CWE-295 · Improper Certificate Validation (page 10)
Page 10 of 17 — CVEs classified under CWE-295, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-21959 | High | 8.1 | 2022-02-04 | A misconfiguration exists in the MQTTS functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. This misconfiguration significantly simplifies a man-in… |
CVE-2021-40855 | Critical | 9.8 | 2022-01-21 | The EU Technical Specifications for Digital COVID Certificates before 1.1 mishandle certificate governance. A non-production public key certificate could have… |
CVE-2022-22156 | Medium | 6.5 | 2022-01-19 | An Improper Certificate Validation weakness in the Juniper Networks Junos OS allows an attacker to perform Person-in-the-Middle (PitM) attacks when a system sc… |
CVE-2022-21836 | High | 7.8 | 2022-01-11 | Windows Certificate Spoofing Vulnerability |
CVE-2021-44273 | High | 7.4 | 2021-12-23 | e2guardian v5.4.x <= v5.4.3r is affected by missing SSL certificate validation in the SSL MITM engine. In standalone mode (i.e., acting as a proxy or a transpa… |
CVE-2021-41028 | High | 8.2 | 2021-12-16 | A combination of a use of hard-coded cryptographic key vulnerability [CWE-321] in FortiClientEMS 7.0.1 and below, 6.4.6 and below and an improper certificate v… |
CVE-2021-43882 | Critical | 9.0 | 2021-12-15 | Microsoft Defender for IoT Remote Code Execution Vulnerability |
CVE-2021-44549 | High | 7.4 | 2021-12-14 | Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the… |
CVE-2021-42027 | High | 7.4 | 2021-12-14 | A vulnerability has been identified in SINUMERIK Edge (All versions < V3.2). The affected software does not properly validate the server certificate when initi… |
CVE-2020-4496 | Medium | 5.9 | 2021-12-13 | The IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x server connection to an IBM Spectrum Protect Plus workload agent is subject to a man-in-the-middle atta… |
CVE-2021-31747 | Medium | 4.8 | 2021-12-10 | Missing SSL Certificate Validation issue exists in Pluck 4.7.15 in update_applet.php, which could lead to man-in-the-middle attacks. |
CVE-2021-34599 | High | 7.4 | 2021-12-01 | Affected versions of CODESYS Git in Versions prior to V1.1.0.0 lack certificate validation in HTTPS handshakes. CODESYS Git does not implement certificate vali… |
CVE-2021-40831 | Medium | 6.3 | 2021-11-23 | The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on macO… |
CVE-2021-40830 | Medium | 6.3 | 2021-11-23 | The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on Unix… |
CVE-2021-40829 | Medium | 6.3 | 2021-11-23 | Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1), C++ (versions prior to 1.12.7) and N… |
CVE-2021-40828 | Medium | 6.3 | 2021-11-23 | Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and… |
CVE-2021-3935 | High | 8.1 | 2021-11-22 | When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established… |
CVE-2021-23167 | High | 8.1 | 2021-11-18 | Improper certificate validation vulnerability in SMTP Client allows man-in-the-middle attack to retrieve sensitive information from the Command Centre Server… |
CVE-2021-23162 | High | 7.7 | 2021-11-18 | Improper validation of the cloud certificate chain in Mobile Connect allows man-in-the-middle attack to impersonate the legitimate Command Centre Server. This… |
CVE-2021-23155 | Critical | 9.0 | 2021-11-18 | Improper validation of the cloud certificate chain in Mobile Client allows man-in-the-middle attack to impersonate the legitimate Command Centre Server. This i… |
CVE-2021-26320 | Medium | 5.5 | 2021-11-16 | Insufficient validation of the AMD SEV Signing Key (ASK) in the SEND_START command in the SEV Firmware may allow a local authenticated attacker to perform a de… |
CVE-2021-41019 | Low | 3.5 | 2021-11-02 | An improper validation of certificate with host mismatch [CWE-297] vulnerability in FortiOS versions 6.4.6 and below may allow the connection to a malicious LD… |
CVE-2021-29737 | High | 7.5 | 2021-11-02 | IBM InfoSphere Data Flow Designer Engine (IBM InfoSphere Information Server 11.7 ) component has improper validation of the REST API server certificate. IBM X-… |
CVE-2021-22278 | Medium | 6.7 | 2021-10-28 | A certificate validation vulnerability in PCM600 Update Manager allows attacker to get unwanted software packages to be installed on computer which has PCM600… |
CVE-2021-36756 | Medium | 6.5 | 2021-10-27 | CFEngine Enterprise 3.15.0 through 3.15.4 has Missing SSL Certificate Validation. |
CVE-2021-41611 | High | 7.5 | 2021-10-18 | An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly classify certain c… |
CVE-2021-20833 | High | 7.4 | 2021-10-13 | The SNKRDUNK Market Place App for iOS versions prior to 2.2.0 does not verify server certificate properly, which allows man-in-the-middle attackers to eavesdro… |
CVE-2021-25634 | High | 7.5 | 2021-10-12 | LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since… |
CVE-2021-25633 | High | 7.5 | 2021-10-11 | LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since… |
CVE-2021-35497 | High | 7.5 | 2021-10-05 | The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO Activ… |
CVE-2021-40713 | Medium | 5.9 | 2021-09-27 | Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a improper certificate validation vulnerability in the cold storage component. If an atta… |
CVE-2021-33907 | Critical | 9.8 | 2021-09-27 | The Zoom Client for Meetings for Windows in all versions before 5.3.0 fails to properly validate the certificate information used to sign .msi files when perfo… |
CVE-2021-38864 | High | 7.5 | 2021-09-23 | IBM Security Verify Bridge 1.0.5.0 could allow a user to obtain sensitive information due to improper certificate validation. IBM X-Force ID: 208155. |
CVE-2021-20435 | Medium | 5.5 | 2021-09-23 | IBM Security Verify Bridge 1.0.5.0 does not properly validate a certificate which could allow a local attacker to obtain sensitive information that could aid i… |
CVE-2021-33695 | Critical | 9.1 | 2021-09-15 | Potentially, SAP Cloud Connector, version - 2.0 communication with the backend is accepted without sufficient validation of the certificate. |
CVE-2021-1837 | Medium | 5.3 | 2021-09-08 | A certificate validation issue was addressed. This issue is fixed in iOS 14.5 and iPadOS 14.5. An attacker in a privileged network position may be able to alte… |
CVE-2021-37219 | High | 8.8 | 2021-09-07 | HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only func… |
CVE-2021-37218 | High | 8.8 | 2021-09-07 | HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality… |
CVE-2021-27018 | High | 7.5 | 2021-08-30 | The mechanism which performs certificate validation was discovered to have a flaw that resulted in certificates signed by an internal certificate authority to… |
CVE-2020-36478 | High | 7.5 | 2021-08-23 | An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). A NULL algorithm parameters entry looks identical to an array… |
CVE-2020-36477 | Medium | 5.9 | 2021-08-23 | An issue was discovered in Mbed TLS before 2.24.0. The verification of X.509 certificates when matching the expected common name (the cn argument of mbedtls_x5… |
CVE-2021-39365 | Medium | 5.9 | 2021-08-22 | In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to… |
CVE-2021-39361 | Medium | 5.9 | 2021-08-22 | In GNOME evolution-rss through 0.3.96, network-soup.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vul… |
CVE-2021-39360 | Medium | 5.9 | 2021-08-22 | In GNOME libzapojit through 0.0.3, zpj-skydrive.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnera… |
CVE-2021-39359 | Medium | 5.9 | 2021-08-22 | In GNOME libgda through 6.0.0, gda-web-provider.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnera… |
CVE-2021-39358 | Medium | 5.9 | 2021-08-22 | In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vuln… |
CVE-2021-37698 | High | 7.5 | 2021-08-19 | Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In v… |
CVE-2021-32728 | Medium | 6.5 | 2021-08-18 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. Clients using the Nextcloud end-to-end encryption feature do… |
CVE-2021-22939 | Medium | 5.3 | 2021-08-16 | If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to se… |
CVE-2021-32069 | Medium | 4.8 | 2021-08-13 | The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack due to improper TLS negotiation. A successful expl… |
CVE-2021-31399 | Medium | 4.6 | 2021-08-13 | On 2N Access Unit 2.0 2.31.0.40.5 devices, an attacker can pose as the web relay for a man-in-the-middle attack. |
CVE-2021-22926 | High | 7.5 | 2021-08-05 | libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with th… |
CVE-2021-32581 | High | 8.1 | 2021-08-05 | Acronis True Image prior to 2021 Update 4 for Windows, Acronis True Image prior to 2021 Update 5 for Mac, Acronis Agent prior to build 26653, Acronis Cyber Pro… |
CVE-2021-3636 | Medium | 4.6 | 2021-07-30 | It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectly included additional certificates. The… |
CVE-2021-35193 | High | 7.5 | 2021-07-30 | Patterson Application Service in Patterson Eaglesoft 18 through 21 accepts the same certificate authentication across different customers' installations (that… |
CVE-2020-12681 | High | 7.5 | 2021-07-26 | Missing TLS certificate validation on 3xLogic Infinias eIDC32 devices through 3.4.125 allows an attacker to intercept/control the channel by which door lock po… |
CVE-2020-36425 | Medium | 5.3 | 2021-07-19 | An issue was discovered in Arm Mbed TLS before 2.24.0. It incorrectly uses a revocationDate check when deciding whether to honor certificate revocation via a C… |
CVE-2021-32574 | High | 7.5 | 2021-07-17 | HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject… |
CVE-2021-34558 | Medium | 6.5 | 2021-07-15 | The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a… |
CVE-2021-32755 | Medium | 5.4 | 2021-07-13 | Wire is a collaboration platform. wire-ios-transport handles authentication of requests, network failures, and retries for the iOS implementation of Wire. In t… |
CVE-2021-31892 | High | 7.4 | 2021-07-13 | A vulnerability has been identified in SINUMERIK Analyse MyCondition (All versions), SINUMERIK Analyze MyPerformance (All versions), SINUMERIK Analyze MyPerfor… |
CVE-2021-32727 | Medium | 5.7 | 2021-07-12 | Nextcloud Android Client is the Android client for Nextcloud. Clients using the Nextcloud end-to-end encryption feature download the public and private key via… |
CVE-2021-36377 | High | 7.5 | 2021-07-12 | Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation. |
CVE-2021-3547 | High | 7.4 | 2021-07-12 | OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unrelated server certif… |
CVE-2021-36371 | Low | 3.7 | 2021-07-09 | Emissary-Ingress (formerly Ambassador API Gateway) through 1.13.9 allows attackers to bypass client certificate requirements (i.e., mTLS cert_required) on back… |
CVE-2021-1134 | High | 7.4 | 2021-06-29 | A vulnerability in the Cisco Identity Services Engine (ISE) integration feature of the Cisco DNA Center Software could allow an unauthenticated, remote attacke… |
CVE-2021-21571 | Medium | 5.9 | 2021-06-24 | Dell UEFI BIOS https stack leveraged by the Dell BIOSConnect feature and Dell HTTPS Boot feature contains an improper certificate validation vulnerability. A r… |
CVE-2020-15732 | Medium | 6.5 | 2021-06-22 | Improper Certificate Validation vulnerability in the Online Threat Prevention module as used in Bitdefender Total Security allows an attacker to potentially by… |
CVE-2021-1566 | High | 7.4 | 2021-06-16 | A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco We… |
CVE-2021-22895 | Medium | 5.9 | 2021-06-11 | Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register wit… |
CVE-2021-20732 | Medium | 5.9 | 2021-06-09 | The ATOM (ATOM - Smart life App for Android versions prior to 1.8.1 and ATOM - Smart life App for iOS versions prior to 1.8.2) does not verify server certifica… |
CVE-2021-21559 | High | 7.1 | 2021-06-08 | Dell EMC NetWorker, versions 18.x, 19.1.x, 19.2.x 19.3.x, 19.4, and 19.4.0.1 contain an Improper Certificate Validation vulnerability in the client (NetWorker… |
CVE-2021-22218 | Low | 2.6 | 2021-06-08 | All versions of GitLab CE/EE starting from 12.8 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13… |
CVE-2021-29504 | Critical | 9.1 | 2021-06-07 | WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote at… |
CVE-2021-24012 | Medium | 6.5 | 2021-06-02 | An improper following of a certificate's chain of trust vulnerability in FortiGate versions 6.4.0 to 6.4.4 may allow an LDAP user to connect to SSLVPN with any… |
CVE-2021-22909 | High | 7.5 | 2021-05-27 | A vulnerability found in EdgeMAX EdgeRouter V2.0.9 and earlier could allow a malicious actor to execute a man-in-the-middle (MitM) attack during a firmware upd… |
CVE-2016-20011 | High | 7.5 | 2021-05-25 | libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds witho… |
CVE-2020-28907 | Critical | 9.8 | 2021-05-24 | Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to do… |
CVE-2007-5967 | Medium | 6.5 | 2021-05-17 | A flaw in Mozilla's embedded certificate code might allow web sites to install root certificates on devices without user approval. |
CVE-2021-22138 | Low | 3.7 | 2021-05-13 | In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When specifying a trusted… |
CVE-2021-32919 | High | 7.5 | 2021-05-13 | An issue was discovered in Prosody before 0.11.9. The undocumented dialback_without_dialback option in mod_dialback enables an experimental feature for server-… |
CVE-2021-29495 | Medium | 5.9 | 2021-05-07 | Nim is a statically typed compiled systems programming language. In Nim standard library before 1.4.2, httpClient SSL/TLS certificate verification was disabled… |
CVE-2020-36127 | Medium | 6.5 | 2021-05-07 | Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by an information disclosure vulnerability. Through the PUK signature functionality, an adm… |
CVE-2021-20695 | High | 8.8 | 2021-04-26 | Improper following of a certificate's chain of trust vulnerability in DAP-1880AC firmware version 1.21 and earlier allows a remote authenticated attacker to ga… |
CVE-2021-31597 | Critical | 9.4 | 2021-04-23 | The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists bu… |
CVE-2021-29653 | High | 7.5 | 2021-04-22 | HashiCorp Vault and Vault Enterprise 1.5.1 and newer, under certain circumstances, may exclude revoked but unexpired certificates from the CRL. Fixed in 1.5.8… |
CVE-2021-27400 | High | 7.5 | 2021-04-22 | HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did not validate TLS certificates when connect… |
CVE-2021-20989 | Medium | 5.9 | 2021-04-19 | Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote access and remote su… |
CVE-2021-3460 | High | 8.1 | 2021-04-13 | The Motorola MH702x devices, prior to version 2.0.0.301, do not properly verify the server certificate during communication with the support server which could… |
CVE-2020-7924 | Medium | 4.2 | 2021-04-12 | Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certif… |
CVE-2021-22511 | Medium | 6.5 | 2021-04-08 | Improper Certificate Validation vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and ea… |
CVE-2021-27899 | High | 7.4 | 2021-04-06 | The Proofpoint Insider Threat Management Agents (formerly ObserveIT Agent) for MacOS and Linux perform improper validation of the ITM Server's certificate, whi… |
CVE-2021-21374 | High | 8.1 | 2021-03-26 | Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimb… |
CVE-2021-21373 | High | 7.5 | 2021-03-26 | Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimb… |
CVE-2021-3450 | High | 7.4 | 2021-03-25 | The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from… |
CVE-2021-21385 | High | 8.8 | 2021-03-24 | Mifos-Mobile Android Application for MifosX is an Android Application built on top of the MifosX Self-Service platform. Mifos-Mobile before commit e505f62 disa… |
CVE-2021-1471 | Critical | 9.9 | 2021-03-24 | Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrar… |
CVE-2021-28363 | Medium | 6.5 | 2021-03-15 | The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to… |
CVE-2020-15260 | Medium | 6.8 | 2021-03-10 | PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN… |
CVE-2021-27257 | Medium | 6.5 | 2021-03-05 | This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R7800 firmware… |