Falhas do tipo CWE-295

1.020 resultados

Validação inadequada de certificado SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou emitidos por autoridades não confiáveis. Isso permite que um atacante em posição de intermediário (man-in-the-middle) intercepte a comunicação criptografada e acesse dados sensíveis que deveriam estar protegidos.

Exemplo

Uma aplicação mobile conecta a uma API via HTTPS mas ignora erros de validação de certificado (ou desabilita a verificação para 'facilitar testes'). Um atacante na mesma rede WiFi consegue interceptar requisições, roubar tokens de autenticação ou credenciais do usuário.

Como mitigar

Sempre validar o certificado do servidor (hostname, cadeia de confiança, data de validade). Em desenvolvimento, use certificados válidos mesmo em ambientes de teste; nunca desabilite validação em produção. Considere certificate pinning para APIs críticas, fixando o certificado esperado na aplicação.

CVE-2024-39771MEDIUMQBiC CLOUD CC-2L v1.1.30 and earlier and Safie One v1.8.2 and earlier do not properly validate certificates, which may allow a network-adjacEPSS 0.1%CVE-2026-87880MEDIUMSensitive information disclosure due to missing SSL certificate verification affecting one component. The following products are affected: AEPSS 0.1%CVE-2026-9758HIGHImproper Certificate Validation in S2OPCEPSS 0.1%CVE-2026-40539HIGHAn improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 andEPSS 0.1%CVE-2026-96375MEDIUMCloud - Critical - Remote code execution - SA-CONTRIB-2026-176EPSS 0.1%CVE-2019-25652HIGHUniFi Network Controller Improper Certificate Validation Leading to Credential Theft via MITMEPSS 0.1%CVE-2026-112652MEDIUMA logic issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, mEPSS 0.1%CVE-2025-9785HIGHMisconfigured certificate validation with self-signed certificates for Print DeployEPSS 0.1%CVE-2026-100701MEDIUMNodemailer 5.0.0 through 10.0.1 TLS servername Cache ConfusionEPSS 0.1%CVE-2026-120250MEDIUMOpenAlgo 1.0.0.29 before 2.0.3.1 Improper Certificate Validation in SMTP ConnectionsEPSS 0.1%CVE-2026-54548LOWkas: Persistent SSH Host Key Checking DisablementEPSS 0.1%CVE-2026-89135MEDIUMFailed X509_verify_cert leaves unverified CA in shared CertManagerEPSS 0.1%CVE-2026-16792HIGHGlobal TLS Certificate Validation Bypass in Lenovo XClarity OrchestratorEPSS 0.1%CVE-2026-0249MEDIUMGlobalProtect App: Certificate Validation Bypass VulnerabilitiesEPSS 0.1%CVE-2026-31798MEDIUMJumpServer Improper Certificate Validation in Custom SMS API ClientEPSS 0.1%CVE-2024-0042MEDIUMIn TBD of TBD, there is a possible confusion of OEM and DRM certificates due to improperly used crypto. This could lead to local bypass of DEPSS 0.1%CVE-2025-58127MEDIUMLack of TLS validation in plugin Dell Powerscale on Checkmk ExchangeEPSS 0.1%CVE-2025-58124MEDIUMLack of TLS validation in plugin check-mk-api on Checkmk ExchangeEPSS 0.1%CVE-2025-58126MEDIUMLack of TLS validation in plugin VMware vSAN on Checkmk ExchangeEPSS 0.1%CVE-2025-58123MEDIUMLack of TLS validation in plugin BGP Monitoring on Checkmk ExchangeEPSS 0.1%