Falhas do tipo CWE-295

1.020 resultados

Validação inadequada de certificado SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou emitidos por autoridades não confiáveis. Isso permite que um atacante em posição de intermediário (man-in-the-middle) intercepte a comunicação criptografada e acesse dados sensíveis que deveriam estar protegidos.

Exemplo

Uma aplicação mobile conecta a uma API via HTTPS mas ignora erros de validação de certificado (ou desabilita a verificação para 'facilitar testes'). Um atacante na mesma rede WiFi consegue interceptar requisições, roubar tokens de autenticação ou credenciais do usuário.

Como mitigar

Sempre validar o certificado do servidor (hostname, cadeia de confiança, data de validade). Em desenvolvimento, use certificados válidos mesmo em ambientes de teste; nunca desabilite validação em produção. Considere certificate pinning para APIs críticas, fixando o certificado esperado na aplicação.

CVE-2026-108013MEDIUMHCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID)EPSS 0.2%CVE-2026-66406LOWDEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obEPSS 0.2%CVE-2026-92868MEDIUMAn improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificaEPSS 0.2%CVE-2025-13833HIGHInsecure TLS Fingerprint Validation in ForeScout SecureConnector Configuration Enables Remote Code ExecutionEPSS 0.1%CVE-2026-33248MEDIUMNATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matchingEPSS 0.1%CVE-2025-70044MEDIUMAn issue pertaining to CWE-295: Improper Certificate Validation was discovered in fofolee uTools-quickcommand 5.0.3.EPSS 0.1%CVE-2026-15683HIGHLorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation VulnerabilityEPSS 0.1%CVE-2024-4762HIGHAn improper validation vulnerability was reported in the firmware update mechanism of LADM and LDCC that could allow a local attacker to escEPSS 0.1%CVE-2026-17309HIGHMultiple Vulnerabilities in IBM API ConnectEPSS 0.1%CVE-2026-4434HIGHImproper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-the-middle attack viEPSS 0.1%CVE-2026-44312MEDIUMcss_parser allows to MITM included https css urlsEPSS 0.1%CVE-2025-64432MEDIUMKubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation LayerEPSS 0.1%CVE-2026-107318HIGH@fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transportsEPSS 0.1%CVE-2026-17308MEDIUMMultiple Vulnerabilities in IBM API ConnectEPSS 0.1%CVE-2026-116641HIGHThe DB Tools trust certificates issued by recoverable eMudhra intermediate CAsEPSS 0.1%CVE-2026-115930HIGHMongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAsEPSS 0.1%CVE-2025-60022LOWImproper certificate validation vulnerability exists in 'デジラアプリ' App for iOS prior to ver.80.10.00. If this vulnerability is exploited, a maEPSS 0.1%CVE-2025-58781MEDIUMWTW-EAGLE App does not properly validate server certificates, which may allow a man-in-the-middle attacker to monitor encrypted traffic.EPSS 0.1%CVE-2026-44305MEDIUMLemur: LDAP TLS certificate verification globally disabled enables credential interceptionEPSS 0.1%CVE-2025-1001MEDIUMMedixant RadiAnt DICOM Viewer Improper Certificate ValidationEPSS 0.1%