Falhas do tipo CWE-295

1.020 resultados

Validação inadequada de certificado SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou emitidos por autoridades não confiáveis. Isso permite que um atacante em posição de intermediário (man-in-the-middle) intercepte a comunicação criptografada e acesse dados sensíveis que deveriam estar protegidos.

Exemplo

Uma aplicação mobile conecta a uma API via HTTPS mas ignora erros de validação de certificado (ou desabilita a verificação para 'facilitar testes'). Um atacante na mesma rede WiFi consegue interceptar requisições, roubar tokens de autenticação ou credenciais do usuário.

Como mitigar

Sempre validar o certificado do servidor (hostname, cadeia de confiança, data de validade). Em desenvolvimento, use certificados válidos mesmo em ambientes de teste; nunca desabilite validação em produção. Considere certificate pinning para APIs críticas, fixando o certificado esperado na aplicação.

CVE-2026-41714MEDIUMIn Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManagerEPSS 0.1%CVE-2026-77707MEDIUMTLS Certificate Validation Disabled for Keycloak Connections in HAVELSAN's Liman Render EngineEPSS 0.1%CVE-2026-121624HIGHNanosystems Supremo before 5.0.2.3874 Improper TLS Certificate ValidationEPSS 0.1%CVE-2026-8497HIGHImproper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on AndrEPSS 0.1%CVE-2024-32865MEDIUMexacqVison - TLS certificate validationEPSS 0.1%CVE-2026-78556HIGHA vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validEPSS 0.1%CVE-2026-2748HIGHS/MIME Certificate Subject WhitespaceEPSS 0.1%CVE-2025-26478LOWDell ECS version 3.8.1.4 and prior contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent netwoEPSS 0.1%CVE-2026-102671MEDIUMJoyland AI WebView accepts invalid SSL certificatesEPSS 0.1%CVE-2025-2183MEDIUMGlobalProtect App: Improper Certificate Validation Leads to Privilege EscalationEPSS 0.1%CVE-2025-8393HIGHDreame Technology iOS and Android Mobile Applications Improper Certificate ValidationEPSS 0.1%CVE-2026-13327HIGHImproper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positiEPSS 0.1%CVE-2026-89133MEDIUMNameConstraints not enforced across unconstrained intermediate CAEPSS 0.1%CVE-2026-20323HIGHCisco Secure Firewall Management Center and Secure Firewall Threat Defense Software sftunnel Unauthorized Authentication Bypass VulnerabilityEPSS 0.1%CVE-2026-45175HIGHIdira Endpoint Privilege Manager Agent: Security Control and Cryptographic Validation Bypass in Internal Agent Validation ProcessesEPSS 0.1%CVE-2026-89102HIGHOCSP stapling v2 multi accepts non-CA chain certificates as issuersEPSS 0.1%CVE-2025-65083LOWGoSign Desktop through 2.4.1 disables TLS certificate validation when configured to use a proxy server. This can be problematic if the GoSigEPSS 0.1%CVE-2026-18678MEDIUMKong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configuredEPSS 0.1%CVE-2021-22278MEDIUMCertificate verification vulnerability in Update Manager of PCM600 Engineering ToolEPSS 0.1%CVE-2026-8367MEDIUMaria2c Improper Certificate ValidationEPSS 0.1%