CWE-295 · Improper Certificate Validation (page 13)
Page 13 of 17 — CVEs classified under CWE-295, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10444 | Medium | 6.5 | 2019-10-16 | Jenkins Bumblebee HP ALM Plugin 4.1.3 and earlier unconditionally disabled SSL/TLS and hostname verification for connections to HP ALM. |
CVE-2019-14823 | High | 7.4 | 2019-10-14 | A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the r… |
CVE-2019-0054 | Medium | 6.8 | 2019-10-09 | An Improper Certificate Validation weakness in the SRX Series Application Identification (app-id) signature update client of Juniper Networks Junos OS allows a… |
CVE-2019-5506 | Medium | 5.9 | 2019-10-09 | Clustered Data ONTAP versions 9.0 and higher do not enforce hostname verification under certain circumstances making them susceptible to impersonation via man-… |
CVE-2019-16263 | High | 7.4 | 2019-10-07 | The Twitter Kit framework through 3.4.2 for iOS does not properly validate the api.twitter.com SSL certificate. Although the certificate chain must contain one… |
CVE-2019-15042 | High | 7.5 | 2019-10-01 | An issue was discovered in JetBrains TeamCity 2018.2.4. It had no SSL certificate validation for some external https connections. This was fixed in TeamCity 20… |
CVE-2019-1231 | Medium | 5.9 | 2019-09-11 | An information disclosure vulnerability exists in the way Rome SDK handles server SSL/TLS certificate validation, aka 'Rome SDK Information Disclosure Vulnerab… |
CVE-2019-11497 | High | 7.5 | 2019-09-10 | In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entered as part of the reference creation, XDCR did not parse and check the certifica… |
CVE-2019-16179 | Medium | 5.3 | 2019-09-09 | Limesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration. |
CVE-2016-10937 | High | 7.5 | 2019-09-08 | IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate. |
CVE-2019-3751 | Medium | 6.4 | 2019-09-03 | Dell EMC Enterprise Copy Data Management (eCDM) versions 1.0, 1.1, 2.0, 2.1, and 3.0 contain a certificate validation vulnerability. An unauthenticated remote… |
CVE-2017-18588 | Medium | 5.3 | 2019-08-26 | An issue was discovered in the security-framework crate before 0.1.12 for Rust. Hostname verification for certificates does not occur if ClientBuilder uses cus… |
CVE-2016-10931 | High | 8.1 | 2019-08-26 | An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off… |
CVE-2019-15525 | High | 8.1 | 2019-08-23 | There is Missing SSL Certificate Validation in the pw3270 terminal emulator before version 5.1. |
CVE-2019-1948 | Medium | 5.9 | 2019-08-21 | A vulnerability in Cisco Webex Meetings Mobile (iOS) could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data by usin… |
CVE-2019-5280 | Medium | 6.5 | 2019-08-13 | The SIP TLS module of Huawei CloudLink Phone 7900 with V600R019C10 has a TLS certificate verification vulnerability. Due to insufficient verification of specif… |
CVE-2019-14516 | High | 7.4 | 2019-08-13 | The mAadhaar application 1.2.7 for Android lacks SSL Certificate Validation, leading to man-in-the-middle attacks against requests for FAQs or Help. |
CVE-2019-10382 | Medium | 6.5 | 2019-08-07 | Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM. |
CVE-2019-10381 | High | 7.5 | 2019-08-07 | Jenkins Codefresh Integration Plugin 1.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM. |
CVE-2017-18479 | Medium | 6.5 | 2019-08-05 | In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209). |
CVE-2019-3890 | High | 8.1 | 2019-08-01 | It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential informatio… |
CVE-2019-14334 | Medium | 5.5 | 2019-08-01 | An issue was discovered on D-Link 6600-AP, DWL-3600AP, and DWL-8610AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated Certificate and RSA Private K… |
CVE-2019-7615 | High | 7.4 | 2019-07-30 | A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the 'serve… |
CVE-2019-1552 | Low | 3.3 | 2019-07-30 | OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory… |
CVE-2019-11727 | Medium | 5.3 | 2019-07-23 | A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only… |
CVE-2019-1010206 | Medium | 5.9 | 2019-07-23 | OSS Http Request (Apache Cordova Plugin) 6 is affected by: Missing SSL certificate validation. The impact is: certificate spoofing. The component is: use this… |
CVE-2019-1940 | Medium | 5.9 | 2019-07-17 | A vulnerability in the Web Services Management Agent (WSMA) feature of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker… |
CVE-2019-1010275 | Critical | 9.8 | 2019-07-17 | helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation. The impact is: Unauthorized clients could connect to the server because self-signed… |
CVE-2019-1006 | High | 7.5 | 2019-07-15 | An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAML tokens… |
CVE-2019-11242 | High | 8.1 | 2019-07-12 | A man-in-the-middle vulnerability related to vCenter access was found in Cohesity DataPlatform version 5.x and 6.x prior to 6.1.1c. Cohesity clusters did not v… |
CVE-2019-9148 | Medium | 4.3 | 2019-07-09 | Mailvelope prior to 3.3.0 accepts or operates with invalid PGP public keys: Mailvelope allows importing keys that contain users without a valid self-certificat… |
CVE-2019-5961 | High | 7.4 | 2019-07-05 | The Android App 'Tootdon for Mastodon' version 3.4.1 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers… |
CVE-2019-1886 | High | 8.6 | 2019-07-04 | A vulnerability in the HTTPS decryption feature of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to cause a denial of serv… |
CVE-2019-13050 | High | 7.5 | 2019-06-29 | Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver confi… |
CVE-2019-4150 | Low | 3.7 | 2019-06-25 | IBM Security Access Manager 9.0.1 through 9.0.6 does not validate, or incorrectly validates, a certificate which could allow an attacker to spoof a trusted ent… |
CVE-2017-17945 | Critical | 9.1 | 2019-06-24 | The ASUS HiVivo aspplication before 5.6.27 for ASUS Watch has Missing SSL Certificate Validation. |
CVE-2017-17944 | Critical | 9.1 | 2019-06-20 | The ASUS Vivobaby application before 1.1.09 for Android has Missing SSL Certificate Validation. |
CVE-2019-12855 | High | 7.4 | 2019-06-16 | In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connec… |
CVE-2019-3875 | Medium | 6.5 | 2019-06-12 | A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL lis… |
CVE-2019-10334 | Medium | 6.5 | 2019-06-11 | Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM when MultipartUtility.java is used… |
CVE-2018-20135 | High | 8.1 | 2019-06-07 | Samsung Galaxy Apps before 4.4.01.7 allows modification of the hostname used for load balancing on installations of applications through a man-in-the-middle at… |
CVE-2019-12496 | High | 7.5 | 2019-05-31 | An issue was discovered in Hybrid Group Gobot before 1.13.0. The mqtt subsystem skips verification of root CA certificates by default. |
CVE-2019-4264 | Medium | 5.9 | 2019-05-29 | IBM QRadar SIEM 7.2.8 WinCollect could allow an attacker to obtain sensitive information by spoofing a trusted entity using man in the middle techniques due to… |
CVE-2019-12098 | High | 7.4 | 2019-05-15 | In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in k… |
CVE-2019-11550 | Medium | 5.9 | 2019-05-08 | Citrix SD-WAN 10.2.x before 10.2.1 and NetScaler SD-WAN 10.0.x before 10.0.7 have Improper Certificate Validation. |
CVE-2018-5408 | High | 7.4 | 2019-05-08 | The PrinterLogic Print Management software, versions up to and including 18.3.1.96, does not validate, or incorrectly validates, the PrinterLogic management po… |
CVE-2019-1859 | High | 7.2 | 2019-05-03 | A vulnerability in the Secure Shell (SSH) authentication process of Cisco Small Business Switches software could allow an attacker to bypass client-side certif… |
CVE-2019-1590 | High | 8.1 | 2019-05-03 | A vulnerability in the Transport Layer Security (TLS) certificate validation functionality of Cisco Nexus 9000 Series Application Centric Infrastructure (ACI)… |
CVE-2019-10317 | Medium | 5.9 | 2019-04-30 | Jenkins SiteMonitor Plugin 0.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM. |
CVE-2019-10314 | Medium | 5.9 | 2019-04-30 | Jenkins Koji Plugin disables SSL/TLS and hostname verification globally for the Jenkins master JVM. |
CVE-2019-11324 | High | 7.5 | 2019-04-18 | The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificate… |
CVE-2018-20200 | Medium | 5.9 | 2019-04-18 | CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to bypass certificate pinning by changing SSLContext and the boolean val… |
CVE-2019-10914 | Critical | 9.8 | 2019-04-08 | pubRsaDecryptSignedElementExt in MatrixSSL 4.0.1 Open, as used in Inside Secure TLS Toolkit, has a stack-based buffer overflow during X.509 certificate verific… |
CVE-2018-4436 | High | 7.5 | 2019-04-03 | A certificate validation issue existed in configuration profiles. This was addressed with additional checks. This issue affected versions prior to iOS 12.1.1… |
CVE-2019-1757 | Medium | 5.9 | 2019-03-28 | A vulnerability in the Cisco Smart Call Home feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to gain unauthorized read… |
CVE-2019-1748 | High | 7.4 | 2019-03-28 | A vulnerability in the Cisco Network Plug-and-Play (PnP) agent of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker… |
CVE-2018-5926 | Critical | 9.1 | 2019-03-27 | A potential vulnerability has been identified in HP Remote Graphics Software’s certificate authentication process version 7.5.0 and earlier. |
CVE-2019-3814 | High | 7.7 | 2019-03-27 | It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote attacker in possession of a valid certifi… |
CVE-2019-3841 | High | 7.4 | 2019-03-25 | Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into PVCs from container… |
CVE-2019-8351 | Critical | 9.1 | 2019-03-21 | Heimdal Thor Agent 2.5.17x before 2.5.173 does not verify X.509 certificates from TLS servers, which allows remote attackers to spoof servers and obtain sensit… |
CVE-2019-6702 | Medium | 5.9 | 2019-03-21 | The MasterCard Qkr! app before 5.0.8 for iOS has Missing SSL Certificate Validation. NOTE: this CVE only applies to obsolete versions from 2016 or earlier. |
CVE-2019-5729 | High | 8.1 | 2019-03-21 | Splunk-SDK-Python before 1.6.6 does not properly verify untrusted TLS server certificates, which could result in man-in-the-middle attacks. |
CVE-2018-6517 | High | 7.5 | 2019-03-21 | Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's known_hosts file witho… |
CVE-2018-11747 | Critical | 9.8 | 2019-03-21 | Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container. In version 1.4.0, a unique certificate will be genera… |
CVE-2018-12205 | Medium | 6.8 | 2019-03-14 | Improper certificate validation in Platform Sample/ Silicon Reference firmware for 8th Generation Intel(R) Core(tm) Processor, 7th Generation Intel(R) Core(tm)… |
CVE-2019-3777 | High | 8.0 | 2019-03-07 | Pivotal Application Service (PAS), versions 2.2.x prior to 2.2.12, 2.3.x prior to 2.3.7 and 2.4.x prior to 2.4.3, contain apps manager that uses a cloud contro… |
CVE-2019-6592 | Critical | 9.1 | 2019-02-26 | On BIG-IP 14.1.0-14.1.0.1, TMM may restart and produce a core file when validating SSL certificates in client SSL or server SSL profiles. |
CVE-2019-6266 | Critical | 9.8 | 2019-02-25 | Cordaware bestinformed Microsoft Windows client before 6.2.1.0 is affected by insecure SSL certificate verification and insecure access patterns. These issues… |
CVE-2019-1683 | High | 7.4 | 2019-02-25 | A vulnerability in the certificate handling component of the Cisco SPA112, SPA525, and SPA5X5 Series IP Phones could allow an unauthenticated, remote attacker… |
CVE-2019-7728 | High | 7.5 | 2019-02-22 | An issue was discovered in the Bosch Smart Camera App before 1.3.1 for Android. Due to improperly implemented TLS certificate checks, a malicious actor could p… |
CVE-2019-1659 | High | 7.4 | 2019-02-21 | A vulnerability in the Identity Services Engine (ISE) integration feature of Cisco Prime Infrastructure (PI) could allow an unauthenticated, remote attacker to… |
CVE-2019-8337 | Medium | 5.3 | 2019-02-13 | In msmtp 1.8.2 and mpop 1.4.3, when tls_trust_file has its default configuration, certificate-verification results are not properly checked. |
CVE-2019-1003009 | High | 7.4 | 2019-02-06 | An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/Ac… |
CVE-2017-1200 | Low | 3.7 | 2019-02-05 | IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) does not validate, or incorrectly validates, a certificate.This weakness might allow an attacker… |
CVE-2019-3807 | Low | 3.7 | 2019-01-29 | An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers w… |
CVE-2018-20245 | High | 7.5 | 2019-01-23 | The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions… |
CVE-2018-15784 | High | 7.4 | 2019-01-18 | Dell Networking OS10 versions prior to 10.4.3.0 contain a vulnerability in the Phone Home feature which does not properly validate the server's certificate aut… |
CVE-2018-16187 | Medium | 5.9 | 2019-01-09 | The RICOH Interactive Whiteboard D2200 V1.3 to V2.2, D5500 V1.3 to V2.2, D5510 V1.3 to V2.2, the display versions with RICOH Interactive Whiteboard Controller… |
CVE-2018-16179 | Medium | 5.9 | 2019-01-09 | The Mizuho Direct App for Android version 3.13.0 and earlier does not verify server certificates, which allows man-in-the-middle attackers to spoof servers and… |
CVE-2018-1320 | High | 7.5 | 2019-01-07 | Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTrans… |
CVE-2018-4015 | High | 8.1 | 2018-12-18 | An exploitable vulnerability exists in the HTTP client functionality of the Webroot BrightCloud SDK. The configuration of the HTTP client does not enforce a se… |
CVE-2017-1265 | Low | 3.7 | 2018-12-17 | IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 does not validate, or incorrectly validates, a certificate. This weakness might allo… |
CVE-2018-16875 | Medium | 5.9 | 2018-12-14 | The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow… |
CVE-2018-19982 | Medium | 5.3 | 2018-12-09 | An issue was discovered on KT MC01507L Z-Wave S0 devices. It occurs because HPKP is not implemented. The communication architecture is APP > Server > Controlle… |
CVE-2017-1622 | Low | 3.7 | 2018-12-05 | IBM QRadar SIEM 7.2.8 and 7.3 does not validate, or incorrectly validates, a certificate. This weakness might allow an attacker to spoof a trusted entity by us… |
CVE-2018-0691 | Medium | 5.9 | 2018-11-15 | Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message A… |
CVE-2018-17187 | High | 7.4 | 2018-11-13 | The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. Unless a verification… |
CVE-2018-17612 | High | 7.5 | 2018-11-09 | Sennheiser HeadSetup 7.3.4903 places Certification Authority (CA) certificates into the Trusted Root CA store of the local system, and publishes the private ke… |
CVE-2018-15326 | High | 7.5 | 2018-10-31 | In some situations on BIG-IP APM 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.2, the CRLDP Auth access policy agent may treat revoked ce… |
CVE-2018-18568 | Medium | 5.9 | 2018-10-24 | Polycom VVX 500 and 601 devices 5.8.0.12848 and earlier allows man-in-the-middle attackers to obtain sensitive credential information by leveraging failure to… |
CVE-2018-18567 | Medium | 5.9 | 2018-10-24 | AudioCodes 440HD and 450HD devices 3.1.2.89 and earlier allows man-in-the-middle attackers to obtain sensitive credential information by leveraging failure to… |
CVE-2018-15387 | Critical | 9.8 | 2018-10-05 | A vulnerability in the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass certificate validation on an affected device. The vulner… |
CVE-2018-0434 | High | 7.4 | 2018-10-05 | A vulnerability in the Zero Touch Provisioning feature of the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to gain unauthorized access… |
CVE-2018-12087 | Medium | 5.3 | 2018-10-03 | Failure to validate certificates in OPC Foundation UA Client Applications communicating without security allows attackers with control over a piece of network… |
CVE-2018-1509 | Low | 3.7 | 2018-10-02 | IBM Security Guardium EcoSystem 10.5 does not validate, or incorrectly validates, a certificate.This weakness might allow an attacker to spoof a trusted entity… |
CVE-2018-17215 | High | 8.1 | 2018-09-26 | An information-disclosure issue was discovered in Postman through 6.3.0. It validates a server's X.509 certificate and presents an error if the certificate is… |
CVE-2018-11087 | Medium | 5.9 | 2018-09-14 | Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation… |
CVE-2018-8479 | Medium | 5.6 | 2018-09-13 | A spoofing vulnerability exists for the Azure IoT Device Provisioning for the C SDK library using the HTTP protocol on Windows platform, aka "Azure IoT SDK Spo… |
CVE-2018-15898 | Medium | 5.9 | 2018-09-11 | The Subsonic Music Streamer application 4.4 for Android has Improper Certificate Validation of the Subsonic server certificate, which might allow man-in-the-mi… |
CVE-2018-2460 | Medium | 5.9 | 2018-09-11 | SAP Business One Android application, version 1.2, does not verify the certificate properly for HTTPS connection. This allows attacker to do MITM attack. |