CWE-295 · Improper Certificate Validation (page 14)
Page 14 of 17 — CVEs classified under CWE-295, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-11775 | High | 7.4 | 2018-09-10 | TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Jav… |
CVE-2018-12608 | High | 7.5 | 2018-09-10 | An issue was discovered in Docker Moby before 17.06.0. The Docker engine validated a client TLS certificate using both the configured client CA root certificat… |
CVE-2016-7075 | High | 7.5 | 2018-09-10 | It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate certificate host name fields. An attacker c… |
CVE-2018-0650 | High | 7.4 | 2018-09-07 | The LINE MUSIC for Android version 3.1.0 to versions prior to 3.6.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attacke… |
CVE-2018-16261 | Medium | 6.8 | 2018-09-06 | In Pulse Secure Pulse Desktop Client 5.3RX before 5.3R5 and 9.0R1, there is a Privilege Escalation Vulnerability with Dynamic Certificate Trust. |
CVE-2018-1000664 | Medium | 5.9 | 2018-09-06 | daneren2005 DSub for Subsonic (Android client) version 5.4.1 contains a CWE-295: Improper Certificate Validation vulnerability in HTTPS Client that can result… |
CVE-2016-1000030 | Critical | 9.8 | 2018-09-05 | Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutls_x509_crt_init() a… |
CVE-2018-15476 | High | 8.1 | 2018-08-30 | An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58, WiFi LED Strip be… |
CVE-2018-12829 | Critical | 9.8 | 2018-08-29 | Adobe Creative Cloud Desktop Application before 4.6.1 has an improper certificate validation vulnerability. Successful exploitation could lead to privilege esc… |
CVE-2018-3927 | Medium | 6.8 | 2018-08-27 | An exploitable information disclosure vulnerability exists in the crash handler of the hubCore binary of the Samsung SmartThings Hub STH-ETH-250 - Firmware ver… |
CVE-2017-7513 | Medium | 5.4 | 2018-08-22 | It was found that Satellite 5 configured with SSL/TLS for the PostgreSQL backend failed to correctly validate X.509 server certificate host name fields. A man-… |
CVE-2017-13105 | Medium | 5.9 | 2018-08-15 | Hi Security Virus Cleaner - Antivirus, Booster, 3.7.1.1329, 2017-09-13, Android application accepts all SSL certificates during SSL communication. This opens t… |
CVE-2016-2922 | Low | 3.7 | 2018-08-13 | IBM Rational ClearQuest 8.0 through 8.0.1.9 and 9.0 through 9.0.1.3 (CQ OSLC linkages, EmailRelay) fails to check the SSL certificate against the requested hos… |
CVE-2018-8034 | High | 7.5 | 2018-08-01 | The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0… |
CVE-2018-10894 | Medium | 5.4 | 2018-08-01 | It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unautho… |
CVE-2018-1999035 | High | 7.4 | 2018-08-01 | A man in the middle vulnerability exists in Jenkins Inedo BuildMaster Plugin 1.3 and earlier in BuildMasterConfiguration.java, BuildMasterConfig.java, BuildMas… |
CVE-2018-1999034 | High | 7.4 | 2018-08-01 | A man in the middle vulnerability exists in Jenkins Inedo ProGet Plugin 0.8 and earlier in ProGetApi.java, ProGetConfig.java, ProGetConfiguration.java that all… |
CVE-2018-1999025 | High | 7.4 | 2018-08-01 | A man in the middle vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java, ATXValidator.java that allows attackers t… |
CVE-2018-8020 | High | 7.4 | 2018-07-31 | Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple entrie… |
CVE-2018-8019 | High | 7.4 | 2018-07-31 | When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked cli… |
CVE-2017-2649 | High | 8.1 | 2018-07-27 | It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Directory server, thereby e… |
CVE-2017-2648 | Medium | 6.8 | 2018-07-27 | It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle attacks. |
CVE-2017-2629 | Medium | 4.3 | 2018-07-27 | curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the… |
CVE-2017-2623 | Medium | 5.3 | 2018-07-27 | It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering. Packages with unsi… |
CVE-2017-12195 | Medium | 6.5 | 2018-07-27 | A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowledge of the given name used to authentica… |
CVE-2017-2639 | Medium | 6.5 | 2018-07-27 | It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and communicating with… |
CVE-2018-0622 | High | 7.4 | 2018-07-26 | The DHC Online Shop App for Android version 3.2.0 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to… |
CVE-2017-7562 | Medium | 6.5 | 2018-07-26 | An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. A remote attacker abl… |
CVE-2017-3182 | Medium | 6.8 | 2018-07-24 | On the iOS platform, the ThreatMetrix SDK versions prior to 3.2 fail to validate SSL certificates provided by HTTPS connections, which may allow an attacker to… |
CVE-2017-7468 | Medium | 4.8 | 2018-07-16 | In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unaccepta… |
CVE-2016-6562 | High | 7.5 | 2018-07-13 | On iOS and Android devices, the ShoreTel Mobility Client app version 9.1.3.109 fails to properly validate SSL certificates provided by HTTPS connections, which… |
CVE-2017-14710 | Medium | 5.9 | 2018-07-12 | The Shein Group Ltd. "SHEIN - Fashion Shopping" app -- aka shein fashion-shopping/id878577184 -- for iOS does not verify X.509 certificates from SSL servers, w… |
CVE-2017-14709 | High | 7.4 | 2018-07-12 | The komoot GmbH "Komoot - Cycling & Hiking Maps" app before 9.3.2 -- aka komoot-cycling-hiking-maps/id447374873 -- for iOS does not verify X.509 certificates f… |
CVE-2017-14612 | Medium | 5.9 | 2018-07-12 | "Shpock Boot Sale & Classifieds" app before 3.17.0 -- aka shpock-boot-sale-classifieds/id557153158 -- for iOS does not verify X.509 certificates from SSL serve… |
CVE-2018-8356 | Medium | 5.5 | 2018-07-11 | A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET Framework Security Fe… |
CVE-2018-12461 | Low | 3.5 | 2018-07-10 | Fixed issues with NetIQ eDirectory prior to 9.1.1 when checking certificate revocation. |
CVE-2018-12499 | High | 7.4 | 2018-07-02 | The Motorola MBP853 firmware does not correctly validate server certificates. This allows for a Man in The Middle (MiTM) attack to take place between a Motorol… |
CVE-2018-1543 | Medium | 5.9 | 2018-06-27 | IBM WebSphere MQ 8.0 and 9.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the SSL certificate. An… |
CVE-2018-1000605 | High | 7.4 | 2018-06-26 | A man in the middle vulnerability exists in Jenkins CollabNet Plugin 2.0.4 and earlier in CollabNetApp.java, CollabNetPlugin.java, CNFormFieldValidator.java th… |
CVE-2018-1000520 | High | 7.5 | 2018-06-26 | ARM mbedTLS version 2.7.0 and earlier contains a Ciphersuite Allows Incorrectly Signed Certificates vulnerability in mbedtls_ssl_get_verify_result() that can r… |
CVE-2018-1000500 | High | 8.1 | 2018-06-26 | Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. This attack appea… |
CVE-2018-0611 | High | 7.4 | 2018-06-26 | The ANA App for iOS version 4.0.22 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers a… |
CVE-2018-1153 | High | 7.4 | 2018-06-18 | Burp Suite Community Edition 1.7.32 and 1.7.33 fail to validate the server certificate in a couple of HTTPS requests which allows a man in the middle to modify… |
CVE-2018-10377 | Medium | 5.9 | 2018-06-17 | PortSwigger Burp Suite before 1.7.34 has Improper Certificate Validation of the Collaborator server certificate, which might allow man-in-the-middle attackers… |
CVE-2018-10408 | High | 7.8 | 2018-06-13 | An issue was discovered in VirusTotal. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection… |
CVE-2018-10406 | High | 7.8 | 2018-06-13 | An issue was discovered in Yelp OSXCollector. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full insp… |
CVE-2018-10405 | High | 7.8 | 2018-06-13 | An issue was discovered in Google Santa and molcodesignchecker. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not co… |
CVE-2018-10404 | High | 7.8 | 2018-06-13 | An issue was discovered in Objective-See KnockKnock, LuLu, TaskExplorer, WhatsYourSign, and procInfo. A maliciously crafted Universal/fat binary can evade thir… |
CVE-2018-10403 | High | 7.8 | 2018-06-13 | An issue was discovered in F-Secure XFENCE and Little Flocker. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not com… |
CVE-2018-12257 | Medium | 4.4 | 2018-06-12 | An issue was discovered on Momentum Axel 720P 5.1.8 devices. There is Authenticated Custom Firmware Upgrade via DNS Hijacking. An authenticated root user with… |
CVE-2016-9064 | Medium | 5.9 | 2018-06-11 | Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in… |
CVE-2018-0334 | Medium | 4.8 | 2018-06-07 | A vulnerability in the certificate management subsystem of Cisco AnyConnect Network Access Manager and of Cisco AnyConnect Secure Mobility Client for iOS, Mac… |
CVE-2018-11712 | High | 7.5 | 2018-06-04 | WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ versions 2.20.0 and 2.20.1, failed… |
CVE-2016-10536 | Medium | 5.9 | 2018-05-31 | engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket… |
CVE-2016-10534 | Medium | 5.9 | 2018-05-31 | electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages. along with Electron. The `--strict-ssl` command li… |
CVE-2018-4991 | Critical | 9.8 | 2018-05-19 | Adobe Creative Cloud Desktop Application versions 4.4.1.298 and earlier have an exploitable Improper certificate validation vulnerability. Successful exploitat… |
CVE-2018-0277 | High | 8.6 | 2018-05-17 | A vulnerability in the Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) certificate validation during EAP authentication for the Cisco Ide… |
CVE-2018-0591 | Medium | 5.9 | 2018-05-14 | The KINEPASS App for Android Ver 3.1.1 and earlier, and for iOS Ver 3.1.2 and earlier do not verify X.509 certificates from SSL servers, which allows man-in-th… |
CVE-2018-8119 | Medium | 5.6 | 2018-05-09 | A spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library improperly validates certificates over the AMQP protocol, aka "Az… |
CVE-2018-4849 | High | 7.4 | 2018-05-03 | A vulnerability has been identified in Siveillance VMS Video for Android (All versions < V12.1a (2018 R1)), Siveillance VMS Video for iOS (All versions < V12.1… |
CVE-2013-7201 | High | 7.4 | 2018-04-27 | WebHybridClient.java in PayPal 5.3 and earlier for Android ignores SSL errors, which allows man-in-the-middle attackers to spoof servers and obtain sensitive i… |
CVE-2017-2836 | Medium | 5.9 | 2018-04-24 | An exploitable denial of service vulnerability exists within the reading of proprietary server certificates in FreeRDP 2.0.0-beta1+android11. A specially craft… |
CVE-2018-0227 | High | 7.5 | 2018-04-19 | A vulnerability in the Secure Sockets Layer (SSL) Virtual Private Network (VPN) Client Certificate Authentication feature for Cisco Adaptive Security Appliance… |
CVE-2018-10066 | High | 8.1 | 2018-04-13 | An issue was discovered in MikroTik RouterOS 6.41.4. Missing OpenVPN server certificate verification allows a remote unauthenticated attacker capable of interc… |
CVE-2017-6143 | Medium | 5.4 | 2018-04-13 | X509 certificate verification was not correctly implemented in the IP Intelligence Subscription and IP Intelligence feed-list features, and thus the remote ser… |
CVE-2015-1777 | Medium | 5.9 | 2018-04-12 | rhnreg_ks in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Gluster Storage 2.1 and Enterprise Linux (RHEL) 5, 6, and 7 does not properly valid… |
CVE-2018-0553 | High | 7.4 | 2018-04-09 | The iRemoconWiFi App for Android version 4.1.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spo… |
CVE-2018-1000151 | Medium | 5.6 | 2018-04-05 | A man in the middle vulnerability exists in Jenkins vSphere Plugin 2.16 and older in VSphere.java that disables SSL/TLS certificate validation by default. |
CVE-2018-4086 | Medium | 5.9 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS bef… |
CVE-2017-13863 | Medium | 5.9 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "APNs" component. It allows man-in-the-middle attackers to… |
CVE-2018-9127 | Critical | 9.8 | 2018-04-02 | Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125… |
CVE-2015-4954 | Medium | 5.9 | 2018-03-27 | IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 improperly allows self-signed certificates, which might allow remote attackers to co… |
CVE-2018-5466 | High | 7.5 | 2018-03-26 | Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have a self-signed SSL certificate vulnerability this could allow an attacker to gain unauthorized… |
CVE-2018-5464 | High | 7.5 | 2018-03-26 | Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an untrusted SSL certificate vulnerability this could allow an attacker to gain unauthorized… |
CVE-2018-5462 | High | 7.5 | 2018-03-26 | Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an SSL incorrect hostname certificate vulnerability this could allow an attacker to gain unau… |
CVE-2018-8970 | High | 7.4 | 2018-03-24 | The int_x509_param_set_hosts function in lib/libcrypto/x509/x509_vpm.c in LibreSSL 2.7.0 before 2.7.1 does not support a certain special case of a zero name le… |
CVE-2018-5502 | High | 7.5 | 2018-03-22 | On F5 BIG-IP versions 13.0.0 - 13.1.0.3, attackers may be able to disrupt services on the BIG-IP system with maliciously crafted client certificate. This vulne… |
CVE-2018-6221 | High | 8.1 | 2018-03-15 | An unvalidated software update vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a man-in-the-middle attacker to tamper with an update file… |
CVE-2018-6219 | Medium | 6.5 | 2018-03-15 | An Insecure Update via HTTP vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to eavesdrop and tamper with certain types of upd… |
CVE-2018-1000096 | High | 8.1 | 2018-03-13 | brianleroux tiny-json-http version all versions since commit 9b8e74a232bba4701844e07bcba794173b0238a8 (Oct 29 2016) contains a Missing SSL certificate validati… |
CVE-2016-9952 | High | 8.1 | 2018-03-12 | The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, makes it eas… |
CVE-2017-2667 | High | 8.1 | 2018-03-12 | Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default. As a r… |
CVE-2017-18227 | High | 7.5 | 2018-03-12 | TitanHQ WebTitan Gateway has incorrect certificate validation for the TLS interception feature. |
CVE-2018-8059 | High | 8.8 | 2018-03-11 | The Djelibeybi configuration examples for use of NGINX in SUSE Portus 2.3, when applied to certain configurations involving Docker Compose, have a Missing SSL… |
CVE-2018-7234 | High | 7.5 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrary system file downl… |
CVE-2017-7429 | High | 8.8 | 2018-03-02 | The certificate upload in NetIQ eDirectory PKI plugin before 8.8.8 Patch 10 Hotfix 1 could be abused to upload JSP code which could be used by authenticated at… |
CVE-2012-6709 | Medium | 5.9 | 2018-02-23 | ELinks 0.12 and Twibright Links 2.3 have Missing SSL Certificate Validation. |
CVE-2018-0518 | Medium | 5.9 | 2018-02-23 | LINE for iOS version 7.1.3 to 7.1.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain s… |
CVE-2017-17455 | Medium | 5.9 | 2018-02-20 | Mahara 16.10 before 16.10.7, 17.04 before 17.04.5, and 17.10 before 17.10.2 are vulnerable to being forced, via a man-in-the-middle attack, to interact with Ma… |
CVE-2017-17301 | Critical | 9.8 | 2018-02-15 | Huawei AR120-S V200R005C32, V200R006C10, V200R007C00, V200R008C20, AR1200 V200R005C20, V200R005C32, V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R00… |
CVE-2017-15341 | High | 7.5 | 2018-02-15 | Huawei AR3200 V200R008C20, V200R008C30, TE40 V600R006C00, TE50 V600R006C00, TE60 V600R006C00 have a denial of service vulnerability. The software decodes X.509… |
CVE-2017-12721 | Medium | 5.9 | 2018-02-15 | An Improper Certificate Validation issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump do… |
CVE-2017-9968 | Medium | 5.9 | 2018-02-12 | A security misconfiguration vulnerability exists in Schneider Electric's IGSS Mobile application versions 3.01 and prior in which a lack of certificate pinning… |
CVE-2018-6827 | High | 8.1 | 2018-02-09 | VOBOT CLOCK before 0.99.30 devices do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sens… |
CVE-2018-6374 | Medium | 6.5 | 2018-01-31 | The GUI component (aka PulseUI) in Pulse Secure Desktop Linux clients before PULSE5.2R9.2 and 5.3.x before PULSE5.3R4.2 does not perform strict SSL Certificate… |
CVE-2017-15698 | Medium | 5.9 | 2018-01-31 | When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not correctly handle fiel… |
CVE-2017-1000396 | Medium | 5.9 | 2018-01-26 | Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified… |
CVE-2017-1000417 | Medium | 5.3 | 2018-01-22 | MatrixSSL version 3.7.2 adopts a collision-prone OID comparison logic resulting in possible spoofing of OIDs (e.g. in ExtKeyUsage extension) on X.509 certifica… |
CVE-2018-5761 | High | 8.1 | 2018-01-22 | A man-in-the-middle vulnerability related to vCenter access was found in Rubrik CDM 3.x and 4.x before 4.0.4-p2. This vulnerability might expose Rubrik user cr… |
CVE-2017-6142 | Medium | 4.8 | 2018-01-19 | X509 certificate verification was not correctly implemented in the early access "user id" feature in the F5 BIG-IP Advanced Firewall Manager versions 13.0.0, 1… |