CWE-295 · Improper Certificate Validation (page 14)
Page 14 of 15 — CVEs classified under CWE-295, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-10511 | Medium | 5.9 | 2017-09-18 | The Twitter iOS client versions 6.62 and 6.62.1 fail to validate Twitter's server certificates for the /1.1/help/settings.json configuration endpoint, permitti… |
CVE-2017-2299 | High | 7.5 | 2017-09-15 | Versions of the puppetlabs-apache module prior to 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. If you specify the `ssl_ca` parame… |
CVE-2017-14420 | Medium | 5.9 | 2017-09-13 | The D-Link NPAPI extension, as used on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devic… |
CVE-2017-14419 | Medium | 5.9 | 2017-09-13 | The D-Link NPAPI extension, as used on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devic… |
CVE-2015-2943 | Medium | 5.9 | 2017-09-06 | Honda Moto LINC 1.6.1 does not verify SSL certificates. |
CVE-2017-6594 | High | 7.5 | 2017-08-28 | The transit path validation code in Heimdal before 7.3 might allow attackers to bypass the capath policy protection mechanism by leveraging failure to add the… |
CVE-2015-0210 | Medium | 5.9 | 2017-08-28 | wpa_supplicant 2.0-16 does not properly check certificate subject name, which allows remote attackers to cause a man-in-the-middle attack. |
CVE-2015-4017 | High | 7.5 | 2017-08-25 | Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules. |
CVE-2017-8445 | Medium | 5.5 | 2017-08-18 | An error was found in the X-Pack Security TLS trust manager for versions 5.0.0 to 5.5.1. If reloading the trust material fails the trust manager will be replac… |
CVE-2014-3451 | High | 7.5 | 2017-08-18 | OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks. |
CVE-2015-2674 | Medium | 5.9 | 2017-08-09 | Restkit allows man-in-the-middle attackers to spoof TLS servers by leveraging use of the ssl.wrap_socket function in Python with the default CERT_NONE value fo… |
CVE-2015-5619 | Medium | 5.9 | 2017-08-09 | Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack output or the Logstash forwarder does not validate SSL/TLS certificates from the Logstash se… |
CVE-2017-11506 | High | 7.4 | 2017-08-09 | When linking a Nessus scanner or agent to Tenable.io or other manager, Nessus 6.x before 6.11 does not verify the manager's TLS certificate when making the ini… |
CVE-2017-7932 | Medium | 6.0 | 2017-08-07 | An improper certificate validation issue was discovered in NXP i.MX 28 i.MX 50, i.MX 53, i.MX 7Solo i.MX 7Dual Vybrid VF3xx, Vybrid VF5xx, Vybrid VF6xx, i.MX 6… |
CVE-2017-6664 | High | 7.5 | 2017-08-07 | A vulnerability in the Autonomic Networking feature of Cisco IOS XE Software could allow an unauthenticated, remote, autonomic node to access the Autonomic Net… |
CVE-2017-10819 | Medium | 5.9 | 2017-08-04 | MaLion for Mac 4.3.0 to 5.2.1 does not properly validate certificates, which may allow an attacker to eavesdrop on an encrypted communication. |
CVE-2017-2278 | Medium | 5.9 | 2017-08-02 | The RBB SPEED TEST App for Android version 2.0.3 and earlier, RBB SPEED TEST App for iOS version 2.1.0 and earlier does not verify X.509 certificates from SSL… |
CVE-2017-11364 | High | 8.8 | 2017-08-02 | The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain control of the targ… |
CVE-2017-11132 | High | 7.5 | 2017-08-01 | An issue was discovered in heinekingmedia StashCat before 1.5.18 for Android. No certificate pinning is implemented; therefore the attacker could issue a certi… |
CVE-2015-0904 | Medium | 5.9 | 2017-07-25 | The Restaurant Karaoke SHIDAX app 1.3.3 and earlier on Android does not verify SSL certificates, which allows remote attackers to obtain sensitive information… |
CVE-2015-3886 | Critical | 9.8 | 2017-07-21 | libinfinity before 0.6.6-1 does not validate expired SSL certificates, which allows remote attackers to have unspecified impact via unknown vectors. |
CVE-2017-11501 | Medium | 5.9 | 2017-07-20 | NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication ag… |
CVE-2017-1000007 | Medium | 5.9 | 2017-07-17 | txAWS (all current versions) fail to perform complete certificate verification resulting in vulnerability to MitM attacks and information disclosure. |
CVE-2017-7726 | High | 7.5 | 2017-07-11 | iSmartAlarm cube devices have an SSL Certificate Validation Vulnerability. |
CVE-2017-7406 | Critical | 9.8 | 2017-07-07 | The D-Link DIR-615 device before v20.12PTb04 doesn't use SSL for any of the authenticated pages. Also, it doesn't allow the user to generate his own SSL Certif… |
CVE-2017-3218 | High | 8.8 | 2017-06-21 | Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician uses HTTP for software update… |
CVE-2017-9601 | Medium | 5.9 | 2017-06-16 | The "FNB Kemp Mobile Banking" by First National Bank of Kemp app 3.0.2 -- aka fnb-kemp-mobile-banking/id571448725 for iOS does not verify X.509 certificates fr… |
CVE-2017-9600 | Medium | 5.9 | 2017-06-16 | The "Peoples Bank Tulsa" by Peoples Bank - OK app 3.0.2 -- aka peoples-bank-tulsa/id1074279285 for iOS does not verify X.509 certificates from SSL servers, whi… |
CVE-2017-9599 | Medium | 5.9 | 2017-06-16 | The "Fountain Trust Mobile Banking" by FOUNTAIN TRUST COMPANY app before 3.2.0 -- aka fountain-trust-mobile-banking/id891343006 for iOS does not verify X.509 c… |
CVE-2017-9598 | Medium | 5.9 | 2017-06-16 | The "Morton Credit Union Mobile Banking" by Morton Credit Union app 3.0.1 -- aka morton-credit-union-mobile-banking/id1119623070 for iOS does not verify X.509… |
CVE-2017-9597 | Medium | 5.9 | 2017-06-16 | The "Blue Ridge Bank and Trust Co. Mobile Banking" by Blue Ridge Bank and Trust Co. app 3.0.1 -- aka blue-ridge-bank-and-trust-co-mobile-banking/id699679197 fo… |
CVE-2017-9596 | Medium | 5.9 | 2017-06-16 | The "CFB Mobile Banking" by Citizens First Bank Wisconsin app 3.0.1 -- aka cfb-mobile-banking/id1081102805 for iOS does not verify X.509 certificates from SSL… |
CVE-2017-9595 | Medium | 5.9 | 2017-06-16 | The "First State Bank of Bigfork Mobile Banking" by First State Bank of Bigfork app 4.0.3 -- aka first-state-bank-of-bigfork-mobile-banking/id1133969876 for iO… |
CVE-2017-9594 | Medium | 5.9 | 2017-06-16 | The "SVB Mobile" by Sauk Valley Bank Mobile Banking app 3.0.0 -- aka svb-mobile/id796429885 for iOS does not verify X.509 certificates from SSL servers, which… |
CVE-2017-9593 | Medium | 5.9 | 2017-06-16 | The "Oculina Mobile Banking" by Oculina Bank app 3.0.0 -- aka oculina-mobile-banking/id867025690 for iOS does not verify X.509 certificates from SSL servers, w… |
CVE-2017-9592 | Medium | 5.9 | 2017-06-16 | The "Your Legacy Federal Credit Union Mobile Banking" by Your Legacy Federal Credit Union app 3.0.1 -- aka your-legacy-federal-credit-union-mobile-banking/id91… |
CVE-2017-9591 | Medium | 5.9 | 2017-06-16 | The "PCB Mobile" by Phelps County Bank app 3.0.2 -- aka pcb-mobile/id436891295 for iOS does not verify X.509 certificates from SSL servers, which allows man-in… |
CVE-2017-9590 | Medium | 5.9 | 2017-06-16 | The "State Bank of Waterloo Mobile Banking" by State Bank of Waterloo app 3.0.2 -- aka state-bank-of-waterloo-mobile-banking/id555321714 for iOS does not verif… |
CVE-2017-9589 | Medium | 5.9 | 2017-06-16 | The "SCSB Shelbyville IL Mobile Banking" by Shelby County State Bank app 3.0.0 -- aka scsb-shelbyville-il-mobile-banking/id938960224 for iOS does not verify X… |
CVE-2017-9588 | Medium | 5.9 | 2017-06-16 | The "Oritani Mobile Banking" by Oritani Bank app 3.0.0 -- aka oritani-mobile-banking/id778851066 for iOS does not verify X.509 certificates from SSL servers, w… |
CVE-2017-9587 | Medium | 5.9 | 2017-06-16 | The "PCSB BANK Mobile" by PCSB Bank app 3.0.4 -- aka pcsb-bank-mobile/id1067472090 for iOS does not verify X.509 certificates from SSL servers, which allows ma… |
CVE-2017-9586 | Medium | 5.9 | 2017-06-16 | The "FSBY Mobile Banking" by First State Bank of Yoakum TX app 3.0.0 -- aka fsby-mobile-banking/id899136434 for iOS does not verify X.509 certificates from SSL… |
CVE-2017-9585 | Medium | 5.9 | 2017-06-16 | The "Community State Bank - Lamar Mobile Banking" by Community State Bank - Lamar app 3.0.3 -- aka community-state-bank-lamar-mobile-banking/id1083927885 for i… |
CVE-2017-9584 | Medium | 5.9 | 2017-06-16 | The "HBO Mobile Banking" by Heritage Bank of Ozarks app 3.0.0 -- aka hbo-mobile-banking/id860224933 for iOS does not verify X.509 certificates from SSL servers… |
CVE-2017-9583 | Medium | 5.9 | 2017-06-16 | The "Charlevoix State Bank" by Charlevoix State Bank app 3.0.1 -- aka charlevoix-state-bank/id1128963717 for iOS does not verify X.509 certificates from SSL se… |
CVE-2017-9582 | Medium | 5.9 | 2017-06-16 | The "BNB Mobile Banking" by Brady National Bank app 3.0.0 -- aka bnb-mobile-banking/id674215747 for iOS does not verify X.509 certificates from SSL servers, wh… |
CVE-2017-9581 | Medium | 5.9 | 2017-06-16 | The "Algonquin State Bank Mobile Banking" by Algonquin State Bank app 3.0.0 -- aka algonquin-state-bank-mobile-banking/id1089657735 for iOS does not verify X.5… |
CVE-2017-9580 | Medium | 5.9 | 2017-06-16 | The "Pioneer Bank & Trust Mobile Banking" by PIONEER BANK AND TRUST app 3.0.0 -- aka pioneer-bank-trust-mobile-banking/id603182861 for iOS does not verify X.50… |
CVE-2017-9579 | Medium | 5.9 | 2017-06-16 | The "JMCU Mobile Banking" by Joplin Metro Credit Union app 3.0.0 -- aka jmcu-mobile-banking/id716065893 for iOS does not verify X.509 certificates from SSL ser… |
CVE-2017-9578 | Medium | 5.9 | 2017-06-16 | The "RVCB Mobile" by RVCB Mobile Banking app 3.0.0 -- aka rvcb-mobile/id757928895 for iOS does not verify X.509 certificates from SSL servers, which allows man… |
CVE-2017-9577 | Medium | 5.9 | 2017-06-16 | The "First Citizens Bank-Mobile Banking" by First Citizens Bank (AL) app 3.0.0 -- aka first-citizens-bank-mobile-banking/id566037101 for iOS does not verify X… |
CVE-2017-9576 | Medium | 5.9 | 2017-06-16 | The "Middleton Community Bank Mobile Banking" by Middleton Community Bank app 3.0.0 -- aka middleton-community-bank-mobile-banking/id721843238 for iOS does not… |
CVE-2017-9575 | Medium | 5.9 | 2017-06-16 | The "FVB Mobile Banking" by First Volunteer Bank of Tennessee app 3.1.1 -- aka fvb-mobile-banking/id551018004 for iOS does not verify X.509 certificates from S… |
CVE-2017-9574 | Medium | 5.9 | 2017-06-16 | The "KC Area Credit Union Mobile Banking" by K C Area Credit Union app 3.0.1 -- aka kc-area-credit-union-mobile-banking/id1097607736 for iOS does not verify X… |
CVE-2017-9573 | Medium | 5.9 | 2017-06-16 | The North Adams State Bank (Ursa) nasb-mobile-banking/id980573797 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-th… |
CVE-2017-9572 | Medium | 5.9 | 2017-06-16 | The athens-state-bank-mobile-banking/id719748589 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attacker… |
CVE-2017-9571 | Medium | 5.9 | 2017-06-16 | The Citizens Community Bank (TN) ccb-mobile-banking/id610030469 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-… |
CVE-2017-9570 | Medium | 5.9 | 2017-06-16 | The mount-vernon-bank-trust-mobile-banking/id542706679 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle at… |
CVE-2017-9569 | Medium | 5.9 | 2017-06-16 | The Citizens Bank (TX) cbtx-on-the-go/id892396102 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attacke… |
CVE-2017-9568 | Medium | 5.9 | 2017-06-16 | The financial-plus-mobile-banking/id731070564 app 3.0.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers t… |
CVE-2017-9567 | Medium | 5.9 | 2017-06-16 | The avb-bank-mobile-banking/id592565443 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoo… |
CVE-2017-9566 | Medium | 5.9 | 2017-06-16 | The fsb-dequeen-mobile-banking/id1091025340 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to… |
CVE-2017-9565 | Medium | 5.9 | 2017-06-16 | The first-security-bank-sleepy-eye-mobile/id870531890 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle att… |
CVE-2017-9564 | Medium | 5.9 | 2017-06-16 | The community-banks-cb2go/id445828071 app 3.1.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof… |
CVE-2017-9563 | Medium | 5.9 | 2017-06-16 | The First Citizens Community Bank fccb/id809930960 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attack… |
CVE-2017-9562 | Medium | 5.9 | 2017-06-16 | The Freedom First freedom-1st-credit-union-mobile-banking/id1085229458 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-… |
CVE-2017-9561 | Medium | 5.9 | 2017-06-16 | The Lee Bank & Trust lbtc-mobile/id1068984753 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers t… |
CVE-2017-9560 | Medium | 5.9 | 2017-06-16 | The cayuga-lake-national-bank/id1151601539 app 4.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to s… |
CVE-2017-9559 | Medium | 5.9 | 2017-06-16 | The MEA Financial vision-bank/id420406345 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to sp… |
CVE-2017-9558 | Medium | 5.9 | 2017-06-16 | The wawa-employees-credit-union-mobile/id1158082793 app 4.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attac… |
CVE-2017-4981 | High | 7.5 | 2017-06-14 | EMC RSA BSAFE Cert-C before 2.9.0.5 contains a potential improper certificate processing vulnerability. |
CVE-2016-7816 | Medium | 5.9 | 2017-06-09 | The Cybozu kintone mobile for Android 1.0.6 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof… |
CVE-2016-7805 | Medium | 5.9 | 2017-06-09 | The mobiGate App for Android version 2.2.1.2 and earlier and mobiGate App for iOS version 2.2.4.1 and earlier do not verify X.509 certificates from SSL servers… |
CVE-2016-5648 | Medium | 5.3 | 2017-06-08 | Acer Portal app before 3.9.4.2000 for Android does not properly validate SSL certificates, which allows remote attackers to perform a Man-in-the-middle attack… |
CVE-2016-8231 | High | 7.5 | 2017-06-04 | In Lenovo Service Bridge before version 4, a bug found in the signature verification logic of the code signing certificate could be exploited by an attacker to… |
CVE-2016-3083 | High | 7.5 | 2017-05-30 | Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes). While validating the server's certificat… |
CVE-2017-2800 | Critical | 9.8 | 2017-05-24 | A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting in potential certificate validation vu… |
CVE-2017-6988 | Medium | 5.9 | 2017-05-22 | An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "802.1X" component. It allows remote attackers to d… |
CVE-2017-2498 | High | 7.5 | 2017-05-22 | An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. The issue involves the "Security" component. It allows attackers to bypass in… |
CVE-2017-8943 | Medium | 5.9 | 2017-05-15 | The PUMA PUMATRAC app 3.0.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain s… |
CVE-2017-8942 | Medium | 5.9 | 2017-05-15 | The YottaMark ShopWell - Healthy Diet & Grocery Food Scanner app 5.3.7 through 5.4.2 for iOS does not verify X.509 certificates from SSL servers, which allows… |
CVE-2017-8941 | Medium | 5.9 | 2017-05-15 | The Interval International app 3.3 through 3.5.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof… |
CVE-2017-8940 | Medium | 5.9 | 2017-05-15 | The Zipongo - Healthy Recipes and Grocery Deals app before 6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle atta… |
CVE-2017-8939 | Medium | 5.9 | 2017-05-15 | The Warner Bros. ellentube app 3.1.1 through 3.1.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spo… |
CVE-2017-8938 | Medium | 5.9 | 2017-05-15 | The Radio Javan app 9.3.4 through 9.6.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers… |
CVE-2017-8937 | Medium | 5.9 | 2017-05-15 | The Life Before Us Yo app 2.5.8 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obta… |
CVE-2017-8936 | Medium | 5.9 | 2017-05-15 | The MoboTap Dolphin Web Browser - Fast Private Internet Search app 9.23.0 through 9.23.2 for iOS does not verify X.509 certificates from SSL servers, which all… |
CVE-2017-8935 | Medium | 5.9 | 2017-05-15 | The Quest Information Systems Indiana Voters app 1.1.24 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers t… |
CVE-2017-0248 | High | 7.5 | 2017-05-12 | Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a cer… |
CVE-2017-8060 | Medium | 5.9 | 2017-05-05 | Acceptance of invalid/self-signed TLS certificates in "Panda Mobile Security" 1.1 for iOS allows a man-in-the-middle and/or physically proximate attacker to si… |
CVE-2017-8059 | High | 8.1 | 2017-05-05 | Acceptance of invalid/self-signed TLS certificates in "Foxit PDF - PDF reader, editor, form, signature" before 5.4 for iOS allows a man-in-the-middle and/or ph… |
CVE-2017-8058 | Medium | 5.9 | 2017-05-05 | Acceptance of invalid/self-signed TLS certificates in Atlassian HipChat before 3.16.2 for iOS allows a man-in-the-middle and/or physically proximate attacker t… |
CVE-2017-5919 | Medium | 5.9 | 2017-05-05 | The 21st Century Insurance app 10.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers an… |
CVE-2017-5918 | Medium | 5.9 | 2017-05-05 | The Banco de Costa Rica BCR Movil app 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof server… |
CVE-2017-5916 | Medium | 5.9 | 2017-05-05 | The America's First Federal Credit Union (FCU) Mobile Banking app 3.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-mi… |
CVE-2017-5915 | Medium | 5.9 | 2017-05-05 | The Emirates NBD Bank P.J.S.C Emirates NBD KSA app 3.10.0 through 3.10.4 (UAE) and 2.0.1 through 2.1.0 (KSA) for iOS does not verify X.509 certificates from SS… |
CVE-2017-5914 | Medium | 5.9 | 2017-05-05 | The DOT IT Banque Zitouna app 2.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and ob… |
CVE-2017-5913 | Medium | 5.9 | 2017-05-05 | The TradeKing Forex for iPhone app 1.2.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers… |
CVE-2017-5912 | Medium | 5.9 | 2017-05-05 | The FOREX.com FOREXTrader for iPhone app 2.9.12 through 2.9.14 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle atta… |
CVE-2017-5911 | Medium | 5.9 | 2017-05-05 | The Banco Santander Mexico SA Supermovil app 3.5 through 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attack… |