Falhas do tipo CWE-295

1.020 resultados

Validação inadequada de certificado SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou emitidos por autoridades não confiáveis. Isso permite que um atacante em posição de intermediário (man-in-the-middle) intercepte a comunicação criptografada e acesse dados sensíveis que deveriam estar protegidos.

Exemplo

Uma aplicação mobile conecta a uma API via HTTPS mas ignora erros de validação de certificado (ou desabilita a verificação para 'facilitar testes'). Um atacante na mesma rede WiFi consegue interceptar requisições, roubar tokens de autenticação ou credenciais do usuário.

Como mitigar

Sempre validar o certificado do servidor (hostname, cadeia de confiança, data de validade). Em desenvolvimento, use certificados válidos mesmo em ambientes de teste; nunca desabilite validação em produção. Considere certificate pinning para APIs críticas, fixando o certificado esperado na aplicação.

CVE-2022-42131MEDIUMCertain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers. This EPSS 0.3%CVE-2026-84736HIGHIn the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disablesEPSS 0.3%CVE-2026-1530HIGHFog-kubevirt: fog-kubevirt: man-in-the-middle vulnerability due to disabled certificate validationEPSS 0.3%CVE-2026-118682HIGHClashMi through 1.0.32.1801 Disabled TLS Certificate Validation Enables Update MITMEPSS 0.3%CVE-2024-47119MEDIUMIBM Storage Defender - Resiliency Service improper certificate validationEPSS 0.3%CVE-2026-105031CRITICALApache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.EPSS 0.3%CVE-2025-6037MEDIUMVault Certificate Auth Method Did Not Validate Common Name For Non-CA CertificatesEPSS 0.3%CVE-2026-41016MEDIUMApache Airflow Providers SMTP: No certificate validation on SMTP STARTTLS connections in SMTP providerEPSS 0.3%CVE-2024-28021HIGHA vulnerability exists in the FOXMAN-UN/UNEM server that affects the message queueing mechanism’s certificate validation. If exploited an aEPSS 0.3%CVE-2025-65830CRITICALDue to a lack of certificate validation, all traffic from the mobile application can be intercepted. As a result, an adversary located "upstEPSS 0.3%CVE-2026-57826MEDIUMAn issue was discovered in openHiTLS 0.2.0 through 0.3.2. In the X.509 certificate chain verification, the basic constraints extension and CEPSS 0.3%CVE-2023-50315MEDIUMIBM WebSphere Application Server information disclosureEPSS 0.3%CVE-2026-115693CRITICALCustom cacerts or cacertfile do not restrict trust to the pinned CA in hackneyEPSS 0.3%CVE-2026-9258HIGHImproper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlierEPSS 0.3%CVE-2025-7395CRITICALDomain Name Validation Bypass with Apple Native Certificate ValidationEPSS 0.3%CVE-2025-67229CRITICALAn improper certificate validation vulnerability exists in ToDesktop Builder v0.32.1 This vulnerability allows an unauthenticated, on-path aEPSS 0.3%CVE-2023-38686CRITICALSydent does not verify email server certificatesEPSS 0.3%CVE-2025-50944HIGHAn issue was discovered in the method push.lite.avtech.com.MySSLSocketFactoryNew.checkServerTrusted in AVTECH EagleEyes 2.0.0. The custom X5EPSS 0.3%CVE-2024-40702HIGHIBM Cognos Controller improper certificate validationEPSS 0.3%CVE-2026-54919HIGHcpp-httplib: TLS certificate chain verification bypassed for IP-literal hosts on Mbed TLS and wolfSSL backendsEPSS 0.3%