDIUMComodo Internet Security Premium Update certificate validationEPSS 0.3%CVE-2026-32253CRITICALSunshine: Authentication bypass via improper client certificate validationEPSS 0.3%CVE-2019-3875MEDIUMA vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRLEPSS 0.3%CVE-2024-28872HIGHIncorrect TLS certificate validation can lead to escalated privilegesEPSS 0.3%CVE-2026-118697CRITICALIn JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 20EPSS 0.3%CVE-2026-56624HIGHApache MINA SSHD: SSH certificate options lack validationsEPSS 0.3%CVE-2024-55581HIGHWhen AdaCore Ada Web Server 25.0.0 is linked with GnuTLS, the default behaviour of AWS.Client is vulnerable to a man-in-the-middle attack beEPSS 0.3%