CWE-295 · Improper Certificate Validation (page 13)
Page 13 of 15 — CVEs classified under CWE-295, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-10377 | Medium | 5.9 | 2018-06-17 | PortSwigger Burp Suite before 1.7.34 has Improper Certificate Validation of the Collaborator server certificate, which might allow man-in-the-middle attackers… |
CVE-2018-10408 | High | 7.8 | 2018-06-13 | An issue was discovered in VirusTotal. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection… |
CVE-2018-10406 | High | 7.8 | 2018-06-13 | An issue was discovered in Yelp OSXCollector. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full insp… |
CVE-2018-10405 | High | 7.8 | 2018-06-13 | An issue was discovered in Google Santa and molcodesignchecker. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not co… |
CVE-2018-10404 | High | 7.8 | 2018-06-13 | An issue was discovered in Objective-See KnockKnock, LuLu, TaskExplorer, WhatsYourSign, and procInfo. A maliciously crafted Universal/fat binary can evade thir… |
CVE-2018-10403 | High | 7.8 | 2018-06-13 | An issue was discovered in F-Secure XFENCE and Little Flocker. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not com… |
CVE-2018-12257 | Medium | 4.4 | 2018-06-12 | An issue was discovered on Momentum Axel 720P 5.1.8 devices. There is Authenticated Custom Firmware Upgrade via DNS Hijacking. An authenticated root user with… |
CVE-2016-9064 | Medium | 5.9 | 2018-06-11 | Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in… |
CVE-2018-0334 | Medium | 4.8 | 2018-06-07 | A vulnerability in the certificate management subsystem of Cisco AnyConnect Network Access Manager and of Cisco AnyConnect Secure Mobility Client for iOS, Mac… |
CVE-2018-11712 | High | 7.5 | 2018-06-04 | WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ versions 2.20.0 and 2.20.1, failed… |
CVE-2016-10536 | Medium | 5.9 | 2018-05-31 | engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket… |
CVE-2016-10534 | Medium | 5.9 | 2018-05-31 | electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages. along with Electron. The `--strict-ssl` command li… |
CVE-2018-4991 | Critical | 9.8 | 2018-05-19 | Adobe Creative Cloud Desktop Application versions 4.4.1.298 and earlier have an exploitable Improper certificate validation vulnerability. Successful exploitat… |
CVE-2018-0277 | High | 8.6 | 2018-05-17 | A vulnerability in the Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) certificate validation during EAP authentication for the Cisco Ide… |
CVE-2018-0591 | Medium | 5.9 | 2018-05-14 | The KINEPASS App for Android Ver 3.1.1 and earlier, and for iOS Ver 3.1.2 and earlier do not verify X.509 certificates from SSL servers, which allows man-in-th… |
CVE-2018-8119 | Medium | 5.6 | 2018-05-09 | A spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library improperly validates certificates over the AMQP protocol, aka "Az… |
CVE-2018-4849 | High | 7.4 | 2018-05-03 | A vulnerability has been identified in Siveillance VMS Video for Android (All versions < V12.1a (2018 R1)), Siveillance VMS Video for iOS (All versions < V12.1… |
CVE-2013-7201 | High | 7.4 | 2018-04-27 | WebHybridClient.java in PayPal 5.3 and earlier for Android ignores SSL errors, which allows man-in-the-middle attackers to spoof servers and obtain sensitive i… |
CVE-2017-2836 | Medium | 5.9 | 2018-04-24 | An exploitable denial of service vulnerability exists within the reading of proprietary server certificates in FreeRDP 2.0.0-beta1+android11. A specially craft… |
CVE-2018-0227 | High | 7.5 | 2018-04-19 | A vulnerability in the Secure Sockets Layer (SSL) Virtual Private Network (VPN) Client Certificate Authentication feature for Cisco Adaptive Security Appliance… |
CVE-2018-10066 | High | 8.1 | 2018-04-13 | An issue was discovered in MikroTik RouterOS 6.41.4. Missing OpenVPN server certificate verification allows a remote unauthenticated attacker capable of interc… |
CVE-2017-6143 | Medium | 5.4 | 2018-04-13 | X509 certificate verification was not correctly implemented in the IP Intelligence Subscription and IP Intelligence feed-list features, and thus the remote ser… |
CVE-2015-1777 | Medium | 5.9 | 2018-04-12 | rhnreg_ks in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Gluster Storage 2.1 and Enterprise Linux (RHEL) 5, 6, and 7 does not properly valid… |
CVE-2018-0553 | High | 7.4 | 2018-04-09 | The iRemoconWiFi App for Android version 4.1.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spo… |
CVE-2018-1000151 | Medium | 5.6 | 2018-04-05 | A man in the middle vulnerability exists in Jenkins vSphere Plugin 2.16 and older in VSphere.java that disables SSL/TLS certificate validation by default. |
CVE-2018-4086 | Medium | 5.9 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS bef… |
CVE-2017-13863 | Medium | 5.9 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "APNs" component. It allows man-in-the-middle attackers to… |
CVE-2018-9127 | Critical | 9.8 | 2018-04-02 | Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125… |
CVE-2015-4954 | Medium | 5.9 | 2018-03-27 | IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 improperly allows self-signed certificates, which might allow remote attackers to co… |
CVE-2018-5466 | High | 7.5 | 2018-03-26 | Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have a self-signed SSL certificate vulnerability this could allow an attacker to gain unauthorized… |
CVE-2018-5464 | High | 7.5 | 2018-03-26 | Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an untrusted SSL certificate vulnerability this could allow an attacker to gain unauthorized… |
CVE-2018-5462 | High | 7.5 | 2018-03-26 | Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an SSL incorrect hostname certificate vulnerability this could allow an attacker to gain unau… |
CVE-2018-8970 | High | 7.4 | 2018-03-24 | The int_x509_param_set_hosts function in lib/libcrypto/x509/x509_vpm.c in LibreSSL 2.7.0 before 2.7.1 does not support a certain special case of a zero name le… |
CVE-2018-5502 | High | 7.5 | 2018-03-22 | On F5 BIG-IP versions 13.0.0 - 13.1.0.3, attackers may be able to disrupt services on the BIG-IP system with maliciously crafted client certificate. This vulne… |
CVE-2018-6221 | High | 8.1 | 2018-03-15 | An unvalidated software update vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a man-in-the-middle attacker to tamper with an update file… |
CVE-2018-6219 | Medium | 6.5 | 2018-03-15 | An Insecure Update via HTTP vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to eavesdrop and tamper with certain types of upd… |
CVE-2018-1000096 | High | 8.1 | 2018-03-13 | brianleroux tiny-json-http version all versions since commit 9b8e74a232bba4701844e07bcba794173b0238a8 (Oct 29 2016) contains a Missing SSL certificate validati… |
CVE-2016-9952 | High | 8.1 | 2018-03-12 | The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, makes it eas… |
CVE-2017-2667 | High | 8.1 | 2018-03-12 | Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default. As a r… |
CVE-2017-18227 | High | 7.5 | 2018-03-12 | TitanHQ WebTitan Gateway has incorrect certificate validation for the TLS interception feature. |
CVE-2018-8059 | High | 8.8 | 2018-03-11 | The Djelibeybi configuration examples for use of NGINX in SUSE Portus 2.3, when applied to certain configurations involving Docker Compose, have a Missing SSL… |
CVE-2018-7234 | High | 7.5 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrary system file downl… |
CVE-2017-7429 | High | 8.8 | 2018-03-02 | The certificate upload in NetIQ eDirectory PKI plugin before 8.8.8 Patch 10 Hotfix 1 could be abused to upload JSP code which could be used by authenticated at… |
CVE-2012-6709 | Medium | 5.9 | 2018-02-23 | ELinks 0.12 and Twibright Links 2.3 have Missing SSL Certificate Validation. |
CVE-2018-0518 | Medium | 5.9 | 2018-02-23 | LINE for iOS version 7.1.3 to 7.1.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain s… |
CVE-2017-17455 | Medium | 5.9 | 2018-02-20 | Mahara 16.10 before 16.10.7, 17.04 before 17.04.5, and 17.10 before 17.10.2 are vulnerable to being forced, via a man-in-the-middle attack, to interact with Ma… |
CVE-2017-17301 | Critical | 9.8 | 2018-02-15 | Huawei AR120-S V200R005C32, V200R006C10, V200R007C00, V200R008C20, AR1200 V200R005C20, V200R005C32, V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R00… |
CVE-2017-15341 | High | 7.5 | 2018-02-15 | Huawei AR3200 V200R008C20, V200R008C30, TE40 V600R006C00, TE50 V600R006C00, TE60 V600R006C00 have a denial of service vulnerability. The software decodes X.509… |
CVE-2017-12721 | Medium | 5.9 | 2018-02-15 | An Improper Certificate Validation issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump do… |
CVE-2017-9968 | Medium | 5.9 | 2018-02-12 | A security misconfiguration vulnerability exists in Schneider Electric's IGSS Mobile application versions 3.01 and prior in which a lack of certificate pinning… |
CVE-2018-6827 | High | 8.1 | 2018-02-09 | VOBOT CLOCK before 0.99.30 devices do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sens… |
CVE-2018-6374 | Medium | 6.5 | 2018-01-31 | The GUI component (aka PulseUI) in Pulse Secure Desktop Linux clients before PULSE5.2R9.2 and 5.3.x before PULSE5.3R4.2 does not perform strict SSL Certificate… |
CVE-2017-15698 | Medium | 5.9 | 2018-01-31 | When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not correctly handle fiel… |
CVE-2017-1000396 | Medium | 5.9 | 2018-01-26 | Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified… |
CVE-2017-1000417 | Medium | 5.3 | 2018-01-22 | MatrixSSL version 3.7.2 adopts a collision-prone OID comparison logic resulting in possible spoofing of OIDs (e.g. in ExtKeyUsage extension) on X.509 certifica… |
CVE-2018-5761 | High | 8.1 | 2018-01-22 | A man-in-the-middle vulnerability related to vCenter access was found in Rubrik CDM 3.x and 4.x before 4.0.4-p2. This vulnerability might expose Rubrik user cr… |
CVE-2017-6142 | Medium | 4.8 | 2018-01-19 | X509 certificate verification was not correctly implemented in the early access "user id" feature in the F5 BIG-IP Advanced Firewall Manager versions 13.0.0, 1… |
CVE-2018-5258 | Medium | 5.9 | 2018-01-17 | The Neon app 1.6.14 iOS does not verify X.509 certificates from SSL servers, which allows remote attackers to spoof servers and obtain sensitive information vi… |
CVE-2015-2981 | Medium | 5.9 | 2018-01-12 | The Yodobashi App for Android 1.2.1.0 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof server… |
CVE-2018-0786 | High | 7.5 | 2018-01-10 | Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security… |
CVE-2017-1000415 | Medium | 5.9 | 2018-01-09 | MatrixSSL version 3.7.2 has an incorrect UTCTime date range validation in its X.509 certificate validation process resulting in some certificates have their ex… |
CVE-2015-2320 | Critical | 9.8 | 2018-01-08 | The TLS stack in Mono before 3.12.1 allows remote attackers to have unspecified impact via vectors related to client-side SSLv2 fallback. |
CVE-2015-2319 | High | 7.5 | 2018-01-08 | The TLS stack in Mono before 3.12.1 makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, rel… |
CVE-2015-2318 | High | 8.1 | 2018-01-08 | The TLS stack in Mono before 3.12.1 allows man-in-the-middle attackers to conduct message skipping attacks and consequently impersonate clients by leveraging m… |
CVE-2014-3607 | Medium | 5.9 | 2018-01-08 | DefaultHostnameVerifier in Ldaptive (formerly vt-ldap) does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN… |
CVE-2015-4100 | Medium | 6.8 | 2017-12-21 | Puppet Enterprise 3.7.x and 3.8.0 might allow remote authenticated users to manage certificates for arbitrary nodes by leveraging a client certificate trusted… |
CVE-2017-17718 | Medium | 5.9 | 2017-12-17 | The Net::LDAP (aka net-ldap) gem before 0.16.0 for Ruby has Missing SSL Certificate Validation. |
CVE-2017-17716 | Medium | 5.9 | 2017-12-17 | GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4 release announceme… |
CVE-2017-3194 | High | 8.1 | 2017-12-16 | Pandora iOS app prior to version 8.3.2 fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-i… |
CVE-2017-3190 | High | 7.5 | 2017-12-16 | Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificates provided by HTT… |
CVE-2014-3250 | Medium | 6.5 | 2017-12-11 | The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain s… |
CVE-2016-1252 | Medium | 5.9 | 2017-12-05 | The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before… |
CVE-2017-15114 | High | 8.1 | 2017-11-27 | When libvirtd is configured by OSP director (tripleo-heat-templates) to use the TLS transport it defaults to the same certificate authority as all non-libvirtd… |
CVE-2017-8213 | Medium | 5.3 | 2017-11-22 | Huawei SMC2.0 with software of V100R003C10, V100R005C00SPC100, V100R005C00SPC101B001T, V100R005C00SPC102, V100R005C00SPC103, V100R005C00SPC200, V100R005C00SPC2… |
CVE-2017-15528 | Low | 3.7 | 2017-11-22 | Prior to v 7.6, the Install Norton Security (INS) product can be susceptible to a certificate spoofing vulnerability, which is a type of attack whereby a malic… |
CVE-2017-1000209 | Medium | 5.9 | 2017-11-17 | The Java WebSocket client nv-websocket-client does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltNam… |
CVE-2014-2845 | Medium | 5.9 | 2017-11-15 | Cyberduck before 4.4.4 on Windows does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof FTP-SSL servers via a… |
CVE-2017-11770 | High | 7.5 | 2017-11-15 | .NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly pa… |
CVE-2017-9758 | High | 7.4 | 2017-11-10 | Savitech driver packages for Windows silently install a self-signed certificate into the Trusted Root Certification Authorities store, aka "Inaudible Subversio… |
CVE-2017-2913 | Medium | 5.9 | 2017-11-07 | An exploitable vulnerability exists in the filtering functionality of Circle with Disney. SSL certificates for specific domain names can cause the Bluecoat lib… |
CVE-2017-1000256 | High | 8.1 | 2017-10-31 | libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate S… |
CVE-2017-7080 | High | 7.5 | 2017-10-23 | An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. tvOS before 11 is affected. watchOS before 4 is a… |
CVE-2017-6144 | High | 7.4 | 2017-10-20 | In F5 BIG-IP PEM 12.1.0 through 12.1.2 when downloading the Type Allocation Code (TAC) database file via HTTPS, the server's certificate is not verified. Attac… |
CVE-2014-7242 | Medium | 5.9 | 2017-10-18 | The SumaHo application 3.0.0 and earlier for Android and the SumaHo "driving capability" diagnosis result transmission application 1.2.2 and earlier for Androi… |
CVE-2014-3706 | Medium | 5.9 | 2017-10-18 | ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certif… |
CVE-2017-13083 | Medium | 5.3 | 2017-10-18 | Akeo Consulting Rufus prior to version 2.17.1187 does not adequately validate the integrity of updates downloaded over HTTP, allowing an attacker to easily con… |
CVE-2017-10620 | High | 7.4 | 2017-10-13 | Juniper Networks Junos OS on SRX series devices do not verify the HTTPS server certificate before downloading anti-virus updates. This may allow a man-in-the-m… |
CVE-2015-6358 | Medium | 5.9 | 2017-10-12 | Multiple Cisco embedded devices use hardcoded X.509 certificates and SSH host keys embedded in the firmware, which allows remote attackers to defeat cryptograp… |
CVE-2015-7778 | Medium | 5.9 | 2017-10-10 | Gurunavi App for iOS before 6.0.0 does not verify SSL certificates which could allow remote attackers to perform man-in-the-middle attacks. |
CVE-2015-5639 | High | 7.4 | 2017-10-10 | niconico App for iOS before 6.38 does not verify SSL certificates which could allow remote attackers to execute man-in-the-middle attacks. |
CVE-2015-2988 | High | 7.4 | 2017-10-10 | Rakuten card App for iOS 5.2.0 through 5.2.4 does not verify SSL certificates which might allow remote attackers to execute man-in-the-middle attacks. |
CVE-2017-1000097 | High | 7.5 | 2017-10-05 | On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not… |
CVE-2017-14582 | Medium | 5.9 | 2017-09-30 | The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middl… |
CVE-2017-12228 | Medium | 5.9 | 2017-09-29 | A vulnerability in the Cisco Network Plug and Play application of Cisco IOS 12.4 through 15.6 and Cisco IOS XE 3.3 through 16.4 could allow an unauthenticated… |
CVE-2015-0874 | Medium | 5.9 | 2017-09-26 | Smartphone Passbook 1.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information from en… |
CVE-2017-7971 | Medium | 6.5 | 2017-09-26 | A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywher… |
CVE-2015-7785 | Medium | 5.9 | 2017-09-25 | GANMA! App for iOS does not verify SSL certificates. |
CVE-2015-5666 | Medium | 5.9 | 2017-09-25 | ANA App for Android 3.1.1 and earlier, and ANA App for iOS 3.3.6 and earlier does not verify SSL certificates. |
CVE-2015-5263 | High | 8.1 | 2017-09-25 | pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon registration. |
CVE-2015-3420 | Medium | 5.9 | 2017-09-19 | The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a denial of service (login process crash) vi… |