Falhas do tipo CWE-295

1.020 resultados

Validação inadequada de certificado SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou emitidos por autoridades não confiáveis. Isso permite que um atacante em posição de intermediário (man-in-the-middle) intercepte a comunicação criptografada e acesse dados sensíveis que deveriam estar protegidos.

Exemplo

Uma aplicação mobile conecta a uma API via HTTPS mas ignora erros de validação de certificado (ou desabilita a verificação para 'facilitar testes'). Um atacante na mesma rede WiFi consegue interceptar requisições, roubar tokens de autenticação ou credenciais do usuário.

Como mitigar

Sempre validar o certificado do servidor (hostname, cadeia de confiança, data de validade). Em desenvolvimento, use certificados válidos mesmo em ambientes de teste; nunca desabilite validação em produção. Considere certificate pinning para APIs críticas, fixando o certificado esperado na aplicação.

CVE-2026-121147HIGHSecurity Misconfiguration Vulnerability in Tata Motors iRA and iRA.ev mobile applicationEPSS 0.1%CVE-2026-79975MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificEPSS 0.1%CVE-2026-92543HIGHDocker Engine insecure-registry fallback via malicious DNS responsesEPSS 0.1%CVE-2026-0392HIGHeParakstītājs 3.0 for Windows – remote code execution via unauthenticated auto-updateEPSS 0.1%CVE-2026-41022MEDIUMEaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness toEPSS 0.1%CVE-2024-14024LOWVideo StationEPSS 0.1%CVE-2025-32745MEDIUMDell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Improper Certificate Validation vulnerability. An unauthenticated attacker with adEPSS 0.1%CVE-2026-91897MEDIUMDell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Certificate Validation vulnerability. A high privilegEPSS 0.1%CVE-2023-21358HIGHIn UWB Google, there is a possible way for a malicious app to masquerade as system app com.android.uwb.resources due to improperly used crypEPSS 0.1%CVE-2026-19377MEDIUMImproper certificate validation in Cato Client tunnel handshakeEPSS 0.1%CVE-2026-73594MEDIUMDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains an Improper Certificate ValEPSS 0.1%CVE-2026-67270HIGHDell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-serverEPSS 0.1%CVE-2024-42186LOWHCL BigFix Patch Download Plug-ins are affected by an insecure protocol supportEPSS 0.1%CVE-2026-16754MEDIUMA potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese maEPSS 0.1%CVE-2026-12374MEDIUMImproper XPC caller certificate validation and TOCTOU race condition in macOS PrivilegedHelperToolEPSS 0.1%CVE-2026-10726MEDIUMCato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validationEPSS 0.1%CVE-2026-24508LOWDell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Certificate Validation vulnerability. A low privilegeEPSS 0.1%CVE-2026-14434MEDIUMIBM Turbonomic kubeturbo agent used by IBM Turbonomic Application Resource Management is affected by vulnerabilityEPSS —CVE-2026-14435MEDIUMIBM Turbonomic kubeturbo agent used by IBM Turbonomic Application Resource Management is affected by a vulnerabilityEPSS —CVE-2026-14375MEDIUMThe following vulnerabilities that can affect IBM Storage Scale Install Toolkit are now fixed in 5.2.3.9 or higher and 6.0.1.1 or higherEPSS —