CWE-295 · Improper Certificate Validation (page 10)
Page 10 of 15 — CVEs classified under CWE-295, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-9868 | Critical | 9.1 | 2020-10-22 | A certificate validation issue existed when processing administrator added certificates. This issue was addressed with improved certificate validation. This is… |
CVE-2020-3557 | Medium | 5.3 | 2020-10-21 | A vulnerability in the host input API daemon of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to cause a den… |
CVE-2020-3994 | High | 7.4 | 2020-10-20 | VMware vCenter Server (6.7 before 6.7u3, 6.6 before 6.5u3k) contains a session hijack vulnerability in the vCenter Server Appliance Management Interface update… |
CVE-2020-1675 | High | 8.3 | 2020-10-16 | When Security Assertion Markup Language (SAML) authentication is enabled, Juniper Networks Mist Cloud UI might incorrectly process invalid authentication certi… |
CVE-2020-13955 | Medium | 5.9 | 2020-10-09 | HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calci… |
CVE-2020-26117 | High | 8.1 | 2020-09-27 | In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as autho… |
CVE-2016-11086 | High | 7.4 | 2020-09-24 | lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot be found, which all… |
CVE-2020-24560 | High | 7.5 | 2020-09-24 | An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to c… |
CVE-2020-15604 | High | 7.5 | 2020-09-24 | An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to c… |
CVE-2020-4340 | Medium | 4.3 | 2020-09-23 | IBM Security Secret Server prior to 10.9 could allow an attacker to bypass SSL security due to improper certificate validation. IBM X-Force ID: 178180. |
CVE-2020-24619 | Medium | 5.9 | 2020-09-22 | In mainwindow.cpp in Shotcut before 20.09.13, the upgrade check misuses TLS because of setPeerVerifyMode(QSslSocket::VerifyNone). A man-in-the-middle attacker… |
CVE-2020-6781 | Medium | 6.8 | 2020-09-16 | Improper certificate validation for certain connections in the Bosch Smart Home System App for iOS prior to version 9.17.1 potentially allows to intercept vide… |
CVE-2020-2253 | Medium | 4.8 | 2020-09-16 | Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server. |
CVE-2020-2252 | Medium | 4.8 | 2020-09-16 | Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server. |
CVE-2020-25276 | High | 7.3 | 2020-09-11 | An issue was discovered in PrimeKey EJBCA 6.x and 7.x before 7.4.1. When using a client certificate to enroll over the EST protocol, no revocation check is per… |
CVE-2018-19946 | Medium | 4.2 | 2020-09-11 | The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this improper certificate validation vulnerability could allow an at… |
CVE-2020-11617 | Medium | 5.9 | 2020-08-31 | The RSS application on THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes doesn't validate the SSL certificates of RSS servers, which a… |
CVE-2020-24715 | Critical | 9.8 | 2020-08-27 | The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, native Python code is used that lacks a comparison of the… |
CVE-2020-24714 | Critical | 9.8 | 2020-08-27 | The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, the openssl binary is called without the -verify_hostname… |
CVE-2020-24661 | Medium | 5.9 | 2020-08-26 | GNOME Geary before 3.36.3 mishandles pinned TLS certificate verification for IMAP and SMTP services using invalid TLS certificates (e.g., self-signed certifica… |
CVE-2020-5913 | High | 7.4 | 2020-08-26 | In versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, the BIG-IP Client or Server SSL profile ignores revoked ce… |
CVE-2019-18847 | Critical | 9.8 | 2020-08-26 | Enterprise Access Client Auto-Updater allows for Remote Code Execution prior to version 2.0.1. |
CVE-2020-15498 | Medium | 5.9 | 2020-08-26 | An issue was discovered on ASUS RT-AC1900P routers before 3.0.0.4.385_20253. The router accepts an arbitrary server certificate for a firmware update. The culp… |
CVE-2020-16197 | Medium | 4.3 | 2020-08-25 | An issue was discovered in Octopus Deploy 3.4. A deployment target can be configured with an Account or Certificate that is outside the scope of the deployment… |
CVE-2020-24613 | Medium | 6.8 | 2020-08-24 | wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in tls13.c. This is an incorrect implementa… |
CVE-2020-17366 | High | 7.4 | 2020-08-05 | An issue was discovered in NLnet Labs Routinator 0.1.0 through 0.7.1. It allows remote attackers to bypass intended access restrictions or to cause a denial of… |
CVE-2020-15134 | High | 8.0 | 2020-07-31 | Faye before version 1.4.0, there is a lack of certification validation in TLS handshakes. Faye uses em-http-request and faye-websocket in the Ruby version of i… |
CVE-2020-15133 | High | 8.0 | 2020-07-31 | In faye-websocket before version 0.11.0, there is a lack of certification validation in TLS handshakes. The `Faye::WebSocket::Client` class uses the `EM::Conne… |
CVE-2020-16164 | High | 7.4 | 2020-07-30 | An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14.28. It allows remote attackers to bypass intended access restrictions or to ca… |
CVE-2020-16163 | Critical | 9.1 | 2020-07-30 | An issue was discovered in RIPE NCC RPKI Validator 3.x before 3.1-2020.07.06.14.28. RRDP fetches proceed even with a lack of validation of a TLS HTTPS endpoint… |
CVE-2020-16162 | High | 7.5 | 2020-07-30 | An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14.28. Missing validation checks on CRL presence or CRL staleness in the X509-bas… |
CVE-2020-10925 | High | 8.8 | 2020-07-28 | This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700 V1.0.4.84… |
CVE-2020-6529 | Medium | 4.3 | 2020-07-22 | Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to leak cross-origin data vi… |
CVE-2019-12000 | Medium | 6.6 | 2020-07-17 | HPE has found a potential Remote Access Restriction Bypass in HPE MSE Msg Gw application E-LTU prior to version 3.2 when HTTPS is used between the USSD and an… |
CVE-2020-15813 | High | 8.1 | 2020-07-17 | Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group database stored in LDAP. The connection configu… |
CVE-2020-14039 | Medium | 5.3 | 2020-07-17 | In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equa… |
CVE-2020-15720 | Medium | 6.8 | 2020-07-14 | In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-cod… |
CVE-2020-15719 | Medium | 4.2 | 2020-07-14 | libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN e… |
CVE-2020-15526 | Medium | 5.9 | 2020-07-09 | In Redgate SQL Monitor 7.1.4 through 10.1.6 (inclusive), the scope for disabling some TLS security certificate checks can extend beyond that defined by various… |
CVE-2020-12421 | Medium | 6.5 | 2020-07-09 | When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.)… |
CVE-2019-20894 | High | 7.5 | 2020-07-02 | Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERR_BAD_SSL_CLIENT_AUTH_CERT shou… |
CVE-2020-5909 | Medium | 5.4 | 2020-07-02 | In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the… |
CVE-2020-15047 | Medium | 5.9 | 2020-06-25 | MSA/SMTP.cpp in Trojita before 0.8 ignores certificate-verification errors, which allows man-in-the-middle attackers to spoof SMTP servers. |
CVE-2020-5367 | High | 7.4 | 2020-06-23 | Dell EMC Unisphere for PowerMax versions prior to 9.1.0.17, Dell EMC Unisphere for PowerMax Virtual Appliance versions prior to 9.1.0.17, and PowerMax OS Relea… |
CVE-2020-14981 | Medium | 5.9 | 2020-06-22 | The ThreatTrack VIPRE Password Vault app through 1.100.1090 for iOS has Missing SSL Certificate Validation. |
CVE-2020-14980 | Medium | 5.9 | 2020-06-22 | The Sophos Secure Email application through 3.9.4 for Android has Missing SSL Certificate Validation. |
CVE-2017-18918 | Medium | 4.9 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname. |
CVE-2016-11076 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL. |
CVE-2017-18911 | Critical | 9.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server. |
CVE-2017-18909 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory. |
CVE-2020-3342 | High | 8.8 | 2020-06-18 | A vulnerability in the software update feature of Cisco Webex Meetings Desktop App for Mac could allow an unauthenticated, remote attacker to execute arbitrary… |
CVE-2020-4320 | Medium | 6.5 | 2020-06-16 | IBM MQ Appliance and IBM MQ AMQP Channels 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD do not correctly block or allow clients based on the certificate distinguished name… |
CVE-2019-16252 | Medium | 5.9 | 2020-06-12 | Missing SSL Certificate Validation in the Nutfind.com application through 3.9.12 for Android allows a man-in-the-middle attacker to sniff and manipulate all AP… |
CVE-2020-2033 | Medium | 5.3 | 2020-06-10 | When the pre-logon feature is enabled, a missing certification validation in Palo Alto Networks GlobalProtect app can disclose the pre-logon authentication coo… |
CVE-2020-0119 | Medium | 5.3 | 2020-06-10 | In addOrUpdateNetworkInternal and related functions of WifiConfigManager.java, there is a possible man in the middle attack due to improper certificate validat… |
CVE-2020-9040 | High | 7.5 | 2020-06-08 | Couchbase Server Java SDK before 2.7.1.1 allows a potential attacker to forge an SSL certificate and pose as the intended peer. An attacker can leverage this f… |
CVE-2020-8172 | High | 7.4 | 2020-06-08 | TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0. |
CVE-2020-13254 | Medium | 5.9 | 2020-06-03 | An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed… |
CVE-2020-13245 | Medium | 5.9 | 2020-05-28 | Certain NETGEAR devices are affected by Missing SSL Certificate Validation. This affects R7000 1.0.9.6_1.2.19 through 1.0.11.100_10.2.10, and possibly R6120, R… |
CVE-2020-13645 | Medium | 6.5 | 2020-05-28 | In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the applicat… |
CVE-2020-13616 | Medium | 5.9 | 2020-05-26 | The boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification. |
CVE-2020-13615 | Medium | 5.9 | 2020-05-26 | lib/QoreSocket.cpp in Qore before 0.9.4.2 lacks hostname verification for X.509 certificates. |
CVE-2020-13614 | Medium | 5.9 | 2020-05-26 | An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification. |
CVE-2020-13482 | High | 7.4 | 2020-05-25 | EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the libra… |
CVE-2020-1113 | High | 7.5 | 2020-05-21 | A security feature bypass vulnerability exists in Microsoft Windows when the Task Scheduler service fails to properly verify client connections over RPC, aka '… |
CVE-2020-13163 | High | 7.4 | 2020-05-19 | em-imap 0.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The ho… |
CVE-2020-1758 | Medium | 5.3 | 2020-05-15 | A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. Thi… |
CVE-2020-8156 | High | 7.0 | 2020-05-12 | A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack. |
CVE-2020-10059 | Medium | 4.8 | 2020-05-11 | The UpdateHub module disables DTLS peer checking, which allows for a man in the middle attack. This is mitigated by firmware images requiring valid signatures… |
CVE-2020-12637 | Critical | 9.8 | 2020-05-09 | Zulip Desktop before 5.2.0 has Missing SSL Certificate Validation because all validation was inadvertently disabled during an attempt to recognize the ignoreCe… |
CVE-2020-11050 | Critical | 9.0 | 2020-05-07 | In Java-WebSocket less than or equal to 1.4.1, there is an Improper Validation of Certificate with Host Mismatch where WebSocketClient does not perform SSL hos… |
CVE-2020-2187 | Medium | 5.6 | 2020-05-06 | Jenkins Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed certificates and does not perform hostname validation, enabling man-in-the-mid… |
CVE-2020-12144 | Medium | 6.0 | 2020-05-05 | The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validated. This makes it possible for someone to establish a TLS co… |
CVE-2020-12143 | Medium | 6.0 | 2020-05-05 | The certificate used to identify Orchestrator to EdgeConnect devices is not validated, which makes it possible for someone to establish a TLS connection from E… |
CVE-2019-19101 | Medium | 6.5 | 2020-04-29 | A missing secure communication definition and an incomplete TLS validation in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, < 4.3… |
CVE-2020-1952 | Critical | 9.8 | 2020-04-27 | An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients cou… |
CVE-2020-9488 | Low | 3.7 | 2020-04-27 | Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-mid… |
CVE-2020-5864 | High | 7.4 | 2020-04-23 | In versions of NGINX Controller prior to 3.2.0, communication between NGINX Controller and NGINX Plus instances skip TLS verification by default. |
CVE-2020-11806 | Medium | 5.9 | 2020-04-23 | In MailStore Outlook Add-in (and Email Archive Outlook Add-in) through 12.1.2, the login process does not validate the validity of the certificate presented by… |
CVE-2020-11792 | High | 7.5 | 2020-04-15 | NETGEAR R8900, R9000, RAX120, and XR700 devices before 2020-01-20 are affected by Transport Layer Security (TLS) certificate private key disclosure. |
CVE-2019-4654 | Medium | 4.8 | 2020-04-15 | IBM QRadar 7.3.0 to 7.3.3 Patch 2 does not validate, or incorrectly validates, a certificate which could allow an attacker to spoof a trusted entity by using a… |
CVE-2020-7922 | Medium | 6.4 | 2020-04-09 | X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to Mongo… |
CVE-2020-11580 | Critical | 9.1 | 2020-04-06 | An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients wh… |
CVE-2019-17560 | Critical | 9.1 | 2020-03-30 | The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downlo… |
CVE-2019-3762 | High | 7.5 | 2020-03-18 | Data Protection Central versions 1.0, 1.0.1, 18.1, 18.2, and 19.1 contains an Improper Certificate Chain of Trust Vulnerability. A remote unauthenticated attac… |
CVE-2019-11688 | High | 7.4 | 2020-03-18 | An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl accept any certificate for asusto… |
CVE-2020-10659 | Medium | 4.3 | 2020-03-18 | Entrust Entelligence Security Provider (ESP) before 10.0.60 on Windows mishandles errors during SSL Certificate Validation, leading to situations where (for ex… |
CVE-2020-7919 | High | 7.5 | 2020-03-16 | Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resul… |
CVE-2020-6175 | Medium | 5.9 | 2020-03-16 | Citrix SD-WAN 10.2.x before 10.2.6 and 11.0.x before 11.0.3 has Missing SSL Certificate Validation. |
CVE-2020-9321 | High | 7.5 | 2020-03-16 | configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate contents from providers before logging. |
CVE-2019-10091 | High | 7.4 | 2020-03-16 | When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verification of the entries in the certificate… |
CVE-2020-1887 | Critical | 9.1 | 2020-03-13 | Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to MITM osquery traffic in the absence of… |
CVE-2012-1096 | Medium | 5.5 | 2020-03-10 | NetworkManager 0.9 and earlier allows local users to use other users' certificates or private keys when making a connection via the file path when adding a new… |
CVE-2020-8987 | High | 7.4 | 2020-03-09 | Avast AntiTrack before 1.5.1.172 and AVG Antitrack before 2.0.0.178 proxies traffic to HTTPS sites but does not validate certificates, and thus a man-in-the-mi… |
CVE-2020-3155 | High | 7.4 | 2020-03-04 | A vulnerability in the SSL implementation of the Cisco Intelligent Proximity solution could allow an unauthenticated, remote attacker to view or alter informat… |
CVE-2020-9434 | Critical | 9.1 | 2020-02-27 | openssl_x509_check_ip_asc in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values. |
CVE-2020-9433 | Critical | 9.1 | 2020-02-27 | openssl_x509_check_email in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values. |
CVE-2020-9432 | Critical | 9.1 | 2020-02-27 | openssl_x509_check_host in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values. |
CVE-2020-7043 | Critical | 9.1 | 2020-02-27 | An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2. tunnel.c mishandles certificate validation because hostname comparisons do… |
CVE-2020-7042 | Medium | 5.3 | 2020-02-27 | An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check ope… |