CWE-295 · Improper Certificate Validation (page 15)
Page 15 of 17 — CVEs classified under CWE-295, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-5258 | Medium | 5.9 | 2018-01-17 | The Neon app 1.6.14 iOS does not verify X.509 certificates from SSL servers, which allows remote attackers to spoof servers and obtain sensitive information vi… |
CVE-2015-2981 | Medium | 5.9 | 2018-01-12 | The Yodobashi App for Android 1.2.1.0 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof server… |
CVE-2018-0786 | High | 7.5 | 2018-01-10 | Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security… |
CVE-2017-1000415 | Medium | 5.9 | 2018-01-09 | MatrixSSL version 3.7.2 has an incorrect UTCTime date range validation in its X.509 certificate validation process resulting in some certificates have their ex… |
CVE-2015-2320 | Critical | 9.8 | 2018-01-08 | The TLS stack in Mono before 3.12.1 allows remote attackers to have unspecified impact via vectors related to client-side SSLv2 fallback. |
CVE-2015-2319 | High | 7.5 | 2018-01-08 | The TLS stack in Mono before 3.12.1 makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, rel… |
CVE-2015-2318 | High | 8.1 | 2018-01-08 | The TLS stack in Mono before 3.12.1 allows man-in-the-middle attackers to conduct message skipping attacks and consequently impersonate clients by leveraging m… |
CVE-2014-3607 | Medium | 5.9 | 2018-01-08 | DefaultHostnameVerifier in Ldaptive (formerly vt-ldap) does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN… |
CVE-2015-4100 | Medium | 6.8 | 2017-12-21 | Puppet Enterprise 3.7.x and 3.8.0 might allow remote authenticated users to manage certificates for arbitrary nodes by leveraging a client certificate trusted… |
CVE-2017-17718 | Medium | 5.9 | 2017-12-17 | The Net::LDAP (aka net-ldap) gem before 0.16.0 for Ruby has Missing SSL Certificate Validation. |
CVE-2017-17716 | Medium | 5.9 | 2017-12-17 | GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4 release announceme… |
CVE-2017-3194 | High | 8.1 | 2017-12-16 | Pandora iOS app prior to version 8.3.2 fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-i… |
CVE-2017-3190 | High | 7.5 | 2017-12-16 | Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificates provided by HTT… |
CVE-2014-3250 | Medium | 6.5 | 2017-12-11 | The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain s… |
CVE-2016-1252 | Medium | 5.9 | 2017-12-05 | The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before… |
CVE-2017-15114 | High | 8.1 | 2017-11-27 | When libvirtd is configured by OSP director (tripleo-heat-templates) to use the TLS transport it defaults to the same certificate authority as all non-libvirtd… |
CVE-2017-8213 | Medium | 5.3 | 2017-11-22 | Huawei SMC2.0 with software of V100R003C10, V100R005C00SPC100, V100R005C00SPC101B001T, V100R005C00SPC102, V100R005C00SPC103, V100R005C00SPC200, V100R005C00SPC2… |
CVE-2017-15528 | Low | 3.7 | 2017-11-22 | Prior to v 7.6, the Install Norton Security (INS) product can be susceptible to a certificate spoofing vulnerability, which is a type of attack whereby a malic… |
CVE-2017-1000209 | Medium | 5.9 | 2017-11-17 | The Java WebSocket client nv-websocket-client does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltNam… |
CVE-2014-2845 | Medium | 5.9 | 2017-11-15 | Cyberduck before 4.4.4 on Windows does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof FTP-SSL servers via a… |
CVE-2017-11770 | High | 7.5 | 2017-11-15 | .NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly pa… |
CVE-2017-9758 | High | 7.4 | 2017-11-10 | Savitech driver packages for Windows silently install a self-signed certificate into the Trusted Root Certification Authorities store, aka "Inaudible Subversio… |
CVE-2017-2913 | Medium | 5.9 | 2017-11-07 | An exploitable vulnerability exists in the filtering functionality of Circle with Disney. SSL certificates for specific domain names can cause the Bluecoat lib… |
CVE-2017-1000256 | High | 8.1 | 2017-10-31 | libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate S… |
CVE-2017-7080 | High | 7.5 | 2017-10-23 | An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. tvOS before 11 is affected. watchOS before 4 is a… |
CVE-2017-6144 | High | 7.4 | 2017-10-20 | In F5 BIG-IP PEM 12.1.0 through 12.1.2 when downloading the Type Allocation Code (TAC) database file via HTTPS, the server's certificate is not verified. Attac… |
CVE-2014-7242 | Medium | 5.9 | 2017-10-18 | The SumaHo application 3.0.0 and earlier for Android and the SumaHo "driving capability" diagnosis result transmission application 1.2.2 and earlier for Androi… |
CVE-2014-3706 | Medium | 5.9 | 2017-10-18 | ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certif… |
CVE-2017-13083 | Medium | 5.3 | 2017-10-18 | Akeo Consulting Rufus prior to version 2.17.1187 does not adequately validate the integrity of updates downloaded over HTTP, allowing an attacker to easily con… |
CVE-2017-10620 | High | 7.4 | 2017-10-13 | Juniper Networks Junos OS on SRX series devices do not verify the HTTPS server certificate before downloading anti-virus updates. This may allow a man-in-the-m… |
CVE-2015-6358 | Medium | 5.9 | 2017-10-12 | Multiple Cisco embedded devices use hardcoded X.509 certificates and SSH host keys embedded in the firmware, which allows remote attackers to defeat cryptograp… |
CVE-2015-7778 | Medium | 5.9 | 2017-10-10 | Gurunavi App for iOS before 6.0.0 does not verify SSL certificates which could allow remote attackers to perform man-in-the-middle attacks. |
CVE-2015-5639 | High | 7.4 | 2017-10-10 | niconico App for iOS before 6.38 does not verify SSL certificates which could allow remote attackers to execute man-in-the-middle attacks. |
CVE-2015-2988 | High | 7.4 | 2017-10-10 | Rakuten card App for iOS 5.2.0 through 5.2.4 does not verify SSL certificates which might allow remote attackers to execute man-in-the-middle attacks. |
CVE-2017-1000097 | High | 7.5 | 2017-10-05 | On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not… |
CVE-2017-14582 | Medium | 5.9 | 2017-09-30 | The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middl… |
CVE-2017-12228 | Medium | 5.9 | 2017-09-29 | A vulnerability in the Cisco Network Plug and Play application of Cisco IOS 12.4 through 15.6 and Cisco IOS XE 3.3 through 16.4 could allow an unauthenticated… |
CVE-2015-0874 | Medium | 5.9 | 2017-09-26 | Smartphone Passbook 1.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information from en… |
CVE-2017-7971 | Medium | 6.5 | 2017-09-26 | A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywher… |
CVE-2015-7785 | Medium | 5.9 | 2017-09-25 | GANMA! App for iOS does not verify SSL certificates. |
CVE-2015-5666 | Medium | 5.9 | 2017-09-25 | ANA App for Android 3.1.1 and earlier, and ANA App for iOS 3.3.6 and earlier does not verify SSL certificates. |
CVE-2015-5263 | High | 8.1 | 2017-09-25 | pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon registration. |
CVE-2015-3420 | Medium | 5.9 | 2017-09-19 | The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a denial of service (login process crash) vi… |
CVE-2016-10511 | Medium | 5.9 | 2017-09-18 | The Twitter iOS client versions 6.62 and 6.62.1 fail to validate Twitter's server certificates for the /1.1/help/settings.json configuration endpoint, permitti… |
CVE-2017-2299 | High | 7.5 | 2017-09-15 | Versions of the puppetlabs-apache module prior to 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. If you specify the `ssl_ca` parame… |
CVE-2017-14420 | Medium | 5.9 | 2017-09-13 | The D-Link NPAPI extension, as used on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devic… |
CVE-2017-14419 | Medium | 5.9 | 2017-09-13 | The D-Link NPAPI extension, as used on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devic… |
CVE-2015-2943 | Medium | 5.9 | 2017-09-06 | Honda Moto LINC 1.6.1 does not verify SSL certificates. |
CVE-2017-6594 | High | 7.5 | 2017-08-28 | The transit path validation code in Heimdal before 7.3 might allow attackers to bypass the capath policy protection mechanism by leveraging failure to add the… |
CVE-2015-0210 | Medium | 5.9 | 2017-08-28 | wpa_supplicant 2.0-16 does not properly check certificate subject name, which allows remote attackers to cause a man-in-the-middle attack. |
CVE-2015-4017 | High | 7.5 | 2017-08-25 | Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules. |
CVE-2017-8445 | Medium | 5.5 | 2017-08-18 | An error was found in the X-Pack Security TLS trust manager for versions 5.0.0 to 5.5.1. If reloading the trust material fails the trust manager will be replac… |
CVE-2014-3451 | High | 7.5 | 2017-08-18 | OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks. |
CVE-2015-2674 | Medium | 5.9 | 2017-08-09 | Restkit allows man-in-the-middle attackers to spoof TLS servers by leveraging use of the ssl.wrap_socket function in Python with the default CERT_NONE value fo… |
CVE-2015-5619 | Medium | 5.9 | 2017-08-09 | Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack output or the Logstash forwarder does not validate SSL/TLS certificates from the Logstash se… |
CVE-2017-11506 | High | 7.4 | 2017-08-09 | When linking a Nessus scanner or agent to Tenable.io or other manager, Nessus 6.x before 6.11 does not verify the manager's TLS certificate when making the ini… |
CVE-2017-7932 | Medium | 6.0 | 2017-08-07 | An improper certificate validation issue was discovered in NXP i.MX 28 i.MX 50, i.MX 53, i.MX 7Solo i.MX 7Dual Vybrid VF3xx, Vybrid VF5xx, Vybrid VF6xx, i.MX 6… |
CVE-2017-6664 | High | 7.5 | 2017-08-07 | A vulnerability in the Autonomic Networking feature of Cisco IOS XE Software could allow an unauthenticated, remote, autonomic node to access the Autonomic Net… |
CVE-2017-10819 | Medium | 5.9 | 2017-08-04 | MaLion for Mac 4.3.0 to 5.2.1 does not properly validate certificates, which may allow an attacker to eavesdrop on an encrypted communication. |
CVE-2017-2278 | Medium | 5.9 | 2017-08-02 | The RBB SPEED TEST App for Android version 2.0.3 and earlier, RBB SPEED TEST App for iOS version 2.1.0 and earlier does not verify X.509 certificates from SSL… |
CVE-2017-11364 | High | 8.8 | 2017-08-02 | The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain control of the targ… |
CVE-2017-11132 | High | 7.5 | 2017-08-01 | An issue was discovered in heinekingmedia StashCat before 1.5.18 for Android. No certificate pinning is implemented; therefore the attacker could issue a certi… |
CVE-2015-0904 | Medium | 5.9 | 2017-07-25 | The Restaurant Karaoke SHIDAX app 1.3.3 and earlier on Android does not verify SSL certificates, which allows remote attackers to obtain sensitive information… |
CVE-2015-3886 | Critical | 9.8 | 2017-07-21 | libinfinity before 0.6.6-1 does not validate expired SSL certificates, which allows remote attackers to have unspecified impact via unknown vectors. |
CVE-2017-11501 | Medium | 5.9 | 2017-07-20 | NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication ag… |
CVE-2017-1000007 | Medium | 5.9 | 2017-07-17 | txAWS (all current versions) fail to perform complete certificate verification resulting in vulnerability to MitM attacks and information disclosure. |
CVE-2017-7726 | High | 7.5 | 2017-07-11 | iSmartAlarm cube devices have an SSL Certificate Validation Vulnerability. |
CVE-2017-7406 | Critical | 9.8 | 2017-07-07 | The D-Link DIR-615 device before v20.12PTb04 doesn't use SSL for any of the authenticated pages. Also, it doesn't allow the user to generate his own SSL Certif… |
CVE-2017-3218 | High | 8.8 | 2017-06-21 | Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician uses HTTP for software update… |
CVE-2017-9601 | Medium | 5.9 | 2017-06-16 | The "FNB Kemp Mobile Banking" by First National Bank of Kemp app 3.0.2 -- aka fnb-kemp-mobile-banking/id571448725 for iOS does not verify X.509 certificates fr… |
CVE-2017-9600 | Medium | 5.9 | 2017-06-16 | The "Peoples Bank Tulsa" by Peoples Bank - OK app 3.0.2 -- aka peoples-bank-tulsa/id1074279285 for iOS does not verify X.509 certificates from SSL servers, whi… |
CVE-2017-9599 | Medium | 5.9 | 2017-06-16 | The "Fountain Trust Mobile Banking" by FOUNTAIN TRUST COMPANY app before 3.2.0 -- aka fountain-trust-mobile-banking/id891343006 for iOS does not verify X.509 c… |
CVE-2017-9598 | Medium | 5.9 | 2017-06-16 | The "Morton Credit Union Mobile Banking" by Morton Credit Union app 3.0.1 -- aka morton-credit-union-mobile-banking/id1119623070 for iOS does not verify X.509… |
CVE-2017-9597 | Medium | 5.9 | 2017-06-16 | The "Blue Ridge Bank and Trust Co. Mobile Banking" by Blue Ridge Bank and Trust Co. app 3.0.1 -- aka blue-ridge-bank-and-trust-co-mobile-banking/id699679197 fo… |
CVE-2017-9596 | Medium | 5.9 | 2017-06-16 | The "CFB Mobile Banking" by Citizens First Bank Wisconsin app 3.0.1 -- aka cfb-mobile-banking/id1081102805 for iOS does not verify X.509 certificates from SSL… |
CVE-2017-9595 | Medium | 5.9 | 2017-06-16 | The "First State Bank of Bigfork Mobile Banking" by First State Bank of Bigfork app 4.0.3 -- aka first-state-bank-of-bigfork-mobile-banking/id1133969876 for iO… |
CVE-2017-9594 | Medium | 5.9 | 2017-06-16 | The "SVB Mobile" by Sauk Valley Bank Mobile Banking app 3.0.0 -- aka svb-mobile/id796429885 for iOS does not verify X.509 certificates from SSL servers, which… |
CVE-2017-9593 | Medium | 5.9 | 2017-06-16 | The "Oculina Mobile Banking" by Oculina Bank app 3.0.0 -- aka oculina-mobile-banking/id867025690 for iOS does not verify X.509 certificates from SSL servers, w… |
CVE-2017-9592 | Medium | 5.9 | 2017-06-16 | The "Your Legacy Federal Credit Union Mobile Banking" by Your Legacy Federal Credit Union app 3.0.1 -- aka your-legacy-federal-credit-union-mobile-banking/id91… |
CVE-2017-9591 | Medium | 5.9 | 2017-06-16 | The "PCB Mobile" by Phelps County Bank app 3.0.2 -- aka pcb-mobile/id436891295 for iOS does not verify X.509 certificates from SSL servers, which allows man-in… |
CVE-2017-9590 | Medium | 5.9 | 2017-06-16 | The "State Bank of Waterloo Mobile Banking" by State Bank of Waterloo app 3.0.2 -- aka state-bank-of-waterloo-mobile-banking/id555321714 for iOS does not verif… |
CVE-2017-9589 | Medium | 5.9 | 2017-06-16 | The "SCSB Shelbyville IL Mobile Banking" by Shelby County State Bank app 3.0.0 -- aka scsb-shelbyville-il-mobile-banking/id938960224 for iOS does not verify X… |
CVE-2017-9588 | Medium | 5.9 | 2017-06-16 | The "Oritani Mobile Banking" by Oritani Bank app 3.0.0 -- aka oritani-mobile-banking/id778851066 for iOS does not verify X.509 certificates from SSL servers, w… |
CVE-2017-9587 | Medium | 5.9 | 2017-06-16 | The "PCSB BANK Mobile" by PCSB Bank app 3.0.4 -- aka pcsb-bank-mobile/id1067472090 for iOS does not verify X.509 certificates from SSL servers, which allows ma… |
CVE-2017-9586 | Medium | 5.9 | 2017-06-16 | The "FSBY Mobile Banking" by First State Bank of Yoakum TX app 3.0.0 -- aka fsby-mobile-banking/id899136434 for iOS does not verify X.509 certificates from SSL… |
CVE-2017-9585 | Medium | 5.9 | 2017-06-16 | The "Community State Bank - Lamar Mobile Banking" by Community State Bank - Lamar app 3.0.3 -- aka community-state-bank-lamar-mobile-banking/id1083927885 for i… |
CVE-2017-9584 | Medium | 5.9 | 2017-06-16 | The "HBO Mobile Banking" by Heritage Bank of Ozarks app 3.0.0 -- aka hbo-mobile-banking/id860224933 for iOS does not verify X.509 certificates from SSL servers… |
CVE-2017-9583 | Medium | 5.9 | 2017-06-16 | The "Charlevoix State Bank" by Charlevoix State Bank app 3.0.1 -- aka charlevoix-state-bank/id1128963717 for iOS does not verify X.509 certificates from SSL se… |
CVE-2017-9582 | Medium | 5.9 | 2017-06-16 | The "BNB Mobile Banking" by Brady National Bank app 3.0.0 -- aka bnb-mobile-banking/id674215747 for iOS does not verify X.509 certificates from SSL servers, wh… |
CVE-2017-9581 | Medium | 5.9 | 2017-06-16 | The "Algonquin State Bank Mobile Banking" by Algonquin State Bank app 3.0.0 -- aka algonquin-state-bank-mobile-banking/id1089657735 for iOS does not verify X.5… |
CVE-2017-9580 | Medium | 5.9 | 2017-06-16 | The "Pioneer Bank & Trust Mobile Banking" by PIONEER BANK AND TRUST app 3.0.0 -- aka pioneer-bank-trust-mobile-banking/id603182861 for iOS does not verify X.50… |
CVE-2017-9579 | Medium | 5.9 | 2017-06-16 | The "JMCU Mobile Banking" by Joplin Metro Credit Union app 3.0.0 -- aka jmcu-mobile-banking/id716065893 for iOS does not verify X.509 certificates from SSL ser… |
CVE-2017-9578 | Medium | 5.9 | 2017-06-16 | The "RVCB Mobile" by RVCB Mobile Banking app 3.0.0 -- aka rvcb-mobile/id757928895 for iOS does not verify X.509 certificates from SSL servers, which allows man… |
CVE-2017-9577 | Medium | 5.9 | 2017-06-16 | The "First Citizens Bank-Mobile Banking" by First Citizens Bank (AL) app 3.0.0 -- aka first-citizens-bank-mobile-banking/id566037101 for iOS does not verify X… |
CVE-2017-9576 | Medium | 5.9 | 2017-06-16 | The "Middleton Community Bank Mobile Banking" by Middleton Community Bank app 3.0.0 -- aka middleton-community-bank-mobile-banking/id721843238 for iOS does not… |
CVE-2017-9575 | Medium | 5.9 | 2017-06-16 | The "FVB Mobile Banking" by First Volunteer Bank of Tennessee app 3.1.1 -- aka fvb-mobile-banking/id551018004 for iOS does not verify X.509 certificates from S… |
CVE-2017-9574 | Medium | 5.9 | 2017-06-16 | The "KC Area Credit Union Mobile Banking" by K C Area Credit Union app 3.0.1 -- aka kc-area-credit-union-mobile-banking/id1097607736 for iOS does not verify X… |
CVE-2017-9573 | Medium | 5.9 | 2017-06-16 | The North Adams State Bank (Ursa) nasb-mobile-banking/id980573797 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-th… |
CVE-2017-9572 | Medium | 5.9 | 2017-06-16 | The athens-state-bank-mobile-banking/id719748589 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attacker… |
CVE-2017-9571 | Medium | 5.9 | 2017-06-16 | The Citizens Community Bank (TN) ccb-mobile-banking/id610030469 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-… |