Falhas do tipo CWE-295

856 resultados

Validação inadequada de certificado SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou emitidos por autoridades não confiáveis. Isso permite que um atacante em posição de intermediário (man-in-the-middle) intercepte a comunicação criptografada e acesse dados sensíveis que deveriam estar protegidos.

Exemplo

Uma aplicação mobile conecta a uma API via HTTPS mas ignora erros de validação de certificado (ou desabilita a verificação para 'facilitar testes'). Um atacante na mesma rede WiFi consegue interceptar requisições, roubar tokens de autenticação ou credenciais do usuário.

Como mitigar

Sempre validar o certificado do servidor (hostname, cadeia de confiança, data de validade). Em desenvolvimento, use certificados válidos mesmo em ambientes de teste; nunca desabilite validação em produção. Considere certificate pinning para APIs críticas, fixando o certificado esperado na aplicação.

CVE-2026-93601LOWrustls webpki 0.101.0 before 0.103.12 Name Constraint BypassEPSS 0.2%CVE-2023-6058HIGHHTTPS Certificate Validation Issue in Bitdefender Safepay (VA-11167)EPSS 0.2%CVE-2026-93600LOWrustls webpki Name Constraints URI Validation BypassEPSS 0.2%CVE-2026-60648HIGHVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions tEPSS 0.2%CVE-2025-46551MEDIUMJRuby-OpenSSL has hostname verification disabled by defaultEPSS 0.2%CVE-2026-63336MEDIUMRabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITMEPSS 0.2%CVE-2026-40974MEDIUMSpring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. AffecteEPSS 0.2%CVE-2024-12174LOWAn Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated, privileged attacker could interceEPSS 0.2%CVE-2025-52598MEDIUMInsufficient certificate validationEPSS 0.2%CVE-2026-4587MEDIUMHybridAuth SSL Curl.php certificate validationEPSS 0.2%CVE-2026-33542MEDIUMIncus does not verify combined fingerprint when downloading images from simplestreams serversEPSS 0.2%CVE-2025-13052HIGHAn improper certificates validation vulnerability was found in the Notification settings of ADMEPSS 0.2%CVE-2025-10539MEDIUMImproper TLS Certificate Validation RCE via Malicious Update in DeskTime Time Tracking AppEPSS 0.2%CVE-2026-3100HIGHAn improper certificate validation vulnerability was found in the FTP Backup on the ADM.EPSS 0.2%CVE-2026-32627HIGHcpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via ProxyEPSS 0.2%CVE-2026-76362HIGHImproper Certificate Validation through CyberArk Vault Privileged Access Manager in Splunk SOAREPSS 0.2%CVE-2026-35389HIGHBulwark Webmail S/MIME signature verification accepted self-signed certificatesEPSS 0.2%CVE-2024-8287HIGHAnbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent.EPSS 0.2%CVE-2025-0309MEDIUMNetskope Client Local Elevation of PrivilegesEPSS 0.2%CVE-2025-70045HIGHAn issue pertaining to CWE-295: Improper Certificate Validation was discovered in jxcore jxm master. The application disables TLS/SSL certifEPSS 0.2%