Falhas do tipo CWE-295

1.020 resultados

Validação inadequada de certificado SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou emitidos por autoridades não confiáveis. Isso permite que um atacante em posição de intermediário (man-in-the-middle) intercepte a comunicação criptografada e acesse dados sensíveis que deveriam estar protegidos.

Exemplo

Uma aplicação mobile conecta a uma API via HTTPS mas ignora erros de validação de certificado (ou desabilita a verificação para 'facilitar testes'). Um atacante na mesma rede WiFi consegue interceptar requisições, roubar tokens de autenticação ou credenciais do usuário.

Como mitigar

Sempre validar o certificado do servidor (hostname, cadeia de confiança, data de validade). Em desenvolvimento, use certificados válidos mesmo em ambientes de teste; nunca desabilite validação em produção. Considere certificate pinning para APIs críticas, fixando o certificado esperado na aplicação.

CVE-2025-53869MEDIUMMultiple MFPs provided by Brother Industries, Ltd. does not properly validate server certificates, which may allow a man-in-the-middle attacEPSS 0.2%CVE-2024-6219LOWMark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restEPSS 0.2%CVE-2026-102508CRITICALApache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgradeEPSS 0.2%CVE-2026-57289MEDIUMJenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for coEPSS 0.2%CVE-2024-48865HIGHQTS, QuTS heroEPSS 0.2%CVE-2026-109423CRITICALNetEase Cloud Music TLS Certificate Validation BypassEPSS 0.2%CVE-2026-61813LOWModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::downloadEPSS 0.2%CVE-2026-18257MEDIUMImproper Certificate Validation in S2OPCEPSS 0.2%CVE-2026-79967MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificEPSS 0.2%CVE-2026-35207MEDIUMdeepinid plugin in dde-control-center is configured to skip TLS certificate verification when downloading avatar from remote serverEPSS 0.2%CVE-2026-22250LOWwlc can skip SSL verificationEPSS 0.2%CVE-2026-24935MEDIUMAn improper certificate validation vulnerability was found in a third-party NAT traversal module.EPSS 0.2%CVE-2026-48437MEDIUMCAI Content Credentials | Improper Certificate Validation (CWE-295)EPSS 0.2%CVE-2025-8476HIGHAlpine iLX-507 TIDAL Improper Certificate Validation VulnerabilityEPSS 0.2%CVE-2026-85087MEDIUMApache Thrift: Python ≥3.12 host-name check silently becomes a no-opEPSS 0.2%CVE-2026-2368HIGHAn improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of interceptinEPSS 0.2%CVE-2023-50179MEDIUMAn improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2 all versions, 7.1 all versions, 7.0 all versions may allowEPSS 0.2%CVE-2026-4396HIGHImproper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attacker to perform a man-in-EPSS 0.2%CVE-2026-92868MEDIUMAn improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificaEPSS 0.2%CVE-2026-87733MEDIUMAn issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets acceEPSS 0.2%