CWE-295 · Improper Certificate Validation (page 8)
Page 8 of 17 — CVEs classified under CWE-295, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-5554 | Medium | 4.8 | 2023-10-12 | Lack of TLS certificate verification in log transmission of a financial module within LINE client for iOS prior to 13.16.0. |
CVE-2023-45613 | Medium | 6.8 | 2023-10-09 | In JetBrains Ktor before 2.3.5 server certificates were not verified |
CVE-2023-4586 | High | 7.4 | 2023-10-04 | A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly… |
CVE-2023-2422 | Medium | 5.5 | 2023-10-04 | A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certific… |
CVE-2023-41991 | Medium | 5.5 | 2023-09-21 | A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signat… |
CVE-2023-38356 | High | 8.1 | 2023-09-19 | MiniTool Power Data Recovery 11.6 contains an insecure installation process that allows attackers to achieve remote code execution through a man in the middle… |
CVE-2023-38355 | High | 8.1 | 2023-09-19 | MiniTool Movie Maker 7.0 contains an insecure installation process that allows attackers to achieve remote code execution through a man in the middle attack. |
CVE-2023-38354 | High | 8.1 | 2023-09-19 | MiniTool Shadow Maker version 4.1 contains an insecure installation process that allows attackers to achieve remote code execution through a man in the middle… |
CVE-2023-38353 | Medium | 5.9 | 2023-09-19 | MiniTool Power Data Recovery version 11.6 and before contains an insecure in-app payment system that allows attackers to steal highly sensitive information thr… |
CVE-2023-38352 | High | 8.1 | 2023-09-19 | MiniTool Partition Wizard 12.8 contains an insecure update mechanism that allows attackers to achieve remote code execution through a man in the middle attack. |
CVE-2023-38351 | High | 8.1 | 2023-09-19 | MiniTool Partition Wizard 12.8 contains an insecure installation mechanism that allows attackers to achieve remote code execution through a man in the middle a… |
CVE-2023-4801 | High | 7.5 | 2023-09-13 | An improper certification validation vulnerability in the Insider Threat Management (ITM) Agent for MacOS could be used by an anonymous actor on an adjacent ne… |
CVE-2023-35845 | Medium | 4.7 | 2023-09-11 | Anaconda 3 2023.03-1-Linux allows local users to disrupt TLS certificate validation by modifying the cacert.pem file used by the installed pip program. This oc… |
CVE-2023-30729 | High | 8.1 | 2023-09-06 | Improper Certificate Validation in Samsung Email prior to version 6.1.82.0 allows remote attacker to intercept the network traffic including sensitive informat… |
CVE-2023-41180 | Medium | 5.9 | 2023-09-03 | Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TL… |
CVE-2022-22305 | Medium | 5.4 | 2023-09-01 | An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, 6.4.7 and below; Fo… |
CVE-2023-39441 | Medium | 5.9 | 2023-08-23 | Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL… |
CVE-2023-1409 | Medium | 5.3 | 2023-08-23 | If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely… |
CVE-2023-21265 | High | 7.5 | 2023-08-14 | In multiple locations, there are root CA certificates which need to be disabled. This could lead to remote information disclosure with no additional execution… |
CVE-2023-40256 | Critical | 9.8 | 2023-08-11 | A vulnerability was discovered in Veritas NetBackup Snapshot Manager before 10.2.0.1 that allowed untrusted clients to interact with the RabbitMQ service. This… |
CVE-2023-38686 | Critical | 9.3 | 2023-08-04 | Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent does not verify SMT… |
CVE-2023-34143 | Medium | 5.6 | 2023-07-18 | Improper Validation of Certificate with Host Mismatch vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Server, Device Manager Agent, H… |
CVE-2023-3724 | Critical | 9.1 | 2023-07-17 | If a TLS 1.3 client gets neither a PSK (pre shared key) extension nor a KSE (key share extension) when connecting to a malicious server, a default predictable… |
CVE-2023-3615 | High | 8.1 | 2023-07-17 | Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSock… |
CVE-2023-38325 | High | 7.5 | 2023-07-14 | The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options. |
CVE-2023-31190 | High | 8.1 | 2023-07-11 | DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an Improper Authentication vulnerability during the firmware update procedure. Sp… |
CVE-2023-23546 | Medium | 4.2 | 2023-07-06 | A misconfiguration vulnerability exists in the urvpn_client functionality of Milesight UR32L v32.3.0.5. A specially-crafted man-in-the-middle attack can lead t… |
CVE-2023-33201 | Medium | 5.3 | 2023-07-05 | Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from… |
CVE-2023-32464 | Low | 2.7 | 2023-06-23 | Dell VxRail, versions prior to 7.0.450, contain an improper certificate validation vulnerability. A high privileged remote attacker may potentially exploit th… |
CVE-2023-34414 | Low | 3.1 | 2023-06-19 | The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialogs from attacks tha… |
CVE-2023-30222 | High | 7.5 | 2023-06-16 | An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to retrieve password hashes for all users… |
CVE-2023-35142 | High | 8.1 | 2023-06-14 | Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default. |
CVE-2023-29501 | Medium | 4.8 | 2023-06-13 | Jiyu Kukan Toku-Toku coupon App for iOS versions 3.5.0 and earlier, and Jiyu Kukan Toku-Toku coupon App for Android versions 3.5.0 and earlier are vulnerable t… |
CVE-2023-29175 | Medium | 4.8 | 2023-06-13 | An improper certificate validation vulnerability [CWE-295] in FortiOS 6.2 all versions, 6.4 all versions, 7.0.0 through 7.0.10, 7.2.0 and FortiProxy 1.2 all ve… |
CVE-2023-34410 | Medium | 5.3 | 2023-06-05 | An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS does not always consider w… |
CVE-2023-0547 | Medium | 6.5 | 2023-06-02 | OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird v… |
CVE-2023-0430 | Medium | 6.5 | 2023-06-02 | Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certificate would be displayed as having a vali… |
CVE-2023-24568 | Medium | 5.0 | 2023-05-30 | Dell NetWorker, contains an Improper Validation of Certificate with Host Mismatch vulnerability in Rabbitmq port which could disallow replacing CA signed cert… |
CVE-2023-28321 | Medium | 5.9 | 2023-05-26 | An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternativ… |
CVE-2023-1664 | Medium | 6.5 | 2023-05-26 | A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverse proxy is not valid… |
CVE-2023-20881 | High | 8.1 | 2023-05-19 | Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drain credentials if the… |
CVE-2022-45458 | High | 7.5 | 2023-05-18 | Sensitive information disclosure and manipulation due to improper certification validation. The following products are affected: Acronis Agent (Windows, macOS… |
CVE-2022-45457 | High | 7.5 | 2023-05-18 | Sensitive information disclosure and manipulation due to improper certification validation. The following products are affected: Acronis Agent (Windows) before… |
CVE-2023-32994 | Low | 3.7 | 2023-05-16 | Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configur… |
CVE-2023-27823 | Critical | 9.8 | 2023-05-12 | An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials. |
CVE-2023-31151 | Medium | 4.7 | 2023-05-10 | An Improper Certificate Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could a… |
CVE-2023-23901 | Medium | 6.5 | 2023-05-10 | Improper following of a certificate's chain of trust exists in SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, and SkyBridge BASIC MB-A130 firmware Ver… |
CVE-2022-39161 | Medium | 4.8 | 2023-05-03 | IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and IBM WebSphere Application Server Liberty, when configured to communicate with the Web Server Plug-ins… |
CVE-2023-24461 | High | 7.4 | 2023-05-03 | An improper certificate validation vulnerability exists in the BIG-IP Edge Client for Windows and macOS and may allow an attacker to impersonate a BIG-IP APM… |
CVE-2022-35898 | Critical | 9.8 | 2023-05-01 | OpenText BizManager before 16.6.0.1 does not perform proper validation during the change-password operation. This allows any authenticated user to change the p… |
CVE-2022-48186 | Medium | 6.2 | 2023-05-01 | A certificate validation vulnerability exists in the Baiying Android application which could lead to information disclosure. |
CVE-2023-31486 | High | 8.1 | 2023-04-29 | HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to… |
CVE-2023-31485 | Medium | 5.9 | 2023-04-29 | GitLab::API::v4 through 0.26 does not verify TLS certificates when connecting to a GitLab server, enabling machine-in-the-middle attacks. |
CVE-2023-31484 | High | 8.1 | 2023-04-29 | CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. |
CVE-2022-47758 | Critical | 9.8 | 2023-04-27 | Nanoleaf firmware v7.1.1 and below is missing TLS verification, allowing attackers to execute arbitrary code via a DNS hijacking attack. |
CVE-2023-26463 | Critical | 9.8 | 2023-04-15 | strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes within the same functi… |
CVE-2021-46880 | Critical | 9.8 | 2023-04-15 | x509/x509_verify.c in LibreSSL before 3.4.2, and OpenBSD before 7.0 errata 006, allows authentication bypass because an error for an unverified certificate cha… |
CVE-2023-30517 | Medium | 5.3 | 2023-04-12 | Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when connecting to a confi… |
CVE-2023-30516 | Medium | 6.5 | 2023-04-12 | Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries, resul… |
CVE-2022-48437 | Medium | 5.3 | 2023-04-12 | An issue was discovered in x509/x509_verify.c in LibreSSL before 3.6.1, and in OpenBSD before 7.2 errata 001. x509_verify_ctx_add_chain does not store errors t… |
CVE-2023-22642 | High | 7.5 | 2023-04-11 | An improper certificate validation vulnerability [CWE-295] in FortiAnalyzer and FortiManager 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4.8 through 6.4.10 may… |
CVE-2023-23588 | Medium | 6.2 | 2023-04-11 | A vulnerability has been identified in SIMATIC IPC1047 (All versions), SIMATIC IPC1047E (All versions with maxView Storage Manager < 4.09.00.25611 on Windows)… |
CVE-2023-28093 | Medium | 6.5 | 2023-04-10 | A user with a compromised configuration can start an unsigned binary as a service. |
CVE-2023-25392 | Medium | 5.9 | 2023-04-10 | Allegro Tech BigFlow <1.6 is vulnerable to Missing SSL Certificate Validation. |
CVE-2023-29000 | Medium | 5.4 | 2023-04-04 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.7.0, by trusting that the… |
CVE-2022-27644 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700v3 1.0.4.1… |
CVE-2023-0466 | Medium | 5.3 | 2023-03-28 | The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the i… |
CVE-2023-0465 | Medium | 5.3 | 2023-03-28 | Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invali… |
CVE-2022-45597 | Critical | 9.8 | 2023-03-24 | ComponentSpace.Saml2 4.4.0 Missing SSL Certificate Validation. NOTE: the vendor does not consider this a vulnerability because the report is only about use of… |
CVE-2023-20963 | High | 7.8 | 2023-03-24 | In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User inter… |
CVE-2023-0464 | High | 7.5 | 2023-03-22 | A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy… |
CVE-2021-21548 | High | 7.4 | 2023-03-17 | Dell EMC Unisphere for PowerMax versions before 9.1.0.27, Dell EMC Unisphere for PowerMax Virtual Appliance versions before 9.1.0.27, and PowerMax OS Release… |
CVE-2022-4895 | High | 8.6 | 2023-02-28 | Improper Certificate Validation vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on… |
CVE-2023-1055 | Medium | 5.5 | 2023-02-27 | A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which… |
CVE-2022-39948 | Medium | 4.8 | 2023-02-16 | An improper certificate validation vulnerability [CWE-295] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all versions, 6.0 all ver… |
CVE-2022-48308 | Medium | 6.3 | 2023-02-16 | It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious a… |
CVE-2022-48307 | Medium | 6.3 | 2023-02-16 | It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious… |
CVE-2022-48306 | Medium | 5.7 | 2023-02-16 | Improper Validation of Certificate with Host Mismatch vulnerability in Gotham Chat IRC helper of Palantir Gotham allows A malicious attacker in a privileged ne… |
CVE-2022-27890 | Medium | 6.3 | 2023-02-16 | It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious a… |
CVE-2023-22943 | Medium | 4.8 | 2023-02-14 | In Splunk Add-on Builder (AoB) versions below 4.1.2 and the Splunk CloudConnect SDK versions below 3.1.3, requests to third-party APIs through the REST API Mod… |
CVE-2023-22367 | Medium | 5.9 | 2023-02-13 | Ichiran App for iOS versions prior to 3.1.0 and Ichiran App for Android versions prior to 3.1.0 improperly verify server certificates, which may allow a remote… |
CVE-2022-34404 | Medium | 6.5 | 2023-02-11 | Dell System Update, version 2.0.0 and earlier, contains an Improper Certificate Validation in data parser module. A local attacker with high privileges could… |
CVE-2022-46496 | Medium | 5.9 | 2023-02-06 | BTicino Door Entry HOMETOUCH for iOS 1.4.2 was discovered to be missing an SSL certificate. |
CVE-2022-31733 | Critical | 9.1 | 2023-02-03 | Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are accessible via another port on diego cells… |
CVE-2022-3913 | Medium | 5.3 | 2023-02-01 | Rapid7 Nexpose and InsightVM versions 6.6.82 through 6.6.177 fail to validate the certificate of the update server when downloading updates. This failure could… |
CVE-2023-23131 | High | 7.5 | 2023-02-01 | Selfwealth iOS mobile App 3.3.1 is vulnerable to Insecure App Transport Security (ATS) Settings. |
CVE-2022-45100 | High | 8.1 | 2023-02-01 | Dell PowerScale OneFS, versions 8.2.x-9.3.x, contains an Improper Certificate Validation vulnerability. An remote unauthenticated attacker could potentially e… |
CVE-2022-32748 | High | 7.9 | 2023-01-30 | A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure d… |
CVE-2020-36659 | High | 8.1 | 2023-01-27 | In Apache::Session::Browseable before 1.3.6, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the d… |
CVE-2020-36658 | High | 8.1 | 2023-01-27 | In Apache::Session::LDAP before 0.5, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default c… |
CVE-2023-0509 | High | 7.4 | 2023-01-26 | Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44. |
CVE-2023-23690 | High | 7.0 | 2023-01-19 | Cloud Mobility for Dell EMC Storage, versions 1.3.0.X and below contains an Improper Check for Certificate Revocation vulnerability. A threat actor does not n… |
CVE-2022-42979 | High | 8.8 | 2023-01-06 | Information disclosure due to an insecure hostname validation in the RYDE application 5.8.43 for Android and iOS allows attackers to take over an account via a… |
CVE-2022-45197 | High | 7.5 | 2022-12-25 | Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp. |
CVE-2022-45419 | Medium | 6.5 | 2022-12-22 | If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server that used that certificate, and then dele… |
CVE-2022-34469 | High | 8.1 | 2022-12-22 | When a TLS Certificate error occurs on a domain protected by the HSTS header, the browser should not allow the user to bypass the certificate error. On Firefox… |
CVE-2022-22747 | Medium | 6.5 | 2022-12-22 | After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed t… |
CVE-2022-1834 | Medium | 6.5 | 2022-12-22 | When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displaye… |
CVE-2022-1197 | Medium | 5.4 | 2022-12-22 | When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet r… |
CVE-2022-32531 | Medium | 5.9 | 2022-12-15 | The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails… |