Falhas do tipo CWE-295

1.020 resultados

Validação inadequada de certificado SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou emitidos por autoridades não confiáveis. Isso permite que um atacante em posição de intermediário (man-in-the-middle) intercepte a comunicação criptografada e acesse dados sensíveis que deveriam estar protegidos.

Exemplo

Uma aplicação mobile conecta a uma API via HTTPS mas ignora erros de validação de certificado (ou desabilita a verificação para 'facilitar testes'). Um atacante na mesma rede WiFi consegue interceptar requisições, roubar tokens de autenticação ou credenciais do usuário.

Como mitigar

Sempre validar o certificado do servidor (hostname, cadeia de confiança, data de validade). Em desenvolvimento, use certificados válidos mesmo em ambientes de teste; nunca desabilite validação em produção. Considere certificate pinning para APIs críticas, fixando o certificado esperado na aplicação.

CVE-2025-58123MEDIUMLack of TLS validation in plugin BGP Monitoring on Checkmk ExchangeEPSS 0.1%CVE-2025-1002MEDIUMMicroDicom DICOM Viewer Improper Certificate ValidationEPSS 0.1%CVE-2025-30669MEDIUMZoom Workplace Clients - Improper Certificate ValidationEPSS 0.1%CVE-2026-45170HIGHIdira Vendor PAM - Self-Hosted Connector: Potential Security Bypass due to Incomplete TLS Certificate ValidationEPSS 0.1%CVE-2026-105217LOWCockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.phpEPSS 0.1%CVE-2026-44363MEDIUMUnsafe remote resource fetching in expansion misp-modulesEPSS 0.1%CVE-2026-39388LOWOpenBao's Certificate Authentication Allows Token Renewal With Different CertificateEPSS 0.1%CVE-2026-41012HIGHBOSH vSphere CPI Improper Cert ValidationEPSS 0.1%CVE-2025-12893LOWImproper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB ServerEPSS 0.1%CVE-2026-39984MEDIUMSigstore Timestamp Authority has Improper Certificate Validation in verifierEPSS 0.1%CVE-2026-41859HIGHA network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secrEPSS 0.1%CVE-2026-90452MEDIUMImproper certificate validation in MalcolmEPSS 0.1%CVE-2026-117681HIGHKonflux-ci: ui proxy skips backend tls verification on non-openshift clusters, leaking a token that can impersonate anyoneEPSS 0.1%CVE-2024-38642LOWQuMagieEPSS 0.1%CVE-2026-87425HIGHAn unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorizedEPSS 0.1%CVE-2025-6026LOWAn improper certificate validation vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow a user capable ofEPSS 0.1%CVE-2026-1068MEDIUMAn improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of interceptinEPSS 0.1%CVE-2026-1501LOWIBM Concert Software Improper Certificate ValidationEPSS 0.1%CVE-2026-46734HIGHDell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Certificate Validation vulnerability. A low priviEPSS 0.1%CVE-2026-118040HIGHImproper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessingEPSS 0.1%