Falhas do tipo CWE-295

856 resultados

Validação inadequada de certificado SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou emitidos por autoridades não confiáveis. Isso permite que um atacante em posição de intermediário (man-in-the-middle) intercepte a comunicação criptografada e acesse dados sensíveis que deveriam estar protegidos.

Exemplo

Uma aplicação mobile conecta a uma API via HTTPS mas ignora erros de validação de certificado (ou desabilita a verificação para 'facilitar testes'). Um atacante na mesma rede WiFi consegue interceptar requisições, roubar tokens de autenticação ou credenciais do usuário.

Como mitigar

Sempre validar o certificado do servidor (hostname, cadeia de confiança, data de validade). Em desenvolvimento, use certificados válidos mesmo em ambientes de teste; nunca desabilite validação em produção. Considere certificate pinning para APIs críticas, fixando o certificado esperado na aplicação.

CVE-2026-39388LOWOpenBao's Certificate Authentication Allows Token Renewal With Different CertificateEPSS 0.1%CVE-2026-18257MEDIUMImproper Certificate Validation in S2OPCEPSS 0.1%CVE-2026-79967MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificEPSS 0.1%CVE-2025-30669MEDIUMZoom Workplace Clients - Improper Certificate ValidationEPSS 0.1%CVE-2026-39984MEDIUMSigstore Timestamp Authority has Improper Certificate Validation in verifierEPSS 0.1%CVE-2026-41859HIGHA network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secrEPSS 0.1%CVE-2026-31798MEDIUMJumpServer Improper Certificate Validation in Custom SMS API ClientEPSS 0.1%CVE-2026-84850MEDIUMImproper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 aEPSS 0.1%CVE-2024-38642LOWQuMagieEPSS 0.1%CVE-2026-18678MEDIUMKong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configuredEPSS 0.1%CVE-2026-41012HIGHBOSH vSphere CPI Improper Cert ValidationEPSS 0.1%CVE-2026-66406LOWDEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obEPSS 0.1%CVE-2026-44305MEDIUMLemur: LDAP TLS certificate verification globally disabled enables credential interceptionEPSS 0.1%CVE-2026-20500MEDIUMIn Modem, there is a possible system crash due to improper input validation. This could lead to local denial of service with User execution EPSS 0.1%CVE-2025-12893LOWImproper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB ServerEPSS 0.1%CVE-2026-87872MEDIUMCommunity.general: community.general: ocapi module_utils (ocapi_command, ocapi_info) hardcode validate_certs=false with no override, enabling tls man-in-the-middle and credential disclosureEPSS 0.1%CVE-2026-90452MEDIUMRequests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify tEPSS 0.1%CVE-2025-6026LOWAn improper certificate validation vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow a user capable ofEPSS 0.1%CVE-2026-54548LOWkas: Persistent SSH Host Key Checking DisablementEPSS 0.1%CVE-2026-46734HIGHDell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Certificate Validation vulnerability. A low priviEPSS 0.1%