CWE-295 · Improper Certificate Validation (page 11)
Page 11 of 15 — CVEs classified under CWE-295, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7041 | Medium | 5.3 | 2020-02-27 | An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because an X509_check_host neg… |
CVE-2020-7942 | Medium | 6.5 | 2020-02-19 | Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate al… |
CVE-2019-20455 | Medium | 5.9 | 2020-02-14 | Gateways/Gateway.php in Heartland & Global Payments PHP SDK before 2.0.0 does not enforce SSL certificate validations. |
CVE-2019-15604 | High | 7.5 | 2020-02-07 | Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate |
CVE-2020-7956 | Critical | 9.8 | 2020-01-31 | HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to… |
CVE-2020-5526 | Medium | 5.9 | 2020-01-31 | The AWMS Mobile App for Android 2.0.0 to 2.0.5 and for iOS 2.0.0 to 2.0.8 does not verify X.509 certificates from servers, which allows man-in-the-middle attac… |
CVE-2020-7904 | High | 7.4 | 2020-01-30 | In JetBrains IntelliJ IDEA before 2019.3, some Maven repositories were accessed via HTTP instead of HTTPS. |
CVE-2014-3230 | Medium | 5.9 | 2020-01-28 | The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server… |
CVE-2020-5523 | High | 7.4 | 2020-01-28 | Android App 'MyPallete' and some of the Android banking applications based on 'MyPallete' do not verify X.509 certificates from servers, and also do not proper… |
CVE-2015-0294 | High | 7.5 | 2020-01-27 | GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate. |
CVE-2006-7246 | Medium | 6.8 | 2020-01-27 | NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used. |
CVE-2020-5522 | High | 7.4 | 2020-01-27 | The kantan netprint App for Android 2.0.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof server… |
CVE-2020-5521 | High | 7.4 | 2020-01-27 | The kantan netprint App for iOS 2.0.2 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers an… |
CVE-2020-5520 | High | 7.4 | 2020-01-27 | The netprint App for iOS 3.2.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtai… |
CVE-2017-14806 | Low | 3.7 | 2020-01-27 | A Improper Certificate Validation vulnerability in susestudio-common of SUSE Studio onsite allows remote attackers to MITM connections to the repositories, whi… |
CVE-2011-2669 | Medium | 6.5 | 2020-01-21 | Mozilla Firefox prior to 3.6 has a DoS vulnerability due to an issue in the validation of certificates. |
CVE-2020-3940 | Medium | 5.9 | 2020-01-17 | VMware Workspace ONE SDK and dependent mobile application updates address sensitive information disclosure vulnerability. |
CVE-2020-1929 | High | 7.5 | 2020-01-15 | The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust verification. However this configuration is not respected and… |
CVE-2012-1316 | Medium | 5.9 | 2020-01-15 | Cisco IronPort Web Security Appliance does not check for certificate revocation which could lead to MITM attacks |
CVE-2020-0601 | High | 8.1 | 2020-01-14 | A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit t… |
CVE-2014-0161 | Medium | 5.9 | 2020-01-02 | ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as s… |
CVE-2014-0104 | Medium | 5.9 | 2020-01-02 | In fence-agents before 4.0.17 does not verify remote SSL certificates in the fence_cisco_ucs.py script which can potentially allow for man-in-the-middle attack… |
CVE-2013-0264 | High | 7.5 | 2019-12-30 | An import error was introduced in Cumin in the code refactoring in r5310. Server certificate validation is always disabled when connecting to Aviary servers, e… |
CVE-2019-6032 | High | 7.4 | 2019-12-26 | The NTV News24 prior to Ver.3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sen… |
CVE-2019-6687 | High | 7.4 | 2019-12-23 | On versions 15.0.0-15.0.1.1, the BIG-IP ASM Cloud Security Services profile uses a built-in verification mechanism that fails to properly authenticate the X.50… |
CVE-2019-16561 | High | 7.1 | 2019-12-17 | Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire… |
CVE-2019-16558 | High | 8.2 | 2019-12-17 | Jenkins Spira Importer Plugin 3.2.3 and earlier disables SSL/TLS certificate validation for the Jenkins master JVM. |
CVE-2018-11751 | Medium | 5.4 | 2019-12-16 | Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0. |
CVE-2019-18826 | Critical | 9.8 | 2019-12-16 | Barco ClickShare Button R9861500D01 devices before 1.9.0 have Improper Following of a Certificate's Chain of Trust. The embedded 'dongle_bridge' program used t… |
CVE-2014-3495 | High | 7.5 | 2019-12-13 | duplicity 0.6.24 has improper verification of SSL certificates |
CVE-2019-11554 | Medium | 5.9 | 2019-12-06 | The Audible application through 2.34.0 for Android has Missing SSL Certificate Validation for Adobe SDKs, allowing MITM attackers to cause a denial of service. |
CVE-2019-14910 | Critical | 9.8 | 2019-12-05 | A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (… |
CVE-2011-2207 | Medium | 5.3 | 2019-11-27 | dirmngr before 2.1.0 improperly handles certain system calls, which allows remote attackers to cause a denial of service (DOS) via a specially-crafted certific… |
CVE-2019-19271 | High | 7.5 | 2019-11-26 | An issue was discovered in tls_verify_crl in ProFTPD before 1.3.6. A wrong iteration variable, used when checking a client certificate against CRL entries (ins… |
CVE-2019-19270 | High | 7.5 | 2019-11-26 | An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. Failure to check for the appropriate field of a CRL entry (checking twice for subject, rat… |
CVE-2012-5518 | High | 7.5 | 2019-11-25 | vdsm: certificate generation upon node creation allowing vdsm to start and serve requests from anyone who has a matching key (and certificate) |
CVE-2014-2902 | High | 7.5 | 2019-11-21 | wolfssl before 3.2.0 does not properly authorize CA certificate for signing other certificates. |
CVE-2014-2901 | High | 7.5 | 2019-11-21 | wolfssl before 3.2.0 does not properly issue certificates for a server's hostname. |
CVE-2012-6071 | High | 7.5 | 2019-11-19 | nuSOAP before 0.7.3-5 does not properly check the hostname of a cert. |
CVE-2019-5102 | Medium | 4.0 | 2019-11-18 | An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, t… |
CVE-2019-5101 | Medium | 4.0 | 2019-11-18 | An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, t… |
CVE-2010-4533 | Critical | 9.8 | 2019-11-13 | offlineimap before 6.3.4 added support for SSL server certificate validation but it is still possible to use SSL v2 protocol, which is a flawed protocol with m… |
CVE-2010-4532 | Medium | 5.9 | 2019-11-13 | offlineimap before 6.3.2 does not check for SSL server certificate validation when "ssl = yes" option is specified which can allow man-in-the-middle attacks. |
CVE-2014-8167 | Medium | 5.9 | 2019-11-13 | vdsm and vdsclient does not validate certficate hostname from another vdsm which could facilitate a man-in-the-middle attack |
CVE-2014-7143 | High | 7.5 | 2019-11-12 | Python Twisted 14.0 trustRoot is not respected in HTTP client |
CVE-2009-3552 | Low | 3.1 | 2019-11-09 | In RHEV-M VDC 2.2.0, it was found that the SSL certificate was not verified when using the client-side Red Hat Enterprise Virtualization Manager interface (a W… |
CVE-2019-16209 | High | 7.4 | 2019-11-08 | A vulnerability, in The ReportsTrustManager class of Brocade SANnav versions before v2.0, could allow an attacker to perform a man-in-the-middle attack against… |
CVE-2019-3685 | High | 7.4 | 2019-11-05 | Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client binary |
CVE-2013-2255 | Medium | 5.9 | 2019-11-01 | HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates. |
CVE-2019-18633 | Critical | 9.8 | 2019-10-30 | European Commission eIDAS-Node Integration Package before 2.3.1 has Missing Certificate Validation because a certain ExplicitKeyTrustEvaluator return value is… |
CVE-2019-18632 | Critical | 9.8 | 2019-10-30 | European Commission eIDAS-Node Integration Package before 2.3.1 allows Certificate Faking because an attacker can sign a manipulated SAML response with a forge… |
CVE-2018-21029 | Critical | 9.8 | 2019-10-30 | systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication (SNI) is not sent, and there… |
CVE-2010-4237 | Medium | 5.9 | 2019-10-29 | Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate signed by a Certificat… |
CVE-2019-5538 | Medium | 5.9 | 2019-10-28 | Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vC… |
CVE-2019-5537 | Medium | 5.9 | 2019-10-28 | Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vC… |
CVE-2019-11674 | Medium | 5.9 | 2019-10-22 | Man-in-the-middle vulnerability in Micro Focus Self Service Password Reset, affecting all versions prior to 4.4.0.4. The vulnerability could exploit invalid ce… |
CVE-2019-10446 | High | 8.2 | 2019-10-16 | Jenkins Cadence vManager Plugin 2.7.0 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM. |
CVE-2019-10444 | Medium | 6.5 | 2019-10-16 | Jenkins Bumblebee HP ALM Plugin 4.1.3 and earlier unconditionally disabled SSL/TLS and hostname verification for connections to HP ALM. |
CVE-2019-14823 | High | 7.4 | 2019-10-14 | A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the r… |
CVE-2019-0054 | Medium | 6.8 | 2019-10-09 | An Improper Certificate Validation weakness in the SRX Series Application Identification (app-id) signature update client of Juniper Networks Junos OS allows a… |
CVE-2019-5506 | Medium | 5.9 | 2019-10-09 | Clustered Data ONTAP versions 9.0 and higher do not enforce hostname verification under certain circumstances making them susceptible to impersonation via man-… |
CVE-2019-16263 | High | 7.4 | 2019-10-07 | The Twitter Kit framework through 3.4.2 for iOS does not properly validate the api.twitter.com SSL certificate. Although the certificate chain must contain one… |
CVE-2019-15042 | High | 7.5 | 2019-10-01 | An issue was discovered in JetBrains TeamCity 2018.2.4. It had no SSL certificate validation for some external https connections. This was fixed in TeamCity 20… |
CVE-2019-1231 | Medium | 5.9 | 2019-09-11 | An information disclosure vulnerability exists in the way Rome SDK handles server SSL/TLS certificate validation, aka 'Rome SDK Information Disclosure Vulnerab… |
CVE-2019-11497 | High | 7.5 | 2019-09-10 | In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entered as part of the reference creation, XDCR did not parse and check the certifica… |
CVE-2019-16179 | Medium | 5.3 | 2019-09-09 | Limesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration. |
CVE-2016-10937 | High | 7.5 | 2019-09-08 | IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate. |
CVE-2019-3751 | Medium | 6.4 | 2019-09-03 | Dell EMC Enterprise Copy Data Management (eCDM) versions 1.0, 1.1, 2.0, 2.1, and 3.0 contain a certificate validation vulnerability. An unauthenticated remote… |
CVE-2017-18588 | Medium | 5.3 | 2019-08-26 | An issue was discovered in the security-framework crate before 0.1.12 for Rust. Hostname verification for certificates does not occur if ClientBuilder uses cus… |
CVE-2016-10931 | High | 8.1 | 2019-08-26 | An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off… |
CVE-2019-15525 | High | 8.1 | 2019-08-23 | There is Missing SSL Certificate Validation in the pw3270 terminal emulator before version 5.1. |
CVE-2019-1948 | Medium | 5.9 | 2019-08-21 | A vulnerability in Cisco Webex Meetings Mobile (iOS) could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data by usin… |
CVE-2019-5280 | Medium | 6.5 | 2019-08-13 | The SIP TLS module of Huawei CloudLink Phone 7900 with V600R019C10 has a TLS certificate verification vulnerability. Due to insufficient verification of specif… |
CVE-2019-14516 | High | 7.4 | 2019-08-13 | The mAadhaar application 1.2.7 for Android lacks SSL Certificate Validation, leading to man-in-the-middle attacks against requests for FAQs or Help. |
CVE-2019-10382 | Medium | 6.5 | 2019-08-07 | Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM. |
CVE-2019-10381 | High | 7.5 | 2019-08-07 | Jenkins Codefresh Integration Plugin 1.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM. |
CVE-2017-18479 | Medium | 6.5 | 2019-08-05 | In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209). |
CVE-2019-3890 | High | 8.1 | 2019-08-01 | It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential informatio… |
CVE-2019-14334 | Medium | 5.5 | 2019-08-01 | An issue was discovered on D-Link 6600-AP, DWL-3600AP, and DWL-8610AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated Certificate and RSA Private K… |
CVE-2019-7615 | High | 7.4 | 2019-07-30 | A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the 'serve… |
CVE-2019-1552 | Low | 3.3 | 2019-07-30 | OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory… |
CVE-2019-11727 | Medium | 5.3 | 2019-07-23 | A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only… |
CVE-2019-1010206 | Medium | 5.9 | 2019-07-23 | OSS Http Request (Apache Cordova Plugin) 6 is affected by: Missing SSL certificate validation. The impact is: certificate spoofing. The component is: use this… |
CVE-2019-1940 | Medium | 5.9 | 2019-07-17 | A vulnerability in the Web Services Management Agent (WSMA) feature of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker… |
CVE-2019-1010275 | Critical | 9.8 | 2019-07-17 | helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation. The impact is: Unauthorized clients could connect to the server because self-signed… |
CVE-2019-1006 | High | 7.5 | 2019-07-15 | An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAML tokens… |
CVE-2019-11242 | High | 8.1 | 2019-07-12 | A man-in-the-middle vulnerability related to vCenter access was found in Cohesity DataPlatform version 5.x and 6.x prior to 6.1.1c. Cohesity clusters did not v… |
CVE-2019-9148 | Medium | 4.3 | 2019-07-09 | Mailvelope prior to 3.3.0 accepts or operates with invalid PGP public keys: Mailvelope allows importing keys that contain users without a valid self-certificat… |
CVE-2019-5961 | High | 7.4 | 2019-07-05 | The Android App 'Tootdon for Mastodon' version 3.4.1 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers… |
CVE-2019-1886 | High | 8.6 | 2019-07-04 | A vulnerability in the HTTPS decryption feature of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to cause a denial of serv… |
CVE-2019-13050 | High | 7.5 | 2019-06-29 | Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver confi… |
CVE-2019-4150 | Low | 3.7 | 2019-06-25 | IBM Security Access Manager 9.0.1 through 9.0.6 does not validate, or incorrectly validates, a certificate which could allow an attacker to spoof a trusted ent… |
CVE-2017-17945 | Critical | 9.1 | 2019-06-24 | The ASUS HiVivo aspplication before 5.6.27 for ASUS Watch has Missing SSL Certificate Validation. |
CVE-2017-17944 | Critical | 9.1 | 2019-06-20 | The ASUS Vivobaby application before 1.1.09 for Android has Missing SSL Certificate Validation. |
CVE-2019-12855 | High | 7.4 | 2019-06-16 | In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connec… |
CVE-2019-3875 | Medium | 6.5 | 2019-06-12 | A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL lis… |
CVE-2019-10334 | Medium | 6.5 | 2019-06-11 | Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM when MultipartUtility.java is used… |
CVE-2018-20135 | High | 8.1 | 2019-06-07 | Samsung Galaxy Apps before 4.4.01.7 allows modification of the hostname used for load balancing on installations of applications through a man-in-the-middle at… |
CVE-2019-12496 | High | 7.5 | 2019-05-31 | An issue was discovered in Hybrid Group Gobot before 1.13.0. The mqtt subsystem skips verification of root CA certificates by default. |
CVE-2019-4264 | Medium | 5.9 | 2019-05-29 | IBM QRadar SIEM 7.2.8 WinCollect could allow an attacker to obtain sensitive information by spoofing a trusted entity using man in the middle techniques due to… |