Falhas do tipo CWE-295

1.020 resultados

Validação inadequada de certificado SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou emitidos por autoridades não confiáveis. Isso permite que um atacante em posição de intermediário (man-in-the-middle) intercepte a comunicação criptografada e acesse dados sensíveis que deveriam estar protegidos.

Exemplo

Uma aplicação mobile conecta a uma API via HTTPS mas ignora erros de validação de certificado (ou desabilita a verificação para 'facilitar testes'). Um atacante na mesma rede WiFi consegue interceptar requisições, roubar tokens de autenticação ou credenciais do usuário.

Como mitigar

Sempre validar o certificado do servidor (hostname, cadeia de confiança, data de validade). Em desenvolvimento, use certificados válidos mesmo em ambientes de teste; nunca desabilite validação em produção. Considere certificate pinning para APIs críticas, fixando o certificado esperado na aplicação.

CVE-2024-11621HIGHMissing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modifEPSS 0.2%CVE-2024-23970MEDIUMChargePoint Home Flex Improper Certificate ValidationEPSS 0.2%CVE-2026-80125MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificEPSS 0.2%CVE-2024-33612MEDIUMBIG-IP Next Central Manager vulnerabilityEPSS 0.2%CVE-2025-59353HIGHManager generates mTLS certificates for arbitrary IP addressesEPSS 0.2%CVE-2026-84975HIGHPJSIP: TLS server identity (hostname) verification bypass via embedded NUL in certificate SubjectAltName (OpenSSL and GnuTLS backends)EPSS 0.2%CVE-2026-103602HIGHName constraints bypass via trailing dot in rfc822Name, dNSName and URI hostsEPSS 0.2%CVE-2026-115996MEDIUMUnitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validationEPSS 0.2%CVE-2026-91881CRITICALDell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transporEPSS 0.2%CVE-2022-45856MEDIUMAn improper certificate validation vulnerability [CWE-295] in FortiClientWindows 6.4 all versions, 7.0.0 through 7.0.7, FortiClientMac 6.4 aEPSS 0.2%CVE-2025-12765HIGHpgAdmin 4: LDAP authentication flow vulnerable to TLS certificate verification bypass.EPSS 0.2%CVE-2026-77816MEDIUMIBM WebSphere Application Server Liberty Improper Certificate ValidationEPSS 0.2%CVE-2024-37311HIGHCollabora Online's remote host TLS certificates are not fully verifiedEPSS 0.2%CVE-2026-67231CRITICALRabbitMQ: Trust-store whitelist by Issuer+Serial onlyEPSS 0.2%CVE-2026-63650LOWOpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 usernaEPSS 0.2%CVE-2024-50691HIGHSunGrow iSolarCloud Android app V2.1.6.20241104 and prior suffers from Missing SSL Certificate Validation. The app explicitly ignores certifEPSS 0.2%CVE-2026-15937MEDIUMAgent receiver certificate confusion allows authentication with a certificate issued for another endpointEPSS 0.2%CVE-2026-34073LOWcryptography has incomplete DNS name constraint enforcement on peer namesEPSS 0.2%CVE-2025-0239MEDIUMAlt-Svc ALPN validation failure when redirectedEPSS 0.2%CVE-2025-40744HIGHA vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 11). Affected applications do not properly validate cEPSS 0.2%