CWE-295 · Improper Certificate Validation (page 15)
Page 15 of 15 — CVEs classified under CWE-295, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-5909 | Medium | 5.9 | 2017-05-05 | The Electronic Funds Source (EFS) Mobile Driver Source app 2.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle atta… |
CVE-2017-5907 | Medium | 5.9 | 2017-05-05 | The Great Southern Bank Great Southern Mobile Banking app before 4.0.4 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-mid… |
CVE-2017-5906 | Medium | 5.9 | 2017-05-05 | The Everyday Health Diabetes in Check: Blood Glucose & Carb Tracker app 3.4.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-… |
CVE-2017-5905 | Medium | 5.9 | 2017-05-05 | The Dollar Bank Mobile app 2.6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obt… |
CVE-2017-5902 | Medium | 5.9 | 2017-05-05 | The PayQuicker app 1.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sens… |
CVE-2017-5901 | Medium | 5.9 | 2017-05-05 | The State Bank of India State Bank Anywhere app 5.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to… |
CVE-2017-3213 | Medium | 5.9 | 2017-05-05 | The Think Mutual Bank Mobile Banking app 3.1.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof s… |
CVE-2017-3212 | Medium | 5.9 | 2017-05-05 | The Space Coast Credit Union Mobile app 2.2 for iOS and 2.1.0.1104 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-mid… |
CVE-2016-4467 | Medium | 5.9 | 2017-05-02 | The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server hostname matches a d… |
CVE-2017-2110 | Medium | 5.9 | 2017-04-28 | The Access CX App for Android prior to 2.0.0.1 and for iOS prior to 2.0.2 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle a… |
CVE-2016-7815 | Medium | 4.2 | 2017-04-28 | Remote Service Manager 3.0.0 to 3.1.4 fails to verify client certificates, which may allow remote attackers to gain access to systems on the network. |
CVE-2017-8301 | Medium | 5.3 | 2017-04-27 | LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied upon for a later check of a verification result, in a use case wh… |
CVE-2017-3563 | High | 8.8 | 2017-04-24 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.0.38 and… |
CVE-2016-5016 | Medium | 5.9 | 2017-04-24 | Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud… |
CVE-2016-1519 | Medium | 5.9 | 2017-04-21 | The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-… |
CVE-2016-1221 | Medium | 5.9 | 2017-04-21 | Jetstar App for iOS before 3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sens… |
CVE-2016-1210 | Medium | 5.9 | 2017-04-21 | The 105 BANK app 1.0 and 1.1 for Android and 1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof… |
CVE-2016-1198 | Medium | 5.9 | 2017-04-21 | Photopt for Android before 2.0.1 does not verify SSL certificates. |
CVE-2016-1186 | Medium | 5.9 | 2017-04-21 | Kintone mobile for Android 1.0.0 through 1.0.5 does not verify SSL server certificates. |
CVE-2016-4840 | Medium | 5.9 | 2017-04-21 | Coordinate Plus App for Android 1.0.2 and earlier and Coordinate Plus App for iOS 1.0.2 and earlier do not verify SSL certificates. |
CVE-2016-4832 | Medium | 5.9 | 2017-04-21 | WAON "Service Application" for Android 1.4.1 and earlier does not verify SSL certificates. |
CVE-2016-4830 | Medium | 5.9 | 2017-04-21 | Sushiro App for iOS 2.1.16 and earlier and Sushiro App for Android 2.1.16.1 and earlier do not verify SSL certificates. |
CVE-2016-4829 | Medium | 5.9 | 2017-04-21 | DMM Movie Player App for Android before 1.2.1, and DMM Movie Player App for iPhone/iPad before 2.1.3 does not verify SSL certificates. |
CVE-2016-1184 | Medium | 5.9 | 2017-04-21 | Tokyo Star bank App for Android before 1.4 and Tokyo Star bank App for iOS before 1.4 do not validate SSL certificates. |
CVE-2016-1148 | High | 8.1 | 2017-04-21 | Akerun - Smart Lock Robot App for iOS before 1.2.4 does not verify SSL certificates. |
CVE-2017-2784 | High | 8.1 | 2017-04-20 | An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x bef… |
CVE-2016-4818 | Medium | 5.9 | 2017-04-20 | DMMFX Trade for Android 1.5.0 and earlier, DMMFX DEMO Trade for Android 1.5.0 and earlier, and GAITAMEJAPAN FX Trade for Android 1.4.0 and earlier do not verif… |
CVE-2017-5653 | Medium | 5.3 | 2017-04-18 | JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows re… |
CVE-2013-6662 | Medium | 6.5 | 2017-04-13 | Google Chrome caches TLS sessions before certificate validation occurs. |
CVE-2016-1132 | High | 7.5 | 2017-04-13 | Shoplat App for iOS 1.10.00 through 1.18.00 does not properly verify SSL certificates. |
CVE-2015-7826 | Critical | 9.8 | 2017-04-10 | botan 1.11.x before 1.11.22 improperly handles wildcard matching against hostnames, which might allow remote attackers to have unspecified impact via a valid X… |
CVE-2017-2387 | Medium | 4.8 | 2017-04-07 | The Apple Music (aka com.apple.android.music) application before 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-m… |
CVE-2017-7192 | High | 7.5 | 2017-04-06 | WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because of incorrect management of the certValidated variable (it can be set to true bu… |
CVE-2017-5887 | High | 7.5 | 2017-04-06 | WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because pinning occurs in the stream function (this is too late; pinning should occur i… |
CVE-2015-4680 | High | 7.5 | 2017-04-05 | FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates. |
CVE-2013-7450 | High | 7.5 | 2017-04-03 | Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations. |
CVE-2016-9319 | Medium | 5.9 | 2017-03-31 | There is Missing SSL Certificate Validation in the Trend Micro Enterprise Mobile Security Android Application before 9.7.1193, aka VRTS-398. |
CVE-2017-7322 | High | 8.1 | 2017-03-30 | The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier do not verify X.509 certificates from SSL servers, which allows ma… |
CVE-2017-0129 | High | 7.5 | 2017-03-17 | Microsoft Lync for Mac 2011 fails to properly validate certificates, allowing remote attackers to alter server-client communications, aka "Microsoft Lync for M… |
CVE-2015-2330 | High | 7.5 | 2017-03-10 | Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies. |
CVE-2016-9892 | Medium | 5.9 | 2017-03-02 | The esets_daemon service in ESET Endpoint Antivirus for macOS before 6.4.168.0 and Endpoint Security for macOS before 6.4.168.0 does not properly verify X.509… |
CVE-2016-7662 | High | 7.5 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue i… |
CVE-2016-2402 | Medium | 5.9 | 2017-01-30 | OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate fro… |
CVE-2016-9015 | Low | 3.7 | 2017-01-11 | Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS… |
CVE-2016-7171 | Medium | 5.6 | 2016-12-05 | NetApp Plug-in for Symantec NetBackup prior to version 2.0.1 makes use of a non-unique server certificate, making it vulnerable to impersonation. |
CVE-2016-1000033 | Low | 3.7 | 2016-10-25 | Shotwell version 0.22.0 (and possibly other versions) is vulnerable to a TLS/SSL certification validation flaw resulting in a potential for man in the middle a… |
CVE-2015-8960 | High | 8.1 | 2016-09-21 | The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not di… |
CVE-2015-3152 | Medium | 5.9 | 2016-05-16 | Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optio… |
CVE-2015-0534 | High | 7.5 | 2015-08-20 | EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3, RSA BSAFE Crypto-J before 6.2, RSA BSAFE SSL-J before 6.2, and RSA BSAFE SSL… |
CVE-2015-4094 | | 2015-06-02 | The Thycotic Password Manager Secret Server application through 2.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle… | |
CVE-2015-4000 | Low | 3.7 | 2015-05-21 | The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which… |
CVE-2014-3394 | | 2014-10-10 | The Smart Call Home (SCH) implementation in Cisco ASA Software 8.2 before 8.2(5.50), 8.4 before 8.4(7.15), 8.6 before 8.6(1.14), 8.7 before 8.7(1.13), 9.0 befo… | |
CVE-2014-0363 | | 2014-04-30 | The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certifica… | |
CVE-2014-1266 | High | 7.4 | 2014-02-22 | The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple i… |
CVE-2013-0776 | | 2013-02-19 | Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allow man… | |
CVE-2012-4948 | | 2012-11-14 | The default configuration of Fortinet Fortigate UTM appliances uses the same Certification Authority certificate and same private key across different customer… | |
CVE-2012-5824 | | 2012-11-04 | Trillian 5.1.0.19 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certifi… | |
CVE-2012-5822 | High | 7.4 | 2012-11-04 | The contribution feature in Zamboni does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of… |
CVE-2012-5821 | Medium | 5.9 | 2012-11-04 | Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL server… |
CVE-2012-5819 | High | 7.4 | 2012-11-04 | FilesAnywhere does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate… |
CVE-2012-5817 | High | 7.4 | 2012-11-04 | Codehaus XFire 1.2.6 and earlier, as used in the Amazon EC2 API Tools Java library and other products, does not verify that the server hostname matches a domai… |
CVE-2012-5810 | Medium | 5.9 | 2012-11-04 | The Chase mobile banking application for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAlt… |
CVE-2012-5783 | | 2012-11-04 | Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname… | |
CVE-2012-3446 | Medium | 5.9 | 2012-11-04 | Apache Libcloud before 0.11.1 uses an incorrect regular expression during verification of whether the server hostname matches a domain name in the subject's Co… |
CVE-2012-3037 | | 2012-09-25 | The Siemens SIMATIC S7-1200 2.x PLC does not properly protect the private key of the SIMATIC CONTROLLER Certification Authority certificate, which allows remot… | |
CVE-2012-2993 | Medium | 5.9 | 2012-09-18 | Microsoft Windows Phone 7 does not verify the domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attac… |
CVE-2012-0867 | | 2012-07-18 | PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, whi… | |
CVE-2011-3061 | | 2012-03-30 | Google Chrome before 18.0.1025.142 does not properly check X.509 certificates before use of a SPDY proxy, which might allow man-in-the-middle attackers to spoo… | |
CVE-2011-3024 | | 2012-02-16 | Google Chrome before 17.0.963.56 allows remote attackers to cause a denial of service (application crash) via an empty X.509 certificate. | |
CVE-2011-2874 | | 2011-09-19 | Google Chrome before 14.0.835.163 does not perform an expected pin operation for a self-signed certificate during a session, which has unspecified impact and r… | |
CVE-2011-0199 | Medium | 5.9 | 2011-06-24 | The Certificate Trust Policy component in Apple Mac OS X before 10.6.8 does not perform CRL checking for Extended Validation (EV) certificates that lack OCSP U… |
CVE-2010-4685 | | 2011-01-07 | Cisco IOS before 15.0(1)XA1 does not clear the public key cache upon a change to a certificate map, which allows remote authenticated users to bypass a certifi… | |
CVE-2010-1378 | Critical | 9.8 | 2010-11-15 | OpenSSL in Apple Mac OS X 10.6.x before 10.6.5 does not properly perform arithmetic, which allows remote attackers to bypass X.509 certificate authentication v… |
CVE-2009-4831 | | 2010-04-29 | Cerulean Studios Trillian 3.1 Basic does not check SSL certificates during MSN authentication, which allows remote attackers to obtain MSN credentials via a ma… | |
CVE-2009-3555 | Critical | 9.8 | 2009-11-09 | The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Serve… |
CVE-2009-3767 | | 2009-10-23 | libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain nam… | |
CVE-2009-3046 | High | 7.5 | 2009-09-02 | Opera before 10.00 does not check all intermediate X.509 certificates for revocation, which makes it easier for remote SSL servers to bypass validation of the… |
CVE-2009-2409 | | 2009-07-30 | The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products… | |
CVE-2009-2408 | Medium | 5.9 | 2009-07-30 | Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a… |
CVE-2009-0265 | High | 7.5 | 2009-01-26 | Internet Systems Consortium (ISC) BIND 9.6.0 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remot… |
CVE-2008-4989 | Medium | 5.9 | 2008-11-13 | The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate i… |
CVE-2005-3170 | Medium | 5.0 | 2005-10-06 | The LDAP client on Microsoft Windows 2000 before Update Rollup 1 for SP4 accepts certificates using LDAP Secure Sockets Layer (LDAPS) even when the Certificate… |
CVE-2003-1229 | | 2003-12-31 | X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01, (2) JSSE before 1.0.3, (3) Java Plug-in SDK and JRE 1.3.0 th… | |
CVE-2002-0862 | | 2002-10-04 | The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Micros… |