CWE-295 · Improper Certificate Validation (page 5)
Page 5 of 15 — CVEs classified under CWE-295, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-54849 | Medium | 5.9 | 2025-01-10 | An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the second RSA private key and access sensitive data or execute a man-in-the-middle a… |
CVE-2024-54848 | High | 7.4 | 2025-01-10 | Improper handling and storage of certificates in CP Plus CP-VNR-3104 B3223P22C02424 allow attackers to decrypt communications or execute a man-in-the-middle at… |
CVE-2024-54847 | Medium | 5.9 | 2025-01-10 | An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to access the Diffie-Hellman (DH) parameters and access sensitive data or execute a man-in-the-… |
CVE-2024-54846 | Medium | 5.9 | 2025-01-10 | An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the EC private key and access sensitive data or execute a man-in-the-middle attack. |
CVE-2025-20126 | Medium | 4.8 | 2025-01-08 | A vulnerability in certification validation routines of Cisco ThousandEyes Endpoint Agent for macOS and RoomOS could allow an unauthenticated, remote attacker… |
CVE-2025-0239 | Medium | 4.0 | 2025-01-07 | When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability was fixed in Fi… |
CVE-2024-40702 | High | 8.2 | 2025-01-07 | IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow an unauthorized user to obtain valid tokens to gain access to protected resou… |
CVE-2024-56521 | Critical | 9.8 | 2024-12-27 | An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely. |
CVE-2024-47119 | Medium | 5.9 | 2024-12-18 | IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 does not properly validate a certificate which could allow an attacker to spoof a trusted entity… |
CVE-2024-6001 | High | 8.1 | 2024-12-16 | An improper certificate validation vulnerability was reported in LADM that could allow a network attacker with the ability to redirect an update request to a r… |
CVE-2024-4762 | High | 7.8 | 2024-12-16 | An improper validation vulnerability was reported in the firmware update mechanism of LADM and LDCC that could allow a local attacker to escalate privileges. |
CVE-2024-21543 | High | 7.1 | 2024-12-13 | Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls ba… |
CVE-2024-12174 | Low | 2.7 | 2024-12-09 | An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated, privileged attacker could intercept email messages s… |
CVE-2024-54147 | Medium | 6.8 | 2024-12-09 | Altair is a GraphQL client for all platforms. Prior to version 8.0.5, Altair GraphQL Client's desktop app does not validate HTTPS certificates allowing a man-i… |
CVE-2024-48865 | High | 7.5 | 2024-12-06 | An improper certificate validation vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allo… |
CVE-2024-6219 | Low | 3.8 | 2024-12-06 | Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honour… |
CVE-2024-6156 | Low | 3.8 | 2024-12-06 | Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store. |
CVE-2024-53846 | Medium | 5.5 | 2024-12-05 | OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of desig… |
CVE-2024-45205 | High | 7.1 | 2024-12-04 | An Improper Certificate Validation on the UniFi iOS App managing a standalone UniFi Access Point (not using UniFi Network Application) could allow a malicious… |
CVE-2024-5921 | High | 8.8 | 2024-11-27 | An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary serv… |
CVE-2023-51634 | High | 7.5 | 2024-11-22 | NETGEAR RAX30 Improper Certificate Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to compromise the integ… |
CVE-2024-52510 | Medium | 4.2 | 2024-11-15 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed… |
CVE-2022-20814 | High | 7.4 | 2024-11-15 | A vulnerability in the certificate validation of Cisco Expressway-C and Cisco TelePresence VCS could allow an unauthenticated, remote attacker to gai… |
CVE-2024-5918 | Medium | 4.3 | 2024-11-14 | An improper certificate validation vulnerability in Palo Alto Networks PAN-OS software enables an authorized user with a specially crafted client certificate t… |
CVE-2024-49369 | Critical | 9.8 | 2024-11-12 | Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The… |
CVE-2019-20461 | Critical | 9.8 | 2024-11-07 | An issue was discovered on Alecto IVM-100 2019-11-12 devices. The device uses a custom UDP protocol to start and control video and audio services. The protocol… |
CVE-2024-51774 | High | 8.1 | 2024-11-02 | qBittorrent before 5.0.1 proceeds with use of https URLs even after certificate validation errors. |
CVE-2024-30149 | Medium | 4.8 | 2024-10-31 | HCL AppScan Source <= 10.6.0 does not properly validate a TLS/SSL certificate for an executable. |
CVE-2024-43177 | Medium | 5.9 | 2024-10-22 | IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute. |
CVE-2024-47241 | Medium | 5.5 | 2024-10-18 | Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.24, contains an Improper Certificate Validation vulnerability. A low privileged attacker wi… |
CVE-2023-49570 | High | 7.4 | 2024-10-18 | A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software trusts a certificate issued by an entity that… |
CVE-2023-6058 | Medium | 6.8 | 2024-10-18 | A vulnerability has been identified in Bitdefender Safepay's handling of HTTPS connections. The issue arises when the product blocks a connection due to an unt… |
CVE-2023-6057 | High | 7.4 | 2024-10-18 | A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of certificates issued using… |
CVE-2023-6056 | High | 7.4 | 2024-10-18 | A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of self-signed certificates… |
CVE-2023-6055 | High | 7.4 | 2024-10-18 | A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software fails to properly validate website certificat… |
CVE-2023-49567 | Medium | 6.8 | 2024-10-18 | A vulnerability has been identified in the Bitdefender Total Security HTTPS scanning functionality where the product incorrectly checks the site's certificate… |
CVE-2024-22030 | High | 8.0 | 2024-10-16 | A vulnerability has been identified within Rancher that can be exploited in narrow circumstances through a man-in-the-middle (MITM) attack. An attacker would… |
CVE-2024-31955 | Medium | 4.9 | 2024-10-15 | An issue was discovered in Samsung eMMC with KLMAG2GE4A and KLM8G1WEMB firmware. Code bypass through Electromagnetic Fault Injection allows an attacker to succ… |
CVE-2024-48915 | | 2024-10-15 | Agent Dart is an agent library built for Internet Computer for Dart and Flutter apps. Prior to version 1.0.0-dev.29, certificate verification in `lib/agent/cer… | |
CVE-2024-43550 | High | 7.4 | 2024-10-08 | Windows Secure Channel Spoofing Vulnerability |
CVE-2024-7206 | | 2024-10-08 | SSL Pinning Bypass in eWeLink Some hardware products allows local ATTACKER to Decrypt TLS communication and Extract secrets to clone the device via Flash the m… | |
CVE-2024-20385 | Medium | 5.9 | 2024-10-02 | A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard Orchestrator (NDO) could allow an unauthenticated, remote attacker to intercept sensitiv… |
CVE-2024-9160 | | 2024-09-27 | In versions of the PEADM Forge Module prior to 3.24.0 a security misconfiguration was discovered. | |
CVE-2024-38861 | High | 7.4 | 2024-09-27 | Improper Certificate Validation in Checkmk Exchange plugin MikroTik allows attackers in MitM position to intercept traffic. This issue affects MikroTik: from 2… |
CVE-2024-30134 | Medium | 6.7 | 2024-09-26 | The HCL Traveler for Microsoft Outlook executable (HTMO.exe) is being flagged as potentially Malicious Software or an Unrecognized Application. |
CVE-2024-38324 | Medium | 5.9 | 2024-09-25 | IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI does not validate server name during registration and unregistration operations which… |
CVE-2024-43201 | High | 8.8 | 2024-09-23 | The Planet Fitness Workouts iOS and Android mobile apps fail to properly validate TLS certificates, allowing an attacker with appropriate network access to obt… |
CVE-2024-8287 | High | 7.5 | 2024-09-18 | Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent. An attacker must b… |
CVE-2024-8096 | Medium | 6.5 | 2024-09-11 | When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it m… |
CVE-2024-31489 | Medium | 6.8 | 2024-09-10 | AAn improper certificate validation vulnerability [CWE-295] in FortiClientWindows 7.2.0 through 7.2.2, 7.0.0 through 7.0.11, FortiClientLinux 7.2.0, 7.0.0 thr… |
CVE-2022-45856 | Medium | 4.8 | 2024-09-10 | An improper certificate validation vulnerability [CWE-295] in FortiClientWindows 6.4 all versions, 7.0.0 through 7.0.7, FortiClientMac 6.4 all versions, 7.0 al… |
CVE-2024-40714 | High | 8.3 | 2024-09-07 | An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during… |
CVE-2024-38642 | High | 7.8 | 2024-09-06 | An improper certificate validation vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow local network users to compro… |
CVE-2024-45159 | Critical | 9.8 | 2024-09-05 | An issue was discovered in Mbed TLS 3.x before 3.6.1. With TLS 1.3, when a server enables optional authentication of the client, if the client-provided certifi… |
CVE-2024-8285 | Medium | 5.9 | 2024-08-30 | A flaw was found in Kroxylicious. When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properl… |
CVE-2024-39771 | Medium | 6.8 | 2024-08-28 | QBiC CLOUD CC-2L v1.1.30 and earlier and Safie One v1.8.2 and earlier do not properly validate certificates, which may allow a network-adjacent unauthenticated… |
CVE-2024-41996 | High | 7.5 | 2024-08-26 | Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the cl… |
CVE-2024-45234 | High | 7.5 | 2024-08-24 | An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) an ROA or a… |
CVE-2024-37311 | High | 8.2 | 2024-08-23 | Collabora Online is a collaborative online office suite based on LibreOffice. In affected versions of Collabora Online, https connections from coolwsd to other… |
CVE-2024-8007 | High | 8.1 | 2024-08-21 | A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an attacker to deploy… |
CVE-2024-32928 | Medium | 5.9 | 2024-08-19 | The libcurl CURLOPT_SSL_VERIFYPEER option was disabled on a subset of requests made by Nest production devices which enabled a potential man-in-the-middle atta… |
CVE-2023-50314 | Medium | 5.3 | 2024-08-14 | IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.8 could allow an attacker with access to the network to conduct spoofing attacks. An attacker… |
CVE-2023-50315 | Medium | 5.3 | 2024-08-14 | IBM WebSphere Application Server 8.5 and 9.0 could allow an attacker with access to the network to conduct spoofing attacks. An attacker could exploit this vu… |
CVE-2024-7570 | High | 8.3 | 2024-08-13 | Improper certificate validation in Ivanti ITSM on-prem and Neurons for ITSM Versions 2023.4 and earlier allows a remote attacker in a MITM position to craft a… |
CVE-2024-5445 | Low | 3.8 | 2024-08-12 | Ecosystem Agent version 4 < 4.1.5.2597 and Ecosystem Agent version 5 < 5.1.4.2473 did not properly validate SSL/TLS certificates, which could allow a malicious… |
CVE-2024-42395 | Critical | 9.8 | 2024-08-06 | There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploit… |
CVE-2024-7383 | High | 7.4 | 2024-08-05 | A flaw was found in libnbd. The client did not always correctly verify the NBD server's certificate when using TLS to connect to an NBD server. This issue allo… |
CVE-2024-6472 | High | 7.8 | 2024-08-05 | Certificate Validation user interface in LibreOffice allows potential vulnerability. Signed macros are scripts that have been digitally signed by the deve… |
CVE-2024-32865 | Medium | 6.4 | 2024-08-01 | Under certain circumstances the exacqVision Server will not properly validate TLS certificates provided by connected devices. |
CVE-2024-41264 | High | 7.5 | 2024-08-01 | An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method. |
CVE-2024-41258 | Medium | 5.3 | 2024-07-31 | An issue was discovered in filestash v0.4. The usage of the ssh.InsecureIgnoreHostKey() disables host key verification, possibly allowing attackers to obtain s… |
CVE-2024-41256 | Medium | 5.9 | 2024-07-31 | Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification process when sendin… |
CVE-2024-40464 | High | 8.8 | 2024-07-31 | An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smtp.go file |
CVE-2024-4786 | Low | 2.8 | 2024-07-26 | An improper validation vulnerability was reported in the Lenovo Tab K10 that could allow a specially crafted application to keep the device on. |
CVE-2024-28872 | High | 8.9 | 2024-07-11 | The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the Stork agent. Once th… |
CVE-2024-37865 | Medium | 5.9 | 2024-07-09 | An issue in S3Browser v.11.4.5 and v.10.9.9 and fixed in v.11.5.7 allows a remote attacker to obtain sensitive information via the S3 compatible storage compon… |
CVE-2024-39698 | High | 7.5 | 2024-07-09 | electron-updater allows for automatic updates for Electron apps. The file `packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts` implements… |
CVE-2024-28067 | Medium | 5.3 | 2024-07-09 | A vulnerability in Samsung Exynos Modem 5300 allows a Man-in-the-Middle (MITM) attacker to downgrade the security mode of packets going to the victim, enabling… |
CVE-2024-33509 | Medium | 4.8 | 2024-07-09 | An improper certificate validation vulnerability [CWE-295] in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions and 6.3 all versions may allow a… |
CVE-2023-50179 | Medium | 4.8 | 2024-07-09 | An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2 all versions, 7.1 all versions, 7.0 all versions may allow a remote and unaut… |
CVE-2023-50178 | High | 7.4 | 2024-07-09 | An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2.0 through 7.2.3, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 al… |
CVE-2024-39312 | Medium | 5.3 | 2024-07-08 | Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parame… |
CVE-2024-20080 | Critical | 9.8 | 2024-07-01 | In gnss service, there is a possible escalation of privilege due to improper certificate validation. This could lead to remote escalation of privilege with no… |
CVE-2024-25053 | Medium | 5.9 | 2024-06-28 | IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is vulnerable to improper certificate validation when using the IBM Pla… |
CVE-2024-5261 | Critical | 9.8 | 2024-06-25 | Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification LibreOfficeKit can be used for acce… |
CVE-2024-28021 | High | 7.4 | 2024-06-11 | A vulnerability exists in the FOXMAN-UN/UNEM server that affects the message queueing mechanism’s certificate validation. If exploited an attacker could spoof… |
CVE-2024-35140 | High | 7.7 | 2024-05-31 | IBM Security Verify Access Docker 10.0.0 through 10.0.6 could allow a local user to escalate their privileges due to improper certificate validation. IBM X-Fo… |
CVE-2024-29072 | High | 8.2 | 2024-05-28 | A privilege escalation vulnerability exists in the Foxit Reader 2024.2.0.25138. The vulnerability occurs due to improper certification validation of the update… |
CVE-2024-31340 | Medium | 4.8 | 2024-05-22 | TP-Link Tether versions prior to 4.5.13 and TP-Link Tapo versions prior to 3.3.6 do not properly validate certificates, which may allow a remote unauthenticate… |
CVE-2024-35299 | Medium | 5.9 | 2024-05-16 | In JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validation |
CVE-2024-30020 | High | 8.1 | 2024-05-14 | Windows Cryptographic Services Remote Code Execution Vulnerability |
CVE-2022-32509 | High | 8.8 | 2024-05-14 | An issue was discovered on certain Nuki Home Solutions devices. Lack of certificate validation on HTTP communications allows attackers to intercept and tamper… |
CVE-2024-33612 | Medium | 6.8 | 2024-05-08 | An improper certificate validation vulnerability exists in BIG-IP Next Central Manager and may allow an attacker to impersonate an Instance Provider system. N… |
CVE-2024-0042 | High | 7.8 | 2024-05-07 | In TBD of TBD, there is a possible confusion of OEM and DRM certificates due to improperly used crypto. This could lead to local bypass of DRM content protecti… |
CVE-2023-35721 | High | 8.8 | 2024-05-03 | NETGEAR Multiple Routers curl_post Improper Certificate Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to… |
CVE-2024-4063 | Low | 3.7 | 2024-04-23 | A vulnerability was found in EZVIZ CS-C6-21WFR-8 5.2.7 Build 170628. It has been classified as problematic. This affects an unknown part of the component Davin… |
CVE-2024-4062 | Low | 3.7 | 2024-04-23 | A vulnerability was found in Hualai Xiaofang iSC5 3.2.2_112 and classified as problematic. Affected by this issue is some unknown functionality. The manipulati… |
CVE-2024-29733 | Low | 2.7 | 2024-04-21 | Improper Certificate Validation vulnerability in Apache Airflow FTP Provider. The FTP hook lacks complete certificate validation in FTP_TLS connections, which… |
CVE-2024-3738 | High | 7.3 | 2024-04-13 | A vulnerability classified as critical has been found in cym1102 nginxWebUI up to 3.9.9. This affects the function handlePath of the file /adminPage/conf/saveC… |
CVE-2023-50949 | Medium | 5.9 | 2024-04-11 | IBM QRadar SIEM 7.5 could allow an unauthorized user to perform unauthorized actions due to improper certificate validation. IBM X-Force ID: 275706. |