CWE-295 · Improper Certificate Validation (page 7)
Page 7 of 17 — CVEs classified under CWE-295, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45234 | High | 7.5 | 2024-08-24 | An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) an ROA or a… |
CVE-2024-37311 | High | 8.2 | 2024-08-23 | Collabora Online is a collaborative online office suite based on LibreOffice. In affected versions of Collabora Online, https connections from coolwsd to other… |
CVE-2024-8007 | High | 8.1 | 2024-08-21 | A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an attacker to deploy… |
CVE-2024-32928 | Medium | 5.9 | 2024-08-19 | The libcurl CURLOPT_SSL_VERIFYPEER option was disabled on a subset of requests made by Nest production devices which enabled a potential man-in-the-middle atta… |
CVE-2023-50314 | Medium | 5.3 | 2024-08-14 | IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.8 could allow an attacker with access to the network to conduct spoofing attacks. An attacker… |
CVE-2023-50315 | Medium | 5.3 | 2024-08-14 | IBM WebSphere Application Server 8.5 and 9.0 could allow an attacker with access to the network to conduct spoofing attacks. An attacker could exploit this vu… |
CVE-2024-7570 | High | 8.3 | 2024-08-13 | Improper certificate validation in Ivanti ITSM on-prem and Neurons for ITSM Versions 2023.4 and earlier allows a remote attacker in a MITM position to craft a… |
CVE-2024-5445 | Low | 3.8 | 2024-08-12 | Ecosystem Agent version 4 < 4.1.5.2597 and Ecosystem Agent version 5 < 5.1.4.2473 did not properly validate SSL/TLS certificates, which could allow a malicious… |
CVE-2024-42395 | Critical | 9.8 | 2024-08-06 | There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploit… |
CVE-2024-7383 | High | 7.4 | 2024-08-05 | A flaw was found in libnbd. The client did not always correctly verify the NBD server's certificate when using TLS to connect to an NBD server. This issue allo… |
CVE-2024-6472 | High | 7.8 | 2024-08-05 | Certificate Validation user interface in LibreOffice allows potential vulnerability. Signed macros are scripts that have been digitally signed by the deve… |
CVE-2024-32865 | Medium | 6.4 | 2024-08-01 | Under certain circumstances the exacqVision Server will not properly validate TLS certificates provided by connected devices. |
CVE-2024-41264 | High | 7.5 | 2024-08-01 | An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method. |
CVE-2024-41258 | Medium | 5.3 | 2024-07-31 | An issue was discovered in filestash v0.4. The usage of the ssh.InsecureIgnoreHostKey() disables host key verification, possibly allowing attackers to obtain s… |
CVE-2024-41256 | Medium | 5.9 | 2024-07-31 | Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification process when sendin… |
CVE-2024-40464 | High | 8.8 | 2024-07-31 | An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smtp.go file |
CVE-2024-4786 | Low | 2.8 | 2024-07-26 | An improper validation vulnerability was reported in the Lenovo Tab K10 that could allow a specially crafted application to keep the device on. |
CVE-2024-28872 | High | 8.9 | 2024-07-11 | The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the Stork agent. Once th… |
CVE-2024-37865 | Medium | 5.9 | 2024-07-09 | An issue in S3Browser v.11.4.5 and v.10.9.9 and fixed in v.11.5.7 allows a remote attacker to obtain sensitive information via the S3 compatible storage compon… |
CVE-2024-39698 | High | 7.5 | 2024-07-09 | electron-updater allows for automatic updates for Electron apps. The file `packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts` implements… |
CVE-2024-28067 | Medium | 5.3 | 2024-07-09 | A vulnerability in Samsung Exynos Modem 5300 allows a Man-in-the-Middle (MITM) attacker to downgrade the security mode of packets going to the victim, enabling… |
CVE-2024-33509 | Medium | 4.8 | 2024-07-09 | An improper certificate validation vulnerability [CWE-295] in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions and 6.3 all versions may allow a… |
CVE-2023-50179 | Medium | 4.8 | 2024-07-09 | An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2 all versions, 7.1 all versions, 7.0 all versions may allow a remote and unaut… |
CVE-2023-50178 | High | 7.4 | 2024-07-09 | An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2.0 through 7.2.3, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 al… |
CVE-2024-39312 | Medium | 5.3 | 2024-07-08 | Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parame… |
CVE-2024-20080 | Critical | 9.8 | 2024-07-01 | In gnss service, there is a possible escalation of privilege due to improper certificate validation. This could lead to remote escalation of privilege with no… |
CVE-2024-25053 | Medium | 5.9 | 2024-06-28 | IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is vulnerable to improper certificate validation when using the IBM Pla… |
CVE-2024-5261 | Critical | 9.8 | 2024-06-25 | Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification LibreOfficeKit can be used for acce… |
CVE-2024-28021 | High | 7.4 | 2024-06-11 | A vulnerability exists in the FOXMAN-UN/UNEM server that affects the message queueing mechanism’s certificate validation. If exploited an attacker could spoof… |
CVE-2024-35140 | High | 7.7 | 2024-05-31 | IBM Security Verify Access Docker 10.0.0 through 10.0.6 could allow a local user to escalate their privileges due to improper certificate validation. IBM X-Fo… |
CVE-2024-29072 | High | 8.2 | 2024-05-28 | A privilege escalation vulnerability exists in the Foxit Reader 2024.2.0.25138. The vulnerability occurs due to improper certification validation of the update… |
CVE-2024-31340 | Medium | 4.8 | 2024-05-22 | TP-Link Tether versions prior to 4.5.13 and TP-Link Tapo versions prior to 3.3.6 do not properly validate certificates, which may allow a remote unauthenticate… |
CVE-2024-35299 | Medium | 5.9 | 2024-05-16 | In JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validation |
CVE-2024-30020 | High | 8.1 | 2024-05-14 | Windows Cryptographic Services Remote Code Execution Vulnerability |
CVE-2022-32509 | High | 8.8 | 2024-05-14 | An issue was discovered on certain Nuki Home Solutions devices. Lack of certificate validation on HTTP communications allows attackers to intercept and tamper… |
CVE-2024-33612 | Medium | 6.8 | 2024-05-08 | An improper certificate validation vulnerability exists in BIG-IP Next Central Manager and may allow an attacker to impersonate an Instance Provider system. N… |
CVE-2024-0042 | High | 7.8 | 2024-05-07 | In TBD of TBD, there is a possible confusion of OEM and DRM certificates due to improperly used crypto. This could lead to local bypass of DRM content protecti… |
CVE-2023-35721 | High | 8.8 | 2024-05-03 | NETGEAR Multiple Routers curl_post Improper Certificate Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to… |
CVE-2024-4063 | Low | 3.7 | 2024-04-23 | A vulnerability was found in EZVIZ CS-C6-21WFR-8 5.2.7 Build 170628. It has been classified as problematic. This affects an unknown part of the component Davin… |
CVE-2024-4062 | Low | 3.7 | 2024-04-23 | A vulnerability was found in Hualai Xiaofang iSC5 3.2.2_112 and classified as problematic. Affected by this issue is some unknown functionality. The manipulati… |
CVE-2024-29733 | Low | 2.7 | 2024-04-21 | Improper Certificate Validation vulnerability in Apache Airflow FTP Provider. The FTP hook lacks complete certificate validation in FTP_TLS connections, which… |
CVE-2024-3738 | High | 7.3 | 2024-04-13 | A vulnerability classified as critical has been found in cym1102 nginxWebUI up to 3.9.9. This affects the function handlePath of the file /adminPage/conf/saveC… |
CVE-2023-50949 | Medium | 5.9 | 2024-04-11 | IBM QRadar SIEM 7.5 could allow an unauthorized user to perform unauthorized actions due to improper certificate validation. IBM X-Force ID: 275706. |
CVE-2024-31872 | High | 7.5 | 2024-04-10 | IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle attack when deploying Open Source scrip… |
CVE-2024-31871 | High | 7.5 | 2024-04-10 | IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle attack when deploying Python scripts du… |
CVE-2024-29050 | High | 8.4 | 2024-04-09 | Windows Cryptographic Services Remote Code Execution Vulnerability |
CVE-2024-27323 | High | 7.5 | 2024-04-01 | PDF-XChange Editor Updater Improper Certificate Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute… |
CVE-2024-29887 | High | 7.4 | 2024-03-27 | Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients… |
CVE-2024-2379 | Medium | 6.3 | 2024-03-27 | libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or c… |
CVE-2024-27440 | Medium | 4.8 | 2024-03-13 | The Toyoko Inn official App for iOS versions prior to 1.13.0 and Toyoko Inn official App for Android versions prior 1.3.14 don't properly verify server certifi… |
CVE-2024-23273 | Medium | 4.3 | 2024-03-08 | This issue was addressed through improved state management. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. Private Browsing t… |
CVE-2024-1351 | High | 8.8 | 2024-03-07 | Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to su… |
CVE-2024-28162 | Medium | 4.2 | 2024-03-06 | In Jenkins Delphix Plugin 3.0.1 through 3.1.0 (both inclusive) a global option for administrators to enable or disable SSL/TLS certificate validation for Data… |
CVE-2024-28161 | Medium | 5.3 | 2024-03-06 | In Jenkins Delphix Plugin 3.0.1, a global option for administrators to enable or disable SSL/TLS certificate validation for Data Control Tower (DCT) connection… |
CVE-2024-2048 | High | 8.1 | 2024-03-04 | Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as tr… |
CVE-2023-47742 | Medium | 5.9 | 2024-03-03 | IBM QRadar Suite Products 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could disclose sensitive information using man… |
CVE-2024-25141 | Critical | 9.1 | 2024-02-20 | When ssl was enabled for Mongo Hook, default settings included "allow_insecure" which caused that certificates were not validated. This was unexpected and undo… |
CVE-2023-49250 | High | 7.3 | 2024-02-20 | Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could i… |
CVE-2023-40104 | High | 7.5 | 2024-02-15 | In ca-certificates, there is a possible way to read encrypted TLS data due to untrusted cryptographic certificates. This could lead to remote information discl… |
CVE-2023-47537 | Medium | 4.8 | 2024-02-15 | An improper certificate validation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.15, FortiOS 6… |
CVE-2024-25642 | High | 7.4 | 2024-02-13 | Due to improper validation of certificate in SAP Cloud Connector - version 2.0, attacker can impersonate the genuine servers to interact with SCC breaking the… |
CVE-2023-47700 | Medium | 5.9 | 2024-02-07 | IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.6 products could allow a remote attacker to spoof a trusted system that w… |
CVE-2023-43017 | High | 8.2 | 2024-02-07 | IBM Security Verify Access 10.0.0.0 through 10.0.6.1 could allow a privileged user to install a configuration file that could allow remote access. IBM X-Force… |
CVE-2023-32330 | High | 7.5 | 2024-02-07 | IBM Security Verify Access 10.0.0.0 through 10.0.6.1 uses insecure calls that could allow an attacker on the network to take control of the server. IBM X-Forc… |
CVE-2024-25140 | Critical | 9.8 | 2024-02-06 | A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with Enhanced Key Usage of Co… |
CVE-2024-1052 | High | 8.0 | 2024-02-05 | Boundary and Boundary Enterprise (“Boundary”) is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate ac… |
CVE-2024-0853 | Medium | 5.3 | 2024-02-03 | curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to the… |
CVE-2020-29504 | High | 7.4 | 2024-02-02 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain a Missing Required Cryptographic… |
CVE-2023-28807 | Medium | 5.1 | 2024-01-31 | In Zscaler Internet Access (ZIA) a mismatch between Connect Host and Client Hello's Server Name Indication (SNI) enables attackers to evade network security co… |
CVE-2023-50356 | Medium | 6.5 | 2024-01-31 | SSL connections to some LDAP servers are vulnerable to a man-in-the-middle attack due to improper certificate validation in AREAL Topkapi Vision (Server). This… |
CVE-2023-51837 | Critical | 9.8 | 2024-01-30 | Ylianst MeshCentral 1.1.16 is vulnerable to Missing SSL Certificate Validation. |
CVE-2023-33760 | Medium | 5.3 | 2024-01-25 | SpliceCom Maximiser Soft PBX v1.5 and before was discovered to utilize a default SSL certificate. This issue can allow attackers to eavesdrop on communications… |
CVE-2023-33757 | Medium | 5.9 | 2024-01-25 | A lack of SSL certificate validation in Splicecom iPCS (iOS App) v1.3.4, iPCS2 (iOS App) v2.8 and before, and iPCS (Android App) v1.8.5 and before allows attac… |
CVE-2023-6043 | High | 7.8 | 2024-01-19 | A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker to bypass integrity checks and execute arbitrary code wit… |
CVE-2023-33295 | Medium | 6.5 | 2024-01-19 | Cohesity DataProtect prior to 6.8.1_u5 or 7.1 was discovered to have a incorrect access control vulnerability due to a lack of TLS Certificate Validation. |
CVE-2023-51662 | Medium | 6.0 | 2023-12-22 | The Snowflake .NET driver provides an interface to the Microsoft .NET open source software framework for developing applications. Snowflake recently received a… |
CVE-2023-5594 | High | 7.5 | 2023-12-21 | Improper validation of the server’s certificate chain in secure traffic scanning feature considered intermediate certificate signed using the MD5 or SHA1 algor… |
CVE-2023-1514 | High | 7.4 | 2023-12-19 | A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certi… |
CVE-2023-6680 | High | 7.4 | 2023-12-15 | An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 prior to 16.5.4, and 1… |
CVE-2009-4123 | High | 7.5 | 2023-12-12 | The jruby-openssl gem before 0.6 for JRuby mishandles SSL certificate validation. |
CVE-2020-12614 | High | 7.8 | 2023-12-12 | An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. If the publisher criteria is selected, it defines the name of a publisher… |
CVE-2023-48427 | High | 8.1 | 2023-12-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected products do not properly validate the certificate of the configur… |
CVE-2023-50454 | Medium | 5.9 | 2023-12-10 | An issue was discovered in Zammad before 6.2.0. In several subsystems, SSL/TLS was used to establish connections to external services without proper validation… |
CVE-2023-49247 | High | 7.5 | 2023-12-06 | Permission verification vulnerability in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-5909 | High | 7.5 | 2023-11-30 | KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect. |
CVE-2023-49312 | Critical | 9.1 | 2023-11-26 | Precision Bridge PrecisionBridge.exe (aka the thick client) before 7.3.21 allows an integrity violation in which the same license key is used on multiple syste… |
CVE-2023-43082 | High | 8.6 | 2023-11-22 | Dell Unity prior to 5.3 contains a 'man in the middle' vulnerability in the vmadapter component. If a customer has a certificate signed by a third-party publi… |
CVE-2023-48054 | High | 7.4 | 2023-11-16 | Missing SSL certificate validation in localstack v2.3.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle att… |
CVE-2023-48052 | High | 7.4 | 2023-11-16 | Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack. |
CVE-2023-42532 | Medium | 5.9 | 2023-11-07 | Improper Certificate Validation in FotaAgent prior to SMR Nov-2023 Release1 allows remote attacker to intercept the network traffic including Firmware informat… |
CVE-2023-46724 | High | 8.6 | 2023-11-01 | Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled us… |
CVE-2023-42425 | Critical | 9.8 | 2023-10-31 | An issue in Turing Video Turing Edge+ EVC5FD v.1.38.6 allows remote attacker to execute arbitrary code and obtain sensitive information via the cloud connectio… |
CVE-2023-21358 | High | 7.8 | 2023-10-30 | In UWB Google, there is a possible way for a malicious app to masquerade as system app com.android.uwb.resources due to improperly used crypto. This could lead… |
CVE-2023-31421 | Medium | 5.9 | 2023-10-26 | It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid fo… |
CVE-2023-31580 | Medium | 5.9 | 2023-10-25 | light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafte… |
CVE-2022-3761 | Medium | 5.9 | 2023-10-17 | OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intercept configuratio… |
CVE-2022-43892 | Low | 3.7 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 does not validate, or incorrectly validates, a certificate which could disclose sensitive information which cou… |
CVE-2022-22380 | Medium | 5.0 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow an attacker to spoof a trusted entity due to improperly validating certificates. IBM X-Force ID… |
CVE-2023-5422 | High | 8.7 | 2023-10-16 | The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSL_get_verify… |
CVE-2023-4499 | High | 7.5 | 2023-10-13 | A potential security vulnerability has been identified in the HP ThinUpdate utility (also known as HP Recovery Image and Software Download Tool) which may lead… |