CWE-295 · Improper Certificate Validation (page 6)
Page 6 of 17 — CVEs classified under CWE-295, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-46551 | Low | 3.7 | 2025-05-07 | JRuby-OpenSSL is an add-on gem for JRuby that emulates the Ruby OpenSSL native library. Starting in JRuby-OpenSSL version 0.12.1 and prior to version 0.15.4 (c… |
CVE-2024-47619 | High | 7.5 | 2025-05-07 | syslog-ng is an enhanced log daemo. Prior to version 4.8.2, `tls_wildcard_match()` matches on certificates such as `foo.*.bar` although that is not allowed. It… |
CVE-2025-3218 | Medium | 5.4 | 2025-05-07 | IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 is vulnerable to authentication and authorization attacks due to incorrect validation processing in IBM i Netserver. A malic… |
CVE-2025-37730 | Medium | 6.5 | 2025-05-06 | Improper certificate validation in Logstash's TCP output could lead to a man-in-the-middle (MitM) attack in “client” mode, as hostname verification in TCP outp… |
CVE-2025-20670 | Medium | 5.7 | 2025-05-05 | In Modem, there is a possible permission bypass due to improper certificate validation. This could lead to remote information disclosure, if a UE has connected… |
CVE-2025-27820 | High | 7.5 | 2025-04-24 | A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apac… |
CVE-2025-28169 | High | 8.1 | 2025-04-23 | BYD QIN PLUS DM-i Dilink OS v3.0_13.1.7.2204050.1 to v3.0_13.1.7.2312290.1_0 was discovered to cend broadcasts to the manufacturer's cloud server unencrypted… |
CVE-2025-26478 | Low | 3.1 | 2025-04-17 | Dell ECS version 3.8.1.4 and prior contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could pot… |
CVE-2024-42193 | High | 8.1 | 2025-04-15 | HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in its handling of SSL certificate validation. This scenario presents a possibi… |
CVE-2025-22459 | Medium | 4.8 | 2025-04-08 | Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to inter… |
CVE-2025-30000 | Medium | 6.7 | 2025-04-08 | A vulnerability has been identified in Siemens License Server (SLS) (All versions < V4.3). The affected application does not properly restrict permissions of t… |
CVE-2021-25635 | Medium | 5.5 | 2025-03-21 | An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untrusted by the target, t… |
CVE-2025-0254 | Medium | 5.9 | 2025-03-20 | HCL Digital Experience components Ring API and dxclient may be vulnerable to man-in-the-middle (MitM) attacks prior to 9.5 CF226. An attacker could intercept… |
CVE-2024-10445 | Medium | 4.3 | 2025-03-19 | Improper certificate validation vulnerability in the update functionality in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DS… |
CVE-2024-10444 | High | 7.5 | 2025-03-19 | Improper certificate validation vulnerability in the LDAP utilities in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3… |
CVE-2023-48785 | Medium | 4.8 | 2025-03-14 | An improper certificate validation vulnerability [CWE-295] in FortiNAC-F version 7.2.4 and below may allow a remote and unauthenticated attacker to perform a M… |
CVE-2024-40590 | Medium | 4.8 | 2025-03-14 | An improper certificate validation vulnerability [CWE-295] in FortiPortal version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, version 6.0.15 and b… |
CVE-2024-43107 | High | 7.2 | 2025-03-10 | Improper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP) permits unauthenticated messages (e.g. alarm events) to be sent t… |
CVE-2024-41724 | High | 8.7 | 2025-03-10 | Improper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration allowed an attacker to spoof the SALTO server. This issue affe… |
CVE-2024-50394 | High | 8.8 | 2025-03-07 | An improper certificate validation vulnerability has been reported to affect Helpdesk. If exploited, the vulnerability could allow remote attackers to compromi… |
CVE-2025-23118 | Medium | 6.4 | 2025-03-01 | An Improper Certificate Validation vulnerability could allow an authenticated malicious actor with access to UniFi Protect Cameras adjacent network to make uns… |
CVE-2024-41334 | High | 8.8 | 2025-02-27 | Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor… |
CVE-2024-55581 | High | 7.4 | 2025-02-26 | When AdaCore Ada Web Server 25.0.0 is linked with GnuTLS, the default behaviour of AWS.Client is vulnerable to a man-in-the-middle attack because of lack of ve… |
CVE-2024-50691 | High | 7.4 | 2025-02-26 | SunGrow iSolarCloud Android app V2.1.6.20241104 and prior suffers from Missing SSL Certificate Validation. The app explicitly ignores certificate errors and is… |
CVE-2025-1001 | Medium | 5.7 | 2025-02-21 | Medixant RadiAnt DICOM Viewer is vulnerable due to failure of the update mechanism to verify the update server's certificate which could allow an attacker to a… |
CVE-2024-49782 | Medium | 6.8 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 could allow a remote attacker to spoof mail server identity when using SSL/TLS security. An attacker could exploit th… |
CVE-2024-29171 | Medium | 5.9 | 2025-02-12 | Dell BSAFE SSL-J, versions prior to 6.6 and versions 7.0 through 7.2, contains an Improper certificate verification vulnerability. A remote attacker could pote… |
CVE-2025-1002 | Medium | 5.7 | 2025-02-10 | MicroDicom DICOM Viewer version 2024.03 fails to adequately verify the update server's certificate, which could make it possible for attackers in a privileged… |
CVE-2025-1193 | High | 8.1 | 2025-02-10 | Improper host validation in the certificate validation component in Devolutions Remote Desktop Manager on 2024.3.19 and earlier on Windows allows an attacker t… |
CVE-2024-11621 | High | 8.8 | 2025-02-10 | Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modify encrypted communi… |
CVE-2024-47258 | High | 8.1 | 2025-02-06 | 2N Access Commander version 2.1 and prior is vulnerable in default settings to Man In The Middle attack due to not verifying certificates of 2N edge devices. … |
CVE-2025-23114 | Critical | 9.0 | 2025-02-05 | A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected server. This issue occurs due to a fail… |
CVE-2025-1014 | High | 8.8 | 2025-02-04 | Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability was fixed in Fir… |
CVE-2025-23091 | Medium | 5.9 | 2025-02-01 | An Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man-in-the-middle (MitM… |
CVE-2024-23970 | Medium | 6.5 | 2025-01-31 | This vulnerability allows network-adjacent attackers to compromise transport security on affected installations of ChargePoint Home Flex charging stations. Aut… |
CVE-2024-23928 | Medium | 6.5 | 2025-01-31 | This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of Pioneer DMH-WT7600NEX d… |
CVE-2023-38009 | Medium | 4.2 | 2025-01-26 | IBM Cognos Mobile Client 1.1 iOS may be vulnerable to information disclosure through man in the middle techniques due to the lack of certificate pinning. |
CVE-2024-52330 | High | 7.4 | 2025-01-23 | ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmwa… |
CVE-2024-52329 | High | 7.4 | 2025-01-23 | ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic and o… |
CVE-2024-42186 | Low | 2.8 | 2025-01-23 | BigFix Patch Download Plug-ins are affected by an insecure protocol support. The application can allow improper handling of SSL certificates validation. |
CVE-2024-48460 | Medium | 4.3 | 2025-01-16 | An issue in Eugeny Tabby 1.0.213 allows a remote attacker to obtain sensitive information via the server and sends the SSH username and password even when the… |
CVE-2025-0501 | High | 7.5 | 2025-01-15 | An issue in the native clients for Amazon WorkSpaces (when running PCoIP protocol) may allow an attacker to access remote sessions via man-in-the-middle. |
CVE-2025-0500 | High | 7.5 | 2025-01-15 | An issue in the native clients for Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV Clients may allow an attacker to… |
CVE-2024-54849 | Medium | 5.9 | 2025-01-10 | An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the second RSA private key and access sensitive data or execute a man-in-the-middle a… |
CVE-2024-54848 | High | 7.4 | 2025-01-10 | Improper handling and storage of certificates in CP Plus CP-VNR-3104 B3223P22C02424 allow attackers to decrypt communications or execute a man-in-the-middle at… |
CVE-2024-54847 | Medium | 5.9 | 2025-01-10 | An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to access the Diffie-Hellman (DH) parameters and access sensitive data or execute a man-in-the-… |
CVE-2024-54846 | Medium | 5.9 | 2025-01-10 | An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the EC private key and access sensitive data or execute a man-in-the-middle attack. |
CVE-2025-20126 | Medium | 4.8 | 2025-01-08 | A vulnerability in certification validation routines of Cisco ThousandEyes Endpoint Agent for macOS and RoomOS could allow an unauthenticated, remote attacker… |
CVE-2025-0239 | Medium | 4.0 | 2025-01-07 | When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability was fixed in Fi… |
CVE-2024-40702 | High | 8.2 | 2025-01-07 | IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow an unauthorized user to obtain valid tokens to gain access to protected resou… |
CVE-2024-56521 | Critical | 9.8 | 2024-12-27 | An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely. |
CVE-2024-47119 | Medium | 5.9 | 2024-12-18 | IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 does not properly validate a certificate which could allow an attacker to spoof a trusted entity… |
CVE-2024-6001 | High | 8.1 | 2024-12-16 | An improper certificate validation vulnerability was reported in LADM that could allow a network attacker with the ability to redirect an update request to a r… |
CVE-2024-4762 | High | 7.8 | 2024-12-16 | An improper validation vulnerability was reported in the firmware update mechanism of LADM and LDCC that could allow a local attacker to escalate privileges. |
CVE-2024-21543 | High | 7.1 | 2024-12-13 | Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls ba… |
CVE-2024-12174 | Low | 2.7 | 2024-12-09 | An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated, privileged attacker could intercept email messages s… |
CVE-2024-54147 | Medium | 6.8 | 2024-12-09 | Altair is a GraphQL client for all platforms. Prior to version 8.0.5, Altair GraphQL Client's desktop app does not validate HTTPS certificates allowing a man-i… |
CVE-2024-48865 | High | 7.5 | 2024-12-06 | An improper certificate validation vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allo… |
CVE-2024-6219 | Low | 3.8 | 2024-12-06 | Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honour… |
CVE-2024-6156 | Low | 3.8 | 2024-12-06 | Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store. |
CVE-2024-53846 | Medium | 5.5 | 2024-12-05 | OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of desig… |
CVE-2024-45205 | High | 7.1 | 2024-12-04 | An Improper Certificate Validation on the UniFi iOS App managing a standalone UniFi Access Point (not using UniFi Network Application) could allow a malicious… |
CVE-2024-5921 | High | 8.8 | 2024-11-27 | An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary serv… |
CVE-2023-51634 | High | 7.5 | 2024-11-22 | NETGEAR RAX30 Improper Certificate Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to compromise the integ… |
CVE-2024-52510 | Medium | 4.2 | 2024-11-15 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed… |
CVE-2022-20814 | High | 7.4 | 2024-11-15 | A vulnerability in the certificate validation of Cisco Expressway-C and Cisco TelePresence VCS could allow an unauthenticated, remote attacker to gai… |
CVE-2024-5918 | Medium | 4.3 | 2024-11-14 | An improper certificate validation vulnerability in Palo Alto Networks PAN-OS software enables an authorized user with a specially crafted client certificate t… |
CVE-2024-49369 | Critical | 9.8 | 2024-11-12 | Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The… |
CVE-2019-20461 | Critical | 9.8 | 2024-11-07 | An issue was discovered on Alecto IVM-100 2019-11-12 devices. The device uses a custom UDP protocol to start and control video and audio services. The protocol… |
CVE-2024-51774 | High | 8.1 | 2024-11-02 | qBittorrent before 5.0.1 proceeds with use of https URLs even after certificate validation errors. |
CVE-2024-30149 | Medium | 4.8 | 2024-10-31 | HCL AppScan Source <= 10.6.0 does not properly validate a TLS/SSL certificate for an executable. |
CVE-2024-43177 | Medium | 5.9 | 2024-10-22 | IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute. |
CVE-2024-47241 | Medium | 5.5 | 2024-10-18 | Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.24, contains an Improper Certificate Validation vulnerability. A low privileged attacker wi… |
CVE-2023-49570 | High | 7.4 | 2024-10-18 | A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software trusts a certificate issued by an entity that… |
CVE-2023-6058 | Medium | 6.8 | 2024-10-18 | A vulnerability has been identified in Bitdefender Safepay's handling of HTTPS connections. The issue arises when the product blocks a connection due to an unt… |
CVE-2023-6057 | High | 7.4 | 2024-10-18 | A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of certificates issued using… |
CVE-2023-6056 | High | 7.4 | 2024-10-18 | A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of self-signed certificates… |
CVE-2023-6055 | High | 7.4 | 2024-10-18 | A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software fails to properly validate website certificat… |
CVE-2023-49567 | Medium | 6.8 | 2024-10-18 | A vulnerability has been identified in the Bitdefender Total Security HTTPS scanning functionality where the product incorrectly checks the site's certificate… |
CVE-2024-22030 | High | 8.0 | 2024-10-16 | A vulnerability has been identified within Rancher that can be exploited in narrow circumstances through a man-in-the-middle (MITM) attack. An attacker would… |
CVE-2024-31955 | Medium | 4.9 | 2024-10-15 | An issue was discovered in Samsung eMMC with KLMAG2GE4A and KLM8G1WEMB firmware. Code bypass through Electromagnetic Fault Injection allows an attacker to succ… |
CVE-2024-48915 | | 2024-10-15 | Agent Dart is an agent library built for Internet Computer for Dart and Flutter apps. Prior to version 1.0.0-dev.29, certificate verification in `lib/agent/cer… | |
CVE-2024-43550 | High | 7.4 | 2024-10-08 | Windows Secure Channel Spoofing Vulnerability |
CVE-2024-7206 | | 2024-10-08 | SSL Pinning Bypass in eWeLink Some hardware products allows local ATTACKER to Decrypt TLS communication and Extract secrets to clone the device via Flash the m… | |
CVE-2024-20385 | Medium | 5.9 | 2024-10-02 | A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard Orchestrator (NDO) could allow an unauthenticated, remote attacker to intercept sensitiv… |
CVE-2024-9160 | | 2024-09-27 | In versions of the PEADM Forge Module prior to 3.24.0 a security misconfiguration was discovered. | |
CVE-2024-38861 | High | 7.4 | 2024-09-27 | Improper Certificate Validation in Checkmk Exchange plugin MikroTik allows attackers in MitM position to intercept traffic. This issue affects MikroTik: from 2… |
CVE-2024-30134 | Medium | 6.7 | 2024-09-26 | The HCL Traveler for Microsoft Outlook executable (HTMO.exe) is being flagged as potentially Malicious Software or an Unrecognized Application. |
CVE-2024-38324 | Medium | 5.9 | 2024-09-25 | IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI does not validate server name during registration and unregistration operations which… |
CVE-2024-43201 | High | 8.8 | 2024-09-23 | The Planet Fitness Workouts iOS and Android mobile apps fail to properly validate TLS certificates, allowing an attacker with appropriate network access to obt… |
CVE-2024-8287 | High | 7.5 | 2024-09-18 | Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent. An attacker must b… |
CVE-2024-8096 | Medium | 6.5 | 2024-09-11 | When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it m… |
CVE-2024-31489 | Medium | 6.8 | 2024-09-10 | AAn improper certificate validation vulnerability [CWE-295] in FortiClientWindows 7.2.0 through 7.2.2, 7.0.0 through 7.0.11, FortiClientLinux 7.2.0, 7.0.0 thr… |
CVE-2022-45856 | Medium | 4.8 | 2024-09-10 | An improper certificate validation vulnerability [CWE-295] in FortiClientWindows 6.4 all versions, 7.0.0 through 7.0.7, FortiClientMac 6.4 all versions, 7.0 al… |
CVE-2024-40714 | High | 8.3 | 2024-09-07 | An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during… |
CVE-2024-38642 | High | 7.8 | 2024-09-06 | An improper certificate validation vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow local network users to compro… |
CVE-2024-45159 | Critical | 9.8 | 2024-09-05 | An issue was discovered in Mbed TLS 3.x before 3.6.1. With TLS 1.3, when a server enables optional authentication of the client, if the client-provided certifi… |
CVE-2024-8285 | Medium | 5.9 | 2024-08-30 | A flaw was found in Kroxylicious. When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properl… |
CVE-2024-39771 | Medium | 6.8 | 2024-08-28 | QBiC CLOUD CC-2L v1.1.30 and earlier and Safie One v1.8.2 and earlier do not properly validate certificates, which may allow a network-adjacent unauthenticated… |
CVE-2024-41996 | High | 7.5 | 2024-08-26 | Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the cl… |