CWE-295 · Improper Certificate Validation (page 12)
Page 12 of 17 — CVEs classified under CWE-295, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-13254 | Medium | 5.9 | 2020-06-03 | An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed… |
CVE-2020-13245 | Medium | 5.9 | 2020-05-28 | Certain NETGEAR devices are affected by Missing SSL Certificate Validation. This affects R7000 1.0.9.6_1.2.19 through 1.0.11.100_10.2.10, and possibly R6120, R… |
CVE-2020-13645 | Medium | 6.5 | 2020-05-28 | In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the applicat… |
CVE-2020-13616 | Medium | 5.9 | 2020-05-26 | The boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification. |
CVE-2020-13615 | Medium | 5.9 | 2020-05-26 | lib/QoreSocket.cpp in Qore before 0.9.4.2 lacks hostname verification for X.509 certificates. |
CVE-2020-13614 | Medium | 5.9 | 2020-05-26 | An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification. |
CVE-2020-13482 | High | 7.4 | 2020-05-25 | EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the libra… |
CVE-2020-1113 | Medium | 5.3 | 2020-05-21 | A security feature bypass vulnerability exists in Microsoft Windows when the Task Scheduler service fails to properly verify client connections over RPC. An at… |
CVE-2020-13163 | High | 7.4 | 2020-05-19 | em-imap 0.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The ho… |
CVE-2020-1758 | Medium | 5.3 | 2020-05-15 | A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. Thi… |
CVE-2020-8156 | High | 7.0 | 2020-05-12 | A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack. |
CVE-2020-10059 | Medium | 4.8 | 2020-05-11 | The UpdateHub module disables DTLS peer checking, which allows for a man in the middle attack. This is mitigated by firmware images requiring valid signatures… |
CVE-2020-12637 | Critical | 9.8 | 2020-05-09 | Zulip Desktop before 5.2.0 has Missing SSL Certificate Validation because all validation was inadvertently disabled during an attempt to recognize the ignoreCe… |
CVE-2020-11050 | Critical | 9.0 | 2020-05-07 | In Java-WebSocket less than or equal to 1.4.1, there is an Improper Validation of Certificate with Host Mismatch where WebSocketClient does not perform SSL hos… |
CVE-2020-2187 | Medium | 5.6 | 2020-05-06 | Jenkins Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed certificates and does not perform hostname validation, enabling man-in-the-mid… |
CVE-2020-12144 | Medium | 6.0 | 2020-05-05 | The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validated. This makes it possible for someone to establish a TLS co… |
CVE-2020-12143 | Medium | 6.0 | 2020-05-05 | The certificate used to identify Orchestrator to EdgeConnect devices is not validated, which makes it possible for someone to establish a TLS connection from E… |
CVE-2019-19101 | Medium | 6.5 | 2020-04-29 | A missing secure communication definition and an incomplete TLS validation in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, < 4.3… |
CVE-2020-1952 | Critical | 9.8 | 2020-04-27 | An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients cou… |
CVE-2020-9488 | Low | 3.7 | 2020-04-27 | Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-mid… |
CVE-2020-5864 | High | 7.4 | 2020-04-23 | In versions of NGINX Controller prior to 3.2.0, communication between NGINX Controller and NGINX Plus instances skip TLS verification by default. |
CVE-2020-11806 | Medium | 5.9 | 2020-04-23 | In MailStore Outlook Add-in (and Email Archive Outlook Add-in) through 12.1.2, the login process does not validate the validity of the certificate presented by… |
CVE-2020-11792 | High | 7.5 | 2020-04-15 | NETGEAR R8900, R9000, RAX120, and XR700 devices before 2020-01-20 are affected by Transport Layer Security (TLS) certificate private key disclosure. |
CVE-2019-4654 | Medium | 4.8 | 2020-04-15 | IBM QRadar 7.3.0 to 7.3.3 Patch 2 does not validate, or incorrectly validates, a certificate which could allow an attacker to spoof a trusted entity by using a… |
CVE-2020-7922 | Medium | 6.4 | 2020-04-09 | X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to Mongo… |
CVE-2020-11580 | Critical | 9.1 | 2020-04-06 | An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients wh… |
CVE-2019-17560 | Critical | 9.1 | 2020-03-30 | The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downlo… |
CVE-2019-3762 | High | 7.5 | 2020-03-18 | Data Protection Central versions 1.0, 1.0.1, 18.1, 18.2, and 19.1 contains an Improper Certificate Chain of Trust Vulnerability. A remote unauthenticated attac… |
CVE-2019-11688 | High | 7.4 | 2020-03-18 | An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl accept any certificate for asusto… |
CVE-2020-10659 | Medium | 4.3 | 2020-03-18 | Entrust Entelligence Security Provider (ESP) before 10.0.60 on Windows mishandles errors during SSL Certificate Validation, leading to situations where (for ex… |
CVE-2020-7919 | High | 7.5 | 2020-03-16 | Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resul… |
CVE-2020-6175 | Medium | 5.9 | 2020-03-16 | Citrix SD-WAN 10.2.x before 10.2.6 and 11.0.x before 11.0.3 has Missing SSL Certificate Validation. |
CVE-2020-9321 | High | 7.5 | 2020-03-16 | configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate contents from providers before logging. |
CVE-2019-10091 | High | 7.4 | 2020-03-16 | When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verification of the entries in the certificate… |
CVE-2020-1887 | Critical | 9.1 | 2020-03-13 | Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to MITM osquery traffic in the absence of… |
CVE-2012-1096 | Medium | 5.5 | 2020-03-10 | NetworkManager 0.9 and earlier allows local users to use other users' certificates or private keys when making a connection via the file path when adding a new… |
CVE-2020-8987 | High | 7.4 | 2020-03-09 | Avast AntiTrack before 1.5.1.172 and AVG Antitrack before 2.0.0.178 proxies traffic to HTTPS sites but does not validate certificates, and thus a man-in-the-mi… |
CVE-2020-3155 | High | 7.4 | 2020-03-04 | A vulnerability in the SSL implementation of the Cisco Intelligent Proximity solution could allow an unauthenticated, remote attacker to view or alter informat… |
CVE-2020-9434 | Critical | 9.1 | 2020-02-27 | openssl_x509_check_ip_asc in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values. |
CVE-2020-9433 | Critical | 9.1 | 2020-02-27 | openssl_x509_check_email in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values. |
CVE-2020-9432 | Critical | 9.1 | 2020-02-27 | openssl_x509_check_host in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values. |
CVE-2020-7043 | Critical | 9.1 | 2020-02-27 | An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2. tunnel.c mishandles certificate validation because hostname comparisons do… |
CVE-2020-7042 | Medium | 5.3 | 2020-02-27 | An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check ope… |
CVE-2020-7041 | Medium | 5.3 | 2020-02-27 | An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because an X509_check_host neg… |
CVE-2020-7942 | Medium | 6.5 | 2020-02-19 | Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate al… |
CVE-2019-20455 | Medium | 5.9 | 2020-02-14 | Gateways/Gateway.php in Heartland & Global Payments PHP SDK before 2.0.0 does not enforce SSL certificate validations. |
CVE-2019-15604 | High | 7.5 | 2020-02-07 | Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate |
CVE-2020-7956 | Critical | 9.8 | 2020-01-31 | HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to… |
CVE-2020-5526 | Medium | 5.9 | 2020-01-31 | The AWMS Mobile App for Android 2.0.0 to 2.0.5 and for iOS 2.0.0 to 2.0.8 does not verify X.509 certificates from servers, which allows man-in-the-middle attac… |
CVE-2020-7904 | High | 7.4 | 2020-01-30 | In JetBrains IntelliJ IDEA before 2019.3, some Maven repositories were accessed via HTTP instead of HTTPS. |
CVE-2014-3230 | Medium | 5.9 | 2020-01-28 | The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server… |
CVE-2020-5523 | High | 7.4 | 2020-01-28 | Android App 'MyPallete' and some of the Android banking applications based on 'MyPallete' do not verify X.509 certificates from servers, and also do not proper… |
CVE-2015-0294 | High | 7.5 | 2020-01-27 | GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate. |
CVE-2006-7246 | Medium | 6.8 | 2020-01-27 | NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used. |
CVE-2020-5522 | High | 7.4 | 2020-01-27 | The kantan netprint App for Android 2.0.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof server… |
CVE-2020-5521 | High | 7.4 | 2020-01-27 | The kantan netprint App for iOS 2.0.2 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers an… |
CVE-2020-5520 | High | 7.4 | 2020-01-27 | The netprint App for iOS 3.2.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtai… |
CVE-2017-14806 | Low | 3.7 | 2020-01-27 | A Improper Certificate Validation vulnerability in susestudio-common of SUSE Studio onsite allows remote attackers to MITM connections to the repositories, whi… |
CVE-2011-2669 | Medium | 6.5 | 2020-01-21 | Mozilla Firefox prior to 3.6 has a DoS vulnerability due to an issue in the validation of certificates. |
CVE-2020-3940 | Medium | 5.9 | 2020-01-17 | VMware Workspace ONE SDK and dependent mobile application updates address sensitive information disclosure vulnerability. |
CVE-2020-1929 | High | 7.5 | 2020-01-15 | The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust verification. However this configuration is not respected and… |
CVE-2012-1316 | Medium | 5.9 | 2020-01-15 | Cisco IronPort Web Security Appliance does not check for certificate revocation which could lead to MITM attacks |
CVE-2020-0601 | High | 8.1 | 2020-01-14 | A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit t… |
CVE-2014-0161 | Medium | 5.9 | 2020-01-02 | ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as s… |
CVE-2014-0104 | Medium | 5.9 | 2020-01-02 | In fence-agents before 4.0.17 does not verify remote SSL certificates in the fence_cisco_ucs.py script which can potentially allow for man-in-the-middle attack… |
CVE-2013-0264 | High | 7.5 | 2019-12-30 | An import error was introduced in Cumin in the code refactoring in r5310. Server certificate validation is always disabled when connecting to Aviary servers, e… |
CVE-2019-6032 | High | 7.4 | 2019-12-26 | The NTV News24 prior to Ver.3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sen… |
CVE-2019-6687 | High | 7.4 | 2019-12-23 | On versions 15.0.0-15.0.1.1, the BIG-IP ASM Cloud Security Services profile uses a built-in verification mechanism that fails to properly authenticate the X.50… |
CVE-2019-16561 | High | 7.1 | 2019-12-17 | Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire… |
CVE-2019-16558 | High | 8.2 | 2019-12-17 | Jenkins Spira Importer Plugin 3.2.3 and earlier disables SSL/TLS certificate validation for the Jenkins master JVM. |
CVE-2018-11751 | Medium | 5.4 | 2019-12-16 | Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0. |
CVE-2019-18826 | Critical | 9.8 | 2019-12-16 | Barco ClickShare Button R9861500D01 devices before 1.9.0 have Improper Following of a Certificate's Chain of Trust. The embedded 'dongle_bridge' program used t… |
CVE-2014-3495 | High | 7.5 | 2019-12-13 | duplicity 0.6.24 has improper verification of SSL certificates |
CVE-2019-11554 | Medium | 5.9 | 2019-12-06 | The Audible application through 2.34.0 for Android has Missing SSL Certificate Validation for Adobe SDKs, allowing MITM attackers to cause a denial of service. |
CVE-2019-14910 | Critical | 9.8 | 2019-12-05 | A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (… |
CVE-2011-2207 | Medium | 5.3 | 2019-11-27 | dirmngr before 2.1.0 improperly handles certain system calls, which allows remote attackers to cause a denial of service (DOS) via a specially-crafted certific… |
CVE-2019-19271 | High | 7.5 | 2019-11-26 | An issue was discovered in tls_verify_crl in ProFTPD before 1.3.6. A wrong iteration variable, used when checking a client certificate against CRL entries (ins… |
CVE-2019-19270 | High | 7.5 | 2019-11-26 | An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. Failure to check for the appropriate field of a CRL entry (checking twice for subject, rat… |
CVE-2012-5518 | High | 7.5 | 2019-11-25 | vdsm: certificate generation upon node creation allowing vdsm to start and serve requests from anyone who has a matching key (and certificate) |
CVE-2014-2902 | High | 7.5 | 2019-11-21 | wolfssl before 3.2.0 does not properly authorize CA certificate for signing other certificates. |
CVE-2014-2901 | High | 7.5 | 2019-11-21 | wolfssl before 3.2.0 does not properly issue certificates for a server's hostname. |
CVE-2012-6071 | High | 7.5 | 2019-11-19 | nuSOAP before 0.7.3-5 does not properly check the hostname of a cert. |
CVE-2019-5102 | Medium | 4.0 | 2019-11-18 | An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, t… |
CVE-2019-5101 | Medium | 4.0 | 2019-11-18 | An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, t… |
CVE-2010-4533 | Critical | 9.8 | 2019-11-13 | offlineimap before 6.3.4 added support for SSL server certificate validation but it is still possible to use SSL v2 protocol, which is a flawed protocol with m… |
CVE-2010-4532 | Medium | 5.9 | 2019-11-13 | offlineimap before 6.3.2 does not check for SSL server certificate validation when "ssl = yes" option is specified which can allow man-in-the-middle attacks. |
CVE-2014-8167 | Medium | 5.9 | 2019-11-13 | vdsm and vdsclient does not validate certficate hostname from another vdsm which could facilitate a man-in-the-middle attack |
CVE-2014-7143 | High | 7.5 | 2019-11-12 | Python Twisted 14.0 trustRoot is not respected in HTTP client |
CVE-2009-3552 | Low | 3.1 | 2019-11-09 | In RHEV-M VDC 2.2.0, it was found that the SSL certificate was not verified when using the client-side Red Hat Enterprise Virtualization Manager interface (a W… |
CVE-2019-16209 | High | 7.4 | 2019-11-08 | A vulnerability, in The ReportsTrustManager class of Brocade SANnav versions before v2.0, could allow an attacker to perform a man-in-the-middle attack against… |
CVE-2019-3685 | High | 7.4 | 2019-11-05 | Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client binary |
CVE-2013-2255 | Medium | 5.9 | 2019-11-01 | HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates. |
CVE-2019-18633 | Critical | 9.8 | 2019-10-30 | European Commission eIDAS-Node Integration Package before 2.3.1 has Missing Certificate Validation because a certain ExplicitKeyTrustEvaluator return value is… |
CVE-2019-18632 | Critical | 9.8 | 2019-10-30 | European Commission eIDAS-Node Integration Package before 2.3.1 allows Certificate Faking because an attacker can sign a manipulated SAML response with a forge… |
CVE-2018-21029 | Critical | 9.8 | 2019-10-30 | systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication (SNI) is not sent, and there… |
CVE-2010-4237 | Medium | 5.9 | 2019-10-29 | Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate signed by a Certificat… |
CVE-2019-5538 | Medium | 5.9 | 2019-10-28 | Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vC… |
CVE-2019-5537 | Medium | 5.9 | 2019-10-28 | Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vC… |
CVE-2019-11674 | Medium | 5.9 | 2019-10-22 | Man-in-the-middle vulnerability in Micro Focus Self Service Password Reset, affecting all versions prior to 4.4.0.4. The vulnerability could exploit invalid ce… |
CVE-2019-10446 | High | 8.2 | 2019-10-16 | Jenkins Cadence vManager Plugin 2.7.0 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM. |