CWE-295 · Improper Certificate Validation (page 11)
Page 11 of 17 — CVEs classified under CWE-295, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-27098 | High | 8.1 | 2021-03-05 | In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy… |
CVE-2021-22189 | Medium | 5.9 | 2021-03-04 | Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that… |
CVE-2020-35662 | High | 7.4 | 2021-02-27 | In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated. |
CVE-2020-28972 | Medium | 5.9 | 2021-02-27 | In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS cert… |
CVE-2021-3406 | Critical | 9.8 | 2021-02-25 | A flaw was found in keylime 5.8.1 and older. The issue in the Keylime agent and registrar code invalidates the cryptographic chain of trust from the Endorsemen… |
CVE-2021-20328 | Medium | 6.4 | 2021-02-25 | Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s… |
CVE-2021-20327 | Medium | 6.4 | 2021-02-25 | A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in c… |
CVE-2021-20230 | High | 7.5 | 2021-02-23 | A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options… |
CVE-2021-27189 | Medium | 5.9 | 2021-02-23 | The CIRA Canadian Shield app before 4.0.13 for iOS lacks SSL Certificate Validation. |
CVE-2020-24393 | Medium | 5.9 | 2021-02-19 | TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-… |
CVE-2020-24392 | Medium | 5.9 | 2021-02-19 | In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library (because… |
CVE-2021-26911 | High | 7.4 | 2021-02-17 | core/imap/MCIMAPSession.cpp in Canary Mail before 3.22 has Missing SSL Certificate Validation for IMAP in STARTTLS mode. |
CVE-2020-29457 | Medium | 4.4 | 2021-02-16 | A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 could allow a rogue application to establish a secure connection. |
CVE-2021-20649 | Medium | 4.8 | 2021-02-12 | ELECOM WRC-300FEBK-S contains an improper certificate validation vulnerability. Via a man-in-the-middle attack, an attacker may alter the communication respons… |
CVE-2021-0341 | High | 7.5 | 2021-02-10 | In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could le… |
CVE-2020-4791 | Medium | 5.3 | 2021-02-09 | IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to obtain sensitive information using main in the middle attacks due to imprope… |
CVE-2020-5812 | Medium | 5.9 | 2021-02-06 | Nessus AMI versions 8.12.0 and earlier were found to either not validate, or incorrectly validate, a certificate which could allow an attacker to spoof a trust… |
CVE-2021-1354 | Medium | 4.3 | 2021-02-04 | A vulnerability in the certificate registration process of Cisco Unified Computing System (UCS) Central Software could allow an authenticated, adjacent attacke… |
CVE-2021-3336 | High | 8.1 | 2021-01-29 | DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior (sending an ED22519, ED448, ECC, or R… |
CVE-2021-3309 | High | 8.1 | 2021-01-26 | packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store, |
CVE-2021-3285 | Medium | 5.3 | 2021-01-26 | jxbrowser in TI Code Composer Studio IDE 8.x through 10.x before 10.1.1 does not verify X.509 certificates for HTTPS. |
CVE-2021-1277 | High | 7.5 | 2021-01-20 | Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) could allow an attacker to spoof a trusted host or construct a man-in-the-middle attack to… |
CVE-2021-1276 | High | 7.5 | 2021-01-20 | Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) could allow an attacker to spoof a trusted host or construct a man-in-the-middle attack to… |
CVE-2021-3162 | High | 7.8 | 2021-01-15 | Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation. |
CVE-2020-35733 | High | 7.5 | 2021-01-15 | An issue was discovered in Erlang/OTP before 23.2.2. The ssl application 10.2 accepts and trusts an invalid X.509 certificate chain to a trusted root Certifica… |
CVE-2020-24025 | Medium | 5.3 | 2021-01-11 | Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path. |
CVE-2020-25680 | Medium | 5.4 | 2021-01-07 | A flaw was found in JBCS httpd in version 2.4.37 SP3, where it uses a back-end worker SSL certificate with the keystore file's ID is 'unknown'. The validation… |
CVE-2019-16281 | High | 7.5 | 2020-12-30 | Ptarmigan before 0.2.3 lacks API token validation, e.g., an "if (token === apiToken) {return true;} return false;" code block. |
CVE-2020-8289 | High | 7.8 | 2020-12-27 | Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in `bztransmit` helper due to hardc… |
CVE-2020-5684 | Medium | 4.8 | 2020-12-24 | iSM client versions from V5.1 prior to V12.1 running on NEC Storage Manager or NEC Storage Manager Express does not verify a server certificate properly, which… |
CVE-2020-29663 | Critical | 9.1 | 2020-12-15 | Icinga 2 v2.8.0 through v2.11.7 and v2.12.2 has an issue where revoked certificates due for renewal will automatically be renewed, ignoring the CRL. This issue… |
CVE-2020-8286 | High | 7.5 | 2020-12-14 | curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response. |
CVE-2012-0955 | Medium | 6.8 | 2020-12-02 | software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. software-properti… |
CVE-2020-29440 | Medium | 4.6 | 2020-11-30 | Tesla Model X vehicles before 2020-11-23 do not perform certificate validation during an attempt to pair a new key fob with the body control module (BCM). This… |
CVE-2020-28942 | Medium | 4.3 | 2020-11-19 | An issue exists in PrimeKey EJBCA before 7.4.3 when enrolling with EST while proxied through an RA over the Peers protocol. As a part of EJBCA's domain securit… |
CVE-2020-8279 | High | 7.4 | 2020-11-19 | Missing validation of server certificates for out-going connections in Nextcloud Social < 0.4.0 allowed a man-in-the-middle attack. |
CVE-2020-28362 | High | 7.5 | 2020-11-18 | Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. |
CVE-2020-27589 | High | 7.5 | 2020-11-06 | Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases. |
CVE-2020-27649 | High | 8.3 | 2020-10-29 | Improper certificate validation vulnerability in OpenVPN client in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof… |
CVE-2020-27648 | High | 8.3 | 2020-10-29 | Improper certificate validation vulnerability in OpenVPN client in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers t… |
CVE-2019-8531 | Critical | 9.8 | 2020-10-27 | A validation issue existed in Trust Anchor Management. This issue was addressed with improved validation. This issue is fixed in watchOS 5.2, macOS Mojave 10.1… |
CVE-2019-8642 | Low | 3.3 | 2020-10-27 | An issue existed in the handling of S-MIME certificates. This issue was addressed with improved validation of S-MIME certificates. This issue is fixed in macOS… |
CVE-2019-17007 | High | 7.5 | 2020-10-22 | In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service. |
CVE-2020-9868 | Critical | 9.1 | 2020-10-22 | A certificate validation issue existed when processing administrator added certificates. This issue was addressed with improved certificate validation. This is… |
CVE-2020-3557 | Medium | 5.3 | 2020-10-21 | A vulnerability in the host input API daemon of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to cause a den… |
CVE-2020-3994 | High | 7.4 | 2020-10-20 | VMware vCenter Server (6.7 before 6.7u3, 6.6 before 6.5u3k) contains a session hijack vulnerability in the vCenter Server Appliance Management Interface update… |
CVE-2020-1675 | High | 8.3 | 2020-10-16 | When Security Assertion Markup Language (SAML) authentication is enabled, Juniper Networks Mist Cloud UI might incorrectly process invalid authentication certi… |
CVE-2020-13955 | Medium | 5.9 | 2020-10-09 | HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calci… |
CVE-2020-26117 | High | 8.1 | 2020-09-27 | In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as autho… |
CVE-2016-11086 | High | 7.4 | 2020-09-24 | lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot be found, which all… |
CVE-2020-24560 | High | 7.5 | 2020-09-24 | An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to c… |
CVE-2020-15604 | High | 7.5 | 2020-09-24 | An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to c… |
CVE-2020-4340 | Medium | 4.3 | 2020-09-23 | IBM Security Secret Server prior to 10.9 could allow an attacker to bypass SSL security due to improper certificate validation. IBM X-Force ID: 178180. |
CVE-2020-24619 | Medium | 5.9 | 2020-09-22 | In mainwindow.cpp in Shotcut before 20.09.13, the upgrade check misuses TLS because of setPeerVerifyMode(QSslSocket::VerifyNone). A man-in-the-middle attacker… |
CVE-2020-6781 | Medium | 6.8 | 2020-09-16 | Improper certificate validation for certain connections in the Bosch Smart Home System App for iOS prior to version 9.17.1 potentially allows to intercept vide… |
CVE-2020-2253 | Medium | 4.8 | 2020-09-16 | Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server. |
CVE-2020-2252 | Medium | 4.8 | 2020-09-16 | Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server. |
CVE-2020-25276 | High | 7.3 | 2020-09-11 | An issue was discovered in PrimeKey EJBCA 6.x and 7.x before 7.4.1. When using a client certificate to enroll over the EST protocol, no revocation check is per… |
CVE-2018-19946 | Medium | 4.2 | 2020-09-11 | The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this improper certificate validation vulnerability could allow an at… |
CVE-2020-11617 | Medium | 5.9 | 2020-08-31 | The RSS application on THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes doesn't validate the SSL certificates of RSS servers, which a… |
CVE-2020-24715 | Critical | 9.8 | 2020-08-27 | The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, native Python code is used that lacks a comparison of the… |
CVE-2020-24714 | Critical | 9.8 | 2020-08-27 | The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, the openssl binary is called without the -verify_hostname… |
CVE-2020-24661 | Medium | 5.9 | 2020-08-26 | GNOME Geary before 3.36.3 mishandles pinned TLS certificate verification for IMAP and SMTP services using invalid TLS certificates (e.g., self-signed certifica… |
CVE-2020-5913 | High | 7.4 | 2020-08-26 | In versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, the BIG-IP Client or Server SSL profile ignores revoked ce… |
CVE-2019-18847 | Critical | 9.8 | 2020-08-26 | Enterprise Access Client Auto-Updater allows for Remote Code Execution prior to version 2.0.1. |
CVE-2020-15498 | Medium | 5.9 | 2020-08-26 | An issue was discovered on ASUS RT-AC1900P routers before 3.0.0.4.385_20253. The router accepts an arbitrary server certificate for a firmware update. The culp… |
CVE-2020-16197 | Medium | 4.3 | 2020-08-25 | An issue was discovered in Octopus Deploy 3.4. A deployment target can be configured with an Account or Certificate that is outside the scope of the deployment… |
CVE-2020-24613 | Medium | 6.8 | 2020-08-24 | wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in tls13.c. This is an incorrect implementa… |
CVE-2020-17366 | High | 7.4 | 2020-08-05 | An issue was discovered in NLnet Labs Routinator 0.1.0 through 0.7.1. It allows remote attackers to bypass intended access restrictions or to cause a denial of… |
CVE-2020-15134 | High | 8.0 | 2020-07-31 | Faye before version 1.4.0, there is a lack of certification validation in TLS handshakes. Faye uses em-http-request and faye-websocket in the Ruby version of i… |
CVE-2020-15133 | High | 8.0 | 2020-07-31 | In faye-websocket before version 0.11.0, there is a lack of certification validation in TLS handshakes. The `Faye::WebSocket::Client` class uses the `EM::Conne… |
CVE-2020-16164 | High | 7.4 | 2020-07-30 | An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14.28. It allows remote attackers to bypass intended access restrictions or to ca… |
CVE-2020-16163 | Critical | 9.1 | 2020-07-30 | An issue was discovered in RIPE NCC RPKI Validator 3.x before 3.1-2020.07.06.14.28. RRDP fetches proceed even with a lack of validation of a TLS HTTPS endpoint… |
CVE-2020-16162 | High | 7.5 | 2020-07-30 | An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14.28. Missing validation checks on CRL presence or CRL staleness in the X509-bas… |
CVE-2020-10925 | High | 8.8 | 2020-07-28 | This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700 V1.0.4.84… |
CVE-2020-6529 | Medium | 4.3 | 2020-07-22 | Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to leak cross-origin data vi… |
CVE-2019-12000 | Medium | 6.6 | 2020-07-17 | HPE has found a potential Remote Access Restriction Bypass in HPE MSE Msg Gw application E-LTU prior to version 3.2 when HTTPS is used between the USSD and an… |
CVE-2020-15813 | High | 8.1 | 2020-07-17 | Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group database stored in LDAP. The connection configu… |
CVE-2020-14039 | Medium | 5.3 | 2020-07-17 | In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equa… |
CVE-2020-15720 | Medium | 6.8 | 2020-07-14 | In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-cod… |
CVE-2020-15719 | Medium | 4.2 | 2020-07-14 | libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN e… |
CVE-2020-15526 | Medium | 5.9 | 2020-07-09 | In Redgate SQL Monitor 7.1.4 through 10.1.6 (inclusive), the scope for disabling some TLS security certificate checks can extend beyond that defined by various… |
CVE-2020-12421 | Medium | 6.5 | 2020-07-09 | When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.)… |
CVE-2019-20894 | High | 7.5 | 2020-07-02 | Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERR_BAD_SSL_CLIENT_AUTH_CERT shou… |
CVE-2020-5909 | Medium | 5.4 | 2020-07-02 | In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the… |
CVE-2020-15047 | Medium | 5.9 | 2020-06-25 | MSA/SMTP.cpp in Trojita before 0.8 ignores certificate-verification errors, which allows man-in-the-middle attackers to spoof SMTP servers. |
CVE-2020-5367 | High | 7.4 | 2020-06-23 | Dell EMC Unisphere for PowerMax versions prior to 9.1.0.17, Dell EMC Unisphere for PowerMax Virtual Appliance versions prior to 9.1.0.17, and PowerMax OS Relea… |
CVE-2020-14981 | Medium | 5.9 | 2020-06-22 | The ThreatTrack VIPRE Password Vault app through 1.100.1090 for iOS has Missing SSL Certificate Validation. |
CVE-2020-14980 | Medium | 5.9 | 2020-06-22 | The Sophos Secure Email application through 3.9.4 for Android has Missing SSL Certificate Validation. |
CVE-2017-18918 | Medium | 4.9 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname. |
CVE-2016-11076 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL. |
CVE-2017-18911 | Critical | 9.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server. |
CVE-2017-18909 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory. |
CVE-2020-3342 | High | 8.8 | 2020-06-18 | A vulnerability in the software update feature of Cisco Webex Meetings Desktop App for Mac could allow an unauthenticated, remote attacker to execute arbitrary… |
CVE-2020-4320 | Medium | 6.5 | 2020-06-16 | IBM MQ Appliance and IBM MQ AMQP Channels 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD do not correctly block or allow clients based on the certificate distinguished name… |
CVE-2019-16252 | Medium | 5.9 | 2020-06-12 | Missing SSL Certificate Validation in the Nutfind.com application through 3.9.12 for Android allows a man-in-the-middle attacker to sniff and manipulate all AP… |
CVE-2020-2033 | Medium | 5.3 | 2020-06-10 | When the pre-logon feature is enabled, a missing certification validation in Palo Alto Networks GlobalProtect app can disclose the pre-logon authentication coo… |
CVE-2020-0119 | Medium | 5.3 | 2020-06-10 | In addOrUpdateNetworkInternal and related functions of WifiConfigManager.java, there is a possible man in the middle attack due to improper certificate validat… |
CVE-2020-9040 | High | 7.5 | 2020-06-08 | Couchbase Server Java SDK before 2.7.1.1 allows a potential attacker to forge an SSL certificate and pose as the intended peer. An attacker can leverage this f… |
CVE-2020-8172 | High | 7.4 | 2020-06-08 | TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0. |