CWE-295 · Improper Certificate Validation (page 7)
Page 7 of 15 — CVEs classified under CWE-295, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-32994 | Low | 3.7 | 2023-05-16 | Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configur… |
CVE-2023-27823 | Critical | 9.8 | 2023-05-12 | An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials. |
CVE-2023-31151 | Medium | 4.7 | 2023-05-10 | An Improper Certificate Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could a… |
CVE-2023-23901 | Medium | 6.5 | 2023-05-10 | Improper following of a certificate's chain of trust exists in SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, and SkyBridge BASIC MB-A130 firmware Ver… |
CVE-2022-39161 | Medium | 4.8 | 2023-05-03 | IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and IBM WebSphere Application Server Liberty, when configured to communicate with the Web Server Plug-ins… |
CVE-2023-24461 | High | 7.4 | 2023-05-03 | An improper certificate validation vulnerability exists in the BIG-IP Edge Client for Windows and macOS and may allow an attacker to impersonate a BIG-IP APM… |
CVE-2022-35898 | Critical | 9.8 | 2023-05-01 | OpenText BizManager before 16.6.0.1 does not perform proper validation during the change-password operation. This allows any authenticated user to change the p… |
CVE-2022-48186 | Medium | 6.2 | 2023-05-01 | A certificate validation vulnerability exists in the Baiying Android application which could lead to information disclosure. |
CVE-2023-31486 | High | 8.1 | 2023-04-29 | HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to… |
CVE-2023-31485 | Medium | 5.9 | 2023-04-29 | GitLab::API::v4 through 0.26 does not verify TLS certificates when connecting to a GitLab server, enabling machine-in-the-middle attacks. |
CVE-2023-31484 | High | 8.1 | 2023-04-29 | CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. |
CVE-2022-47758 | Critical | 9.8 | 2023-04-27 | Nanoleaf firmware v7.1.1 and below is missing TLS verification, allowing attackers to execute arbitrary code via a DNS hijacking attack. |
CVE-2023-26463 | Critical | 9.8 | 2023-04-15 | strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes within the same functi… |
CVE-2021-46880 | Critical | 9.8 | 2023-04-15 | x509/x509_verify.c in LibreSSL before 3.4.2, and OpenBSD before 7.0 errata 006, allows authentication bypass because an error for an unverified certificate cha… |
CVE-2023-30517 | Medium | 5.3 | 2023-04-12 | Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when connecting to a confi… |
CVE-2023-30516 | Medium | 6.5 | 2023-04-12 | Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries, resul… |
CVE-2022-48437 | Medium | 5.3 | 2023-04-12 | An issue was discovered in x509/x509_verify.c in LibreSSL before 3.6.1, and in OpenBSD before 7.2 errata 001. x509_verify_ctx_add_chain does not store errors t… |
CVE-2023-22642 | High | 7.5 | 2023-04-11 | An improper certificate validation vulnerability [CWE-295] in FortiAnalyzer and FortiManager 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4.8 through 6.4.10 may… |
CVE-2023-23588 | Medium | 6.2 | 2023-04-11 | A vulnerability has been identified in SIMATIC IPC1047 (All versions), SIMATIC IPC1047E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows)… |
CVE-2023-28093 | Medium | 6.5 | 2023-04-10 | A user with a compromised configuration can start an unsigned binary as a service. |
CVE-2023-25392 | Medium | 5.9 | 2023-04-10 | Allegro Tech BigFlow <1.6 is vulnerable to Missing SSL Certificate Validation. |
CVE-2023-29000 | Medium | 5.4 | 2023-04-04 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.7.0, by trusting that the… |
CVE-2022-27644 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700v3 1.0.4.1… |
CVE-2023-0466 | Medium | 5.3 | 2023-03-28 | The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the i… |
CVE-2023-0465 | Medium | 5.3 | 2023-03-28 | Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invali… |
CVE-2022-45597 | Critical | 9.8 | 2023-03-24 | ComponentSpace.Saml2 4.4.0 Missing SSL Certificate Validation. NOTE: the vendor does not consider this a vulnerability because the report is only about use of… |
CVE-2023-20963 | High | 7.8 | 2023-03-24 | In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User inter… |
CVE-2023-0464 | High | 7.5 | 2023-03-22 | A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy… |
CVE-2021-21548 | High | 7.4 | 2023-03-17 | Dell EMC Unisphere for PowerMax versions before 9.1.0.27, Dell EMC Unisphere for PowerMax Virtual Appliance versions before 9.1.0.27, and PowerMax OS Release… |
CVE-2022-4895 | High | 8.6 | 2023-02-28 | Improper Certificate Validation vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on… |
CVE-2023-1055 | Medium | 5.5 | 2023-02-27 | A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which… |
CVE-2022-39948 | Medium | 4.8 | 2023-02-16 | An improper certificate validation vulnerability [CWE-295] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all versions, 6.0 all ver… |
CVE-2022-48308 | Medium | 6.3 | 2023-02-16 | It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious a… |
CVE-2022-48307 | Medium | 6.3 | 2023-02-16 | It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious… |
CVE-2022-48306 | Medium | 5.7 | 2023-02-16 | Improper Validation of Certificate with Host Mismatch vulnerability in Gotham Chat IRC helper of Palantir Gotham allows A malicious attacker in a privileged ne… |
CVE-2022-27890 | Medium | 6.3 | 2023-02-16 | It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious a… |
CVE-2023-22943 | Medium | 4.8 | 2023-02-14 | In Splunk Add-on Builder (AoB) versions below 4.1.2 and the Splunk CloudConnect SDK versions below 3.1.3, requests to third-party APIs through the REST API Mod… |
CVE-2023-22367 | Medium | 5.9 | 2023-02-13 | Ichiran App for iOS versions prior to 3.1.0 and Ichiran App for Android versions prior to 3.1.0 improperly verify server certificates, which may allow a remote… |
CVE-2022-34404 | Medium | 6.5 | 2023-02-11 | Dell System Update, version 2.0.0 and earlier, contains an Improper Certificate Validation in data parser module. A local attacker with high privileges could… |
CVE-2022-46496 | Medium | 5.9 | 2023-02-06 | BTicino Door Entry HOMETOUCH for iOS 1.4.2 was discovered to be missing an SSL certificate. |
CVE-2022-31733 | Critical | 9.1 | 2023-02-03 | Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are accessible via another port on diego cells… |
CVE-2022-3913 | Medium | 5.3 | 2023-02-01 | Rapid7 Nexpose and InsightVM versions 6.6.82 through 6.6.177 fail to validate the certificate of the update server when downloading updates. This failure could… |
CVE-2023-23131 | High | 7.5 | 2023-02-01 | Selfwealth iOS mobile App 3.3.1 is vulnerable to Insecure App Transport Security (ATS) Settings. |
CVE-2022-45100 | High | 8.1 | 2023-02-01 | Dell PowerScale OneFS, versions 8.2.x-9.3.x, contains an Improper Certificate Validation vulnerability. An remote unauthenticated attacker could potentially e… |
CVE-2022-32748 | High | 7.9 | 2023-01-30 | A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure d… |
CVE-2020-36659 | High | 8.1 | 2023-01-27 | In Apache::Session::Browseable before 1.3.6, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the d… |
CVE-2020-36658 | High | 8.1 | 2023-01-27 | In Apache::Session::LDAP before 0.5, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default c… |
CVE-2023-0509 | High | 7.4 | 2023-01-26 | Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44. |
CVE-2023-23690 | High | 7.0 | 2023-01-19 | Cloud Mobility for Dell EMC Storage, versions 1.3.0.X and below contains an Improper Check for Certificate Revocation vulnerability. A threat actor does not n… |
CVE-2022-42979 | High | 8.8 | 2023-01-06 | Information disclosure due to an insecure hostname validation in the RYDE application 5.8.43 for Android and iOS allows attackers to take over an account via a… |
CVE-2022-45197 | High | 7.5 | 2022-12-25 | Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp. |
CVE-2022-45419 | Medium | 6.5 | 2022-12-22 | If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server that used that certificate, and then dele… |
CVE-2022-34469 | High | 8.1 | 2022-12-22 | When a TLS Certificate error occurs on a domain protected by the HSTS header, the browser should not allow the user to bypass the certificate error. On Firefox… |
CVE-2022-22747 | Medium | 6.5 | 2022-12-22 | After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed t… |
CVE-2022-1834 | Medium | 6.5 | 2022-12-22 | When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displaye… |
CVE-2022-1197 | Medium | 5.4 | 2022-12-22 | When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet r… |
CVE-2022-32531 | Medium | 5.9 | 2022-12-15 | The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails… |
CVE-2022-46153 | High | 8.1 | 2022-12-08 | Traefik is an open source HTTP reverse proxy and load balancer. In affected versions there is a potential vulnerability in Traefik managing TLS connections. A… |
CVE-2022-43705 | Critical | 9.1 | 2022-11-27 | In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 20… |
CVE-2022-39334 | Low | 3.9 | 2022-11-25 | Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to… |
CVE-2022-45391 | High | 7.5 | 2022-11-15 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier globally and unconditionally disables SSL/TLS certificate and hostname validation… |
CVE-2022-38666 | High | 7.5 | 2022-11-15 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificate and hostname validation for several f… |
CVE-2022-42131 | Medium | 4.8 | 2022-11-15 | Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers. This affects Liferay Por… |
CVE-2022-20960 | High | 7.5 | 2022-11-04 | A vulnerability in Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated remote attacker to cause a denial of service… |
CVE-2022-33684 | High | 8.1 | 2022-11-04 | The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureC… |
CVE-2022-42813 | Critical | 9.8 | 2022-11-01 | A certificate validation issue existed in the handling of WKWebView. This issue was addressed with improved validation. This issue is fixed in tvOS 16.1, iOS 1… |
CVE-2022-41316 | Medium | 5.3 | 2022-10-12 | HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on… |
CVE-2022-40147 | High | 7.4 | 2022-10-11 | A vulnerability has been identified in Industrial Edge Management (All versions < V1.5.1). The affected software does not properly validate the server certific… |
CVE-2022-41747 | High | 7.8 | 2022-10-10 | An improper certification validation vulnerability in Trend Micro Apex One agents could allow a local attacker to load a DLL file with system service privilege… |
CVE-2022-39264 | High | 8.6 | 2022-09-28 | nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which cou… |
CVE-2022-34394 | Low | 3.7 | 2022-09-28 | Dell OS10, version 10.5.3.4, contains an Improper Certificate Validation vulnerability in Support Assist. A remote unauthenticated attacker could potentially e… |
CVE-2021-45035 | Medium | 6.3 | 2022-09-23 | Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default. This could allow an attacker that has access to the… |
CVE-2022-33683 | Medium | 5.9 | 2022-09-23 | Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is di… |
CVE-2022-33682 | Medium | 5.9 | 2022-09-23 | TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client… |
CVE-2022-33681 | Medium | 5.9 | 2022-09-23 | Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy make each client vulnerable to a man in the middle attack. Connections from th… |
CVE-2022-41244 | High | 8.1 | 2022-09-21 | Jenkins View26 Test-Reporting Plugin 1.0.7 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abuse… |
CVE-2022-41243 | High | 8.1 | 2022-09-21 | Jenkins SmallTest Plugin 1.0.4 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abused using a ma… |
CVE-2022-29908 | High | 7.8 | 2022-09-19 | The folioupdate service in Fabasoft Cloud Enterprise Client 22.4.0043 allows Local Privilege Escalation. |
CVE-2022-34831 | Critical | 9.8 | 2022-09-14 | An issue was discovered in Keyfactor PrimeKey EJBCA before 7.9.0, related to possible inconsistencies in DNS identifiers submitted in an ACME order and the cor… |
CVE-2022-36173 | High | 8.1 | 2022-09-12 | FreshService macOS Agent < 4.4.0 and FreshServce Linux Agent < 3.4.0 are vulnerable to TLS Man-in-The-Middle via the FreshAgent client and scheduled update ser… |
CVE-2022-1632 | Medium | 6.5 | 2022-09-01 | An Improper Certificate Validation attack was found in Openshift. A re-encrypt Route with destinationCACertificate explicitly set to the default serviceCA skip… |
CVE-2022-2996 | High | 7.4 | 2022-09-01 | A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified. This issue opens up… |
CVE-2021-43767 | Medium | 5.9 | 2022-08-25 | Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication… |
CVE-2021-43766 | High | 8.1 | 2022-08-25 | Odyssey passes to server unencrypted bytes from man-in-the-middle When Odyssey is configured to use certificate Common Name for client authentication, a man-in… |
CVE-2020-35509 | Medium | 5.4 | 2022-08-23 | A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0. An expired certificate would be accepted by the direct-grant authenticator because of missin… |
CVE-2022-37437 | High | 7.4 | 2022-08-16 | When using Ingest Actions to configure a destination that resides on Amazon Simple Storage Service (S3) in Splunk Web, TLS certificate validation is not correc… |
CVE-2022-34156 | Medium | 4.8 | 2022-08-16 | 'Hulu / フールー' App for iOS versions prior to 3.0.81 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encrypted communicat… |
CVE-2022-34865 | Medium | 4.8 | 2022-08-04 | In BIG-IP Versions 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, Traffic Intelligence feeds, which use HTTPS, do not verify the rem… |
CVE-2022-31183 | Critical | 9.1 | 2022-08-01 | fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode `TLSSocket` using `fs2-io` on Node.js, the parameter `requestCert = tr… |
CVE-2022-1805 | High | 8.1 | 2022-07-28 | When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients. The issue could be exploited by… |
CVE-2022-36881 | High | 8.1 | 2022-07-27 | Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle… |
CVE-2022-26305 | High | 7.5 | 2022-07-25 | An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only matching t… |
CVE-2022-20860 | High | 7.4 | 2022-07-21 | A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to alter communications with associated… |
CVE-2021-29755 | High | 7.5 | 2022-07-20 | IBM QRadar SIEM 7.3, 7.4, and 7.5 does not preform proper certificate validation for some inter-host communications. IBM X-Force ID: 202015. |
CVE-2021-22131 | Medium | 6.4 | 2022-07-18 | A improper validation of certificate with host mismatch in Fortinet FortiTokenAndroid version 5.0.3 and below, Fortinet FortiTokeniOS version 5.2.0 and below… |
CVE-2020-16093 | High | 7.5 | 2022-07-18 | In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because… |
CVE-2022-32210 | Medium | 6.5 | 2022-07-14 | `Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that p… |
CVE-2022-31105 | High | 8.3 | 2022-07-12 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 is vulnerab… |
CVE-2022-20813 | Critical | 9.0 | 2022-07-06 | Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS… |
CVE-2014-8164 | Critical | 9.1 | 2022-07-06 | A insecure configuration for certificate verification (http.verify_mode = OpenSSL::SSL::VERIFY_NONE) may lead to verification bypass in Red Hat CloudForms 5.x. |