Falhas do tipo CWE-295

852 resultados

Validação inadequada de certificado SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou emitidos por autoridades não confiáveis. Isso permite que um atacante em posição de intermediário (man-in-the-middle) intercepte a comunicação criptografada e acesse dados sensíveis que deveriam estar protegidos.

Exemplo

Uma aplicação mobile conecta a uma API via HTTPS mas ignora erros de validação de certificado (ou desabilita a verificação para 'facilitar testes'). Um atacante na mesma rede WiFi consegue interceptar requisições, roubar tokens de autenticação ou credenciais do usuário.

Como mitigar

Sempre validar o certificado do servidor (hostname, cadeia de confiança, data de validade). Em desenvolvimento, use certificados válidos mesmo em ambientes de teste; nunca desabilite validação em produção. Considere certificate pinning para APIs críticas, fixando o certificado esperado na aplicação.

CVE-2022-32152HIGHSplunk Enterprise lacked TLS cert validation for Splunk-to-Splunk communication by defaultEPSS 0.9%CVE-2020-8156—A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack.EPSS 0.9%CVE-2020-15133HIGHMissing TLS certificate verification in Faye WebsocketEPSS 0.9%CVE-2026-11814MEDIUMCommand injection vulnerability in certain NETGEAR Nighthawk and Orbi routersEPSS 0.9%CVE-2022-20814HIGHCisco Expressway Series and Cisco TelePresence VCS Improper Certificate Validation VulnerabilityEPSS 0.9%CVE-2020-3155HIGHCisco Intelligent Proximity SSL Certificate Validation VulnerabilityEPSS 0.9%CVE-2026-18129HIGHCleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticatEPSS 0.9%CVE-2019-20461CRITICALAn issue was discovered on Alecto IVM-100 2019-11-12 devices. The device uses a custom UDP protocol to start and control video and audio serEPSS 0.9%CVE-2019-1683MEDIUMCisco SPA112, SPA525, and SPA5x5 Series IP Phones Certificate Validation VulnerabilityEPSS 0.9%CVE-2020-2033MEDIUMGlobalProtect App: Missing certificate validation vulnerability can disclose pre-logon authentication cookieEPSS 0.9%CVE-2019-1948MEDIUMCisco Webex Meetings Mobile (iOS) SSL Certificate Validation VulnerabilityEPSS 0.9%CVE-2020-15134HIGHMissing TLS certificate verification in FayeEPSS 0.9%CVE-2023-32330HIGHIBM Security Verify Access man in the middleEPSS 0.9%CVE-2021-32728MEDIUMEnd-to-end encryption device setup did not verify public keyEPSS 0.9%CVE-2019-1659HIGHCisco Prime Infrastructure Certificate Validation VulnerabilityEPSS 0.8%CVE-2025-3463CRITICAL"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation vulneEPSS 0.8%CVE-2021-21959HIGHA misconfiguration exists in the MQTTS functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. This misconfiguration significantly EPSS 0.8%CVE-2022-3761—OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intEPSS 0.8%CVE-2018-0434—Cisco SD-WAN Solution Certificate Validation VulnerabilityEPSS 0.8%CVE-2022-29222MEDIUMImproper Certificate Validation in Pion DTLSEPSS 0.8%