CWE-295 · Improper Certificate Validation (page 16)
Page 16 of 17 — CVEs classified under CWE-295, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-9570 | Medium | 5.9 | 2017-06-16 | The mount-vernon-bank-trust-mobile-banking/id542706679 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle at… |
CVE-2017-9569 | Medium | 5.9 | 2017-06-16 | The Citizens Bank (TX) cbtx-on-the-go/id892396102 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attacke… |
CVE-2017-9568 | Medium | 5.9 | 2017-06-16 | The financial-plus-mobile-banking/id731070564 app 3.0.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers t… |
CVE-2017-9567 | Medium | 5.9 | 2017-06-16 | The avb-bank-mobile-banking/id592565443 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoo… |
CVE-2017-9566 | Medium | 5.9 | 2017-06-16 | The fsb-dequeen-mobile-banking/id1091025340 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to… |
CVE-2017-9565 | Medium | 5.9 | 2017-06-16 | The first-security-bank-sleepy-eye-mobile/id870531890 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle att… |
CVE-2017-9564 | Medium | 5.9 | 2017-06-16 | The community-banks-cb2go/id445828071 app 3.1.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof… |
CVE-2017-9563 | Medium | 5.9 | 2017-06-16 | The First Citizens Community Bank fccb/id809930960 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attack… |
CVE-2017-9562 | Medium | 5.9 | 2017-06-16 | The Freedom First freedom-1st-credit-union-mobile-banking/id1085229458 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-… |
CVE-2017-9561 | Medium | 5.9 | 2017-06-16 | The Lee Bank & Trust lbtc-mobile/id1068984753 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers t… |
CVE-2017-9560 | Medium | 5.9 | 2017-06-16 | The cayuga-lake-national-bank/id1151601539 app 4.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to s… |
CVE-2017-9559 | Medium | 5.9 | 2017-06-16 | The MEA Financial vision-bank/id420406345 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to sp… |
CVE-2017-9558 | Medium | 5.9 | 2017-06-16 | The wawa-employees-credit-union-mobile/id1158082793 app 4.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attac… |
CVE-2017-4981 | High | 7.5 | 2017-06-14 | EMC RSA BSAFE Cert-C before 2.9.0.5 contains a potential improper certificate processing vulnerability. |
CVE-2016-7816 | Medium | 5.9 | 2017-06-09 | The Cybozu kintone mobile for Android 1.0.6 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof… |
CVE-2016-7805 | Medium | 5.9 | 2017-06-09 | The mobiGate App for Android version 2.2.1.2 and earlier and mobiGate App for iOS version 2.2.4.1 and earlier do not verify X.509 certificates from SSL servers… |
CVE-2016-5648 | Medium | 5.3 | 2017-06-08 | Acer Portal app before 3.9.4.2000 for Android does not properly validate SSL certificates, which allows remote attackers to perform a Man-in-the-middle attack… |
CVE-2016-8231 | High | 7.5 | 2017-06-04 | In Lenovo Service Bridge before version 4, a bug found in the signature verification logic of the code signing certificate could be exploited by an attacker to… |
CVE-2016-3083 | High | 7.5 | 2017-05-30 | Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes). While validating the server's certificat… |
CVE-2017-2800 | Critical | 9.8 | 2017-05-24 | A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting in potential certificate validation vu… |
CVE-2017-6988 | Medium | 5.9 | 2017-05-22 | An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "802.1X" component. It allows remote attackers to d… |
CVE-2017-2498 | High | 7.5 | 2017-05-22 | An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. The issue involves the "Security" component. It allows attackers to bypass in… |
CVE-2017-8943 | Medium | 5.9 | 2017-05-15 | The PUMA PUMATRAC app 3.0.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain s… |
CVE-2017-8942 | Medium | 5.9 | 2017-05-15 | The YottaMark ShopWell - Healthy Diet & Grocery Food Scanner app 5.3.7 through 5.4.2 for iOS does not verify X.509 certificates from SSL servers, which allows… |
CVE-2017-8941 | Medium | 5.9 | 2017-05-15 | The Interval International app 3.3 through 3.5.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof… |
CVE-2017-8940 | Medium | 5.9 | 2017-05-15 | The Zipongo - Healthy Recipes and Grocery Deals app before 6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle atta… |
CVE-2017-8939 | Medium | 5.9 | 2017-05-15 | The Warner Bros. ellentube app 3.1.1 through 3.1.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spo… |
CVE-2017-8938 | Medium | 5.9 | 2017-05-15 | The Radio Javan app 9.3.4 through 9.6.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers… |
CVE-2017-8937 | Medium | 5.9 | 2017-05-15 | The Life Before Us Yo app 2.5.8 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obta… |
CVE-2017-8936 | Medium | 5.9 | 2017-05-15 | The MoboTap Dolphin Web Browser - Fast Private Internet Search app 9.23.0 through 9.23.2 for iOS does not verify X.509 certificates from SSL servers, which all… |
CVE-2017-8935 | Medium | 5.9 | 2017-05-15 | The Quest Information Systems Indiana Voters app 1.1.24 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers t… |
CVE-2017-0248 | High | 7.5 | 2017-05-12 | Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a cer… |
CVE-2017-8060 | Medium | 5.9 | 2017-05-05 | Acceptance of invalid/self-signed TLS certificates in "Panda Mobile Security" 1.1 for iOS allows a man-in-the-middle and/or physically proximate attacker to si… |
CVE-2017-8059 | High | 8.1 | 2017-05-05 | Acceptance of invalid/self-signed TLS certificates in "Foxit PDF - PDF reader, editor, form, signature" before 5.4 for iOS allows a man-in-the-middle and/or ph… |
CVE-2017-8058 | Medium | 5.9 | 2017-05-05 | Acceptance of invalid/self-signed TLS certificates in Atlassian HipChat before 3.16.2 for iOS allows a man-in-the-middle and/or physically proximate attacker t… |
CVE-2017-5919 | Medium | 5.9 | 2017-05-05 | The 21st Century Insurance app 10.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers an… |
CVE-2017-5918 | Medium | 5.9 | 2017-05-05 | The Banco de Costa Rica BCR Movil app 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof server… |
CVE-2017-5916 | Medium | 5.9 | 2017-05-05 | The America's First Federal Credit Union (FCU) Mobile Banking app 3.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-mi… |
CVE-2017-5915 | Medium | 5.9 | 2017-05-05 | The Emirates NBD Bank P.J.S.C Emirates NBD KSA app 3.10.0 through 3.10.4 (UAE) and 2.0.1 through 2.1.0 (KSA) for iOS does not verify X.509 certificates from SS… |
CVE-2017-5914 | Medium | 5.9 | 2017-05-05 | The DOT IT Banque Zitouna app 2.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and ob… |
CVE-2017-5913 | Medium | 5.9 | 2017-05-05 | The TradeKing Forex for iPhone app 1.2.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers… |
CVE-2017-5912 | Medium | 5.9 | 2017-05-05 | The FOREX.com FOREXTrader for iPhone app 2.9.12 through 2.9.14 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle atta… |
CVE-2017-5911 | Medium | 5.9 | 2017-05-05 | The Banco Santander Mexico SA Supermovil app 3.5 through 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attack… |
CVE-2017-5909 | Medium | 5.9 | 2017-05-05 | The Electronic Funds Source (EFS) Mobile Driver Source app 2.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle atta… |
CVE-2017-5907 | Medium | 5.9 | 2017-05-05 | The Great Southern Bank Great Southern Mobile Banking app before 4.0.4 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-mid… |
CVE-2017-5906 | Medium | 5.9 | 2017-05-05 | The Everyday Health Diabetes in Check: Blood Glucose & Carb Tracker app 3.4.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-… |
CVE-2017-5905 | Medium | 5.9 | 2017-05-05 | The Dollar Bank Mobile app 2.6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obt… |
CVE-2017-5902 | Medium | 5.9 | 2017-05-05 | The PayQuicker app 1.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sens… |
CVE-2017-5901 | Medium | 5.9 | 2017-05-05 | The State Bank of India State Bank Anywhere app 5.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to… |
CVE-2017-3213 | Medium | 5.9 | 2017-05-05 | The Think Mutual Bank Mobile Banking app 3.1.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof s… |
CVE-2017-3212 | Medium | 5.9 | 2017-05-05 | The Space Coast Credit Union Mobile app 2.2 for iOS and 2.1.0.1104 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-mid… |
CVE-2016-4467 | Medium | 5.9 | 2017-05-02 | The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server hostname matches a d… |
CVE-2017-2110 | Medium | 5.9 | 2017-04-28 | The Access CX App for Android prior to 2.0.0.1 and for iOS prior to 2.0.2 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle a… |
CVE-2016-7815 | Medium | 4.2 | 2017-04-28 | Remote Service Manager 3.0.0 to 3.1.4 fails to verify client certificates, which may allow remote attackers to gain access to systems on the network. |
CVE-2017-8301 | Medium | 5.3 | 2017-04-27 | LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied upon for a later check of a verification result, in a use case wh… |
CVE-2017-3563 | High | 8.8 | 2017-04-24 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.0.38 and… |
CVE-2016-5016 | Medium | 5.9 | 2017-04-24 | Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud… |
CVE-2016-1519 | Medium | 5.9 | 2017-04-21 | The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-… |
CVE-2016-1221 | Medium | 5.9 | 2017-04-21 | Jetstar App for iOS before 3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sens… |
CVE-2016-1210 | Medium | 5.9 | 2017-04-21 | The 105 BANK app 1.0 and 1.1 for Android and 1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof… |
CVE-2016-1198 | Medium | 5.9 | 2017-04-21 | Photopt for Android before 2.0.1 does not verify SSL certificates. |
CVE-2016-1186 | Medium | 5.9 | 2017-04-21 | Kintone mobile for Android 1.0.0 through 1.0.5 does not verify SSL server certificates. |
CVE-2016-4840 | Medium | 5.9 | 2017-04-21 | Coordinate Plus App for Android 1.0.2 and earlier and Coordinate Plus App for iOS 1.0.2 and earlier do not verify SSL certificates. |
CVE-2016-4832 | Medium | 5.9 | 2017-04-21 | WAON "Service Application" for Android 1.4.1 and earlier does not verify SSL certificates. |
CVE-2016-4830 | Medium | 5.9 | 2017-04-21 | Sushiro App for iOS 2.1.16 and earlier and Sushiro App for Android 2.1.16.1 and earlier do not verify SSL certificates. |
CVE-2016-4829 | Medium | 5.9 | 2017-04-21 | DMM Movie Player App for Android before 1.2.1, and DMM Movie Player App for iPhone/iPad before 2.1.3 does not verify SSL certificates. |
CVE-2016-1184 | Medium | 5.9 | 2017-04-21 | Tokyo Star bank App for Android before 1.4 and Tokyo Star bank App for iOS before 1.4 do not validate SSL certificates. |
CVE-2016-1148 | High | 8.1 | 2017-04-21 | Akerun - Smart Lock Robot App for iOS before 1.2.4 does not verify SSL certificates. |
CVE-2017-2784 | High | 8.1 | 2017-04-20 | An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x bef… |
CVE-2016-4818 | Medium | 5.9 | 2017-04-20 | DMMFX Trade for Android 1.5.0 and earlier, DMMFX DEMO Trade for Android 1.5.0 and earlier, and GAITAMEJAPAN FX Trade for Android 1.4.0 and earlier do not verif… |
CVE-2017-5653 | Medium | 5.3 | 2017-04-18 | JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows re… |
CVE-2013-6662 | Medium | 6.5 | 2017-04-13 | Google Chrome caches TLS sessions before certificate validation occurs. |
CVE-2016-1132 | High | 7.5 | 2017-04-13 | Shoplat App for iOS 1.10.00 through 1.18.00 does not properly verify SSL certificates. |
CVE-2015-7826 | Critical | 9.8 | 2017-04-10 | botan 1.11.x before 1.11.22 improperly handles wildcard matching against hostnames, which might allow remote attackers to have unspecified impact via a valid X… |
CVE-2017-2387 | Medium | 4.8 | 2017-04-07 | The Apple Music (aka com.apple.android.music) application before 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-m… |
CVE-2017-7192 | High | 7.5 | 2017-04-06 | WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because of incorrect management of the certValidated variable (it can be set to true bu… |
CVE-2017-5887 | High | 7.5 | 2017-04-06 | WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because pinning occurs in the stream function (this is too late; pinning should occur i… |
CVE-2015-4680 | High | 7.5 | 2017-04-05 | FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates. |
CVE-2013-7450 | High | 7.5 | 2017-04-03 | Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations. |
CVE-2016-9319 | Medium | 5.9 | 2017-03-31 | There is Missing SSL Certificate Validation in the Trend Micro Enterprise Mobile Security Android Application before 9.7.1193, aka VRTS-398. |
CVE-2017-7322 | High | 8.1 | 2017-03-30 | The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier do not verify X.509 certificates from SSL servers, which allows ma… |
CVE-2017-0129 | High | 7.5 | 2017-03-17 | Microsoft Lync for Mac 2011 fails to properly validate certificates, allowing remote attackers to alter server-client communications, aka "Microsoft Lync for M… |
CVE-2015-2330 | High | 7.5 | 2017-03-10 | Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies. |
CVE-2016-9892 | Medium | 5.9 | 2017-03-02 | The esets_daemon service in ESET Endpoint Antivirus for macOS before 6.4.168.0 and Endpoint Security for macOS before 6.4.168.0 does not properly verify X.509… |
CVE-2016-7662 | High | 7.5 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue i… |
CVE-2016-2402 | Medium | 5.9 | 2017-01-30 | OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate fro… |
CVE-2016-9015 | Low | 3.7 | 2017-01-11 | Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS… |
CVE-2016-7171 | Medium | 5.6 | 2016-12-05 | NetApp Plug-in for Symantec NetBackup prior to version 2.0.1 makes use of a non-unique server certificate, making it vulnerable to impersonation. |
CVE-2016-1000033 | Low | 3.7 | 2016-10-25 | Shotwell version 0.22.0 (and possibly other versions) is vulnerable to a TLS/SSL certification validation flaw resulting in a potential for man in the middle a… |
CVE-2015-8960 | High | 8.1 | 2016-09-21 | The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not di… |
CVE-2015-3152 | Medium | 5.9 | 2016-05-16 | Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optio… |
CVE-2015-0534 | High | 7.5 | 2015-08-20 | EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3, RSA BSAFE Crypto-J before 6.2, RSA BSAFE SSL-J before 6.2, and RSA BSAFE SSL… |
CVE-2015-4094 | | 2015-06-02 | The Thycotic Password Manager Secret Server application through 2.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle… | |
CVE-2015-4000 | Low | 3.7 | 2015-05-21 | The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which… |
CVE-2014-3394 | | 2014-10-10 | The Smart Call Home (SCH) implementation in Cisco ASA Software 8.2 before 8.2(5.50), 8.4 before 8.4(7.15), 8.6 before 8.6(1.14), 8.7 before 8.7(1.13), 9.0 befo… | |
CVE-2014-0363 | | 2014-04-30 | The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certifica… | |
CVE-2014-1266 | High | 7.4 | 2014-02-22 | The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple i… |
CVE-2013-0776 | | 2013-02-19 | Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allow man… | |
CVE-2012-4948 | | 2012-11-14 | The default configuration of Fortinet Fortigate UTM appliances uses the same Certification Authority certificate and same private key across different customer… | |
CVE-2012-5824 | | 2012-11-04 | Trillian 5.1.0.19 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certifi… |