CWE-295 · Improper Certificate Validation (page 9)
Page 9 of 15 — CVEs classified under CWE-295, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-39360 | Medium | 5.9 | 2021-08-22 | In GNOME libzapojit through 0.0.3, zpj-skydrive.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnera… |
CVE-2021-39359 | Medium | 5.9 | 2021-08-22 | In GNOME libgda through 6.0.0, gda-web-provider.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnera… |
CVE-2021-39358 | Medium | 5.9 | 2021-08-22 | In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vuln… |
CVE-2021-37698 | High | 7.5 | 2021-08-19 | Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In v… |
CVE-2021-32728 | Medium | 6.5 | 2021-08-18 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. Clients using the Nextcloud end-to-end encryption feature do… |
CVE-2021-22939 | Medium | 5.3 | 2021-08-16 | If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to se… |
CVE-2021-32069 | Medium | 4.8 | 2021-08-13 | The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack due to improper TLS negotiation. A successful expl… |
CVE-2021-31399 | Medium | 4.6 | 2021-08-13 | On 2N Access Unit 2.0 2.31.0.40.5 devices, an attacker can pose as the web relay for a man-in-the-middle attack. |
CVE-2021-22926 | High | 7.5 | 2021-08-05 | libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with th… |
CVE-2021-32581 | High | 8.1 | 2021-08-05 | Acronis True Image prior to 2021 Update 4 for Windows, Acronis True Image prior to 2021 Update 5 for Mac, Acronis Agent prior to build 26653, Acronis Cyber Pro… |
CVE-2021-3636 | Medium | 4.6 | 2021-07-30 | It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectly included additional certificates. The… |
CVE-2021-35193 | High | 7.5 | 2021-07-30 | Patterson Application Service in Patterson Eaglesoft 18 through 21 accepts the same certificate authentication across different customers' installations (that… |
CVE-2020-12681 | High | 7.5 | 2021-07-26 | Missing TLS certificate validation on 3xLogic Infinias eIDC32 devices through 3.4.125 allows an attacker to intercept/control the channel by which door lock po… |
CVE-2020-36425 | Medium | 5.3 | 2021-07-19 | An issue was discovered in Arm Mbed TLS before 2.24.0. It incorrectly uses a revocationDate check when deciding whether to honor certificate revocation via a C… |
CVE-2021-32574 | High | 7.5 | 2021-07-17 | HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject… |
CVE-2021-34558 | Medium | 6.5 | 2021-07-15 | The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a… |
CVE-2021-32755 | Medium | 5.4 | 2021-07-13 | Wire is a collaboration platform. wire-ios-transport handles authentication of requests, network failures, and retries for the iOS implementation of Wire. In t… |
CVE-2021-31892 | High | 7.4 | 2021-07-13 | A vulnerability has been identified in SINUMERIK Analyse MyCondition (All versions), SINUMERIK Analyze MyPerformance (All versions), SINUMERIK Analyze MyPerfor… |
CVE-2021-32727 | Medium | 5.7 | 2021-07-12 | Nextcloud Android Client is the Android client for Nextcloud. Clients using the Nextcloud end-to-end encryption feature download the public and private key via… |
CVE-2021-36377 | High | 7.5 | 2021-07-12 | Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation. |
CVE-2021-3547 | High | 7.4 | 2021-07-12 | OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unrelated server certif… |
CVE-2021-36371 | Low | 3.7 | 2021-07-09 | Emissary-Ingress (formerly Ambassador API Gateway) through 1.13.9 allows attackers to bypass client certificate requirements (i.e., mTLS cert_required) on back… |
CVE-2021-1134 | High | 7.4 | 2021-06-29 | A vulnerability in the Cisco Identity Services Engine (ISE) integration feature of the Cisco DNA Center Software could allow an unauthenticated, remote attacke… |
CVE-2021-21571 | Medium | 5.9 | 2021-06-24 | Dell UEFI BIOS https stack leveraged by the Dell BIOSConnect feature and Dell HTTPS Boot feature contains an improper certificate validation vulnerability. A r… |
CVE-2020-15732 | Medium | 6.5 | 2021-06-22 | Improper Certificate Validation vulnerability in the Online Threat Prevention module as used in Bitdefender Total Security allows an attacker to potentially by… |
CVE-2021-1566 | High | 7.4 | 2021-06-16 | A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco We… |
CVE-2021-22895 | Medium | 5.9 | 2021-06-11 | Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register wit… |
CVE-2021-20732 | Medium | 5.9 | 2021-06-09 | The ATOM (ATOM - Smart life App for Android versions prior to 1.8.1 and ATOM - Smart life App for iOS versions prior to 1.8.2) does not verify server certifica… |
CVE-2021-21559 | High | 7.1 | 2021-06-08 | Dell EMC NetWorker, versions 18.x, 19.1.x, 19.2.x 19.3.x, 19.4, and 19.4.0.1 contain an Improper Certificate Validation vulnerability in the client (NetWorker… |
CVE-2021-22218 | Low | 2.6 | 2021-06-08 | All versions of GitLab CE/EE starting from 12.8 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13… |
CVE-2021-29504 | Critical | 9.1 | 2021-06-07 | WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote at… |
CVE-2021-24012 | Medium | 6.5 | 2021-06-02 | An improper following of a certificate's chain of trust vulnerability in FortiGate versions 6.4.0 to 6.4.4 may allow an LDAP user to connect to SSLVPN with any… |
CVE-2021-22909 | High | 7.5 | 2021-05-27 | A vulnerability found in EdgeMAX EdgeRouter V2.0.9 and earlier could allow a malicious actor to execute a man-in-the-middle (MitM) attack during a firmware upd… |
CVE-2016-20011 | High | 7.5 | 2021-05-25 | libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds witho… |
CVE-2020-28907 | Critical | 9.8 | 2021-05-24 | Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to do… |
CVE-2007-5967 | Medium | 6.5 | 2021-05-17 | A flaw in Mozilla's embedded certificate code might allow web sites to install root certificates on devices without user approval. |
CVE-2021-22138 | Low | 3.7 | 2021-05-13 | In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When specifying a trusted… |
CVE-2021-32919 | High | 7.5 | 2021-05-13 | An issue was discovered in Prosody before 0.11.9. The undocumented dialback_without_dialback option in mod_dialback enables an experimental feature for server-… |
CVE-2021-29495 | Medium | 5.9 | 2021-05-07 | Nim is a statically typed compiled systems programming language. In Nim standard library before 1.4.2, httpClient SSL/TLS certificate verification was disabled… |
CVE-2020-36127 | Medium | 6.5 | 2021-05-07 | Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by an information disclosure vulnerability. Through the PUK signature functionality, an adm… |
CVE-2021-20695 | High | 8.8 | 2021-04-26 | Improper following of a certificate's chain of trust vulnerability in DAP-1880AC firmware version 1.21 and earlier allows a remote authenticated attacker to ga… |
CVE-2021-31597 | Critical | 9.4 | 2021-04-23 | The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists bu… |
CVE-2021-29653 | High | 7.5 | 2021-04-22 | HashiCorp Vault and Vault Enterprise 1.5.1 and newer, under certain circumstances, may exclude revoked but unexpired certificates from the CRL. Fixed in 1.5.8… |
CVE-2021-27400 | High | 7.5 | 2021-04-22 | HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did not validate TLS certificates when connect… |
CVE-2021-20989 | Medium | 5.9 | 2021-04-19 | Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote access and remote su… |
CVE-2021-3460 | High | 8.1 | 2021-04-13 | The Motorola MH702x devices, prior to version 2.0.0.301, do not properly verify the server certificate during communication with the support server which could… |
CVE-2020-7924 | Medium | 4.2 | 2021-04-12 | Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certif… |
CVE-2021-22511 | Medium | 6.5 | 2021-04-08 | Improper Certificate Validation vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and ea… |
CVE-2021-27899 | High | 7.4 | 2021-04-06 | The Proofpoint Insider Threat Management Agents (formerly ObserveIT Agent) for MacOS and Linux perform improper validation of the ITM Server's certificate, whi… |
CVE-2021-21374 | High | 8.1 | 2021-03-26 | Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimb… |
CVE-2021-21373 | High | 7.5 | 2021-03-26 | Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimb… |
CVE-2021-3450 | High | 7.4 | 2021-03-25 | The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from… |
CVE-2021-21385 | High | 8.8 | 2021-03-24 | Mifos-Mobile Android Application for MifosX is an Android Application built on top of the MifosX Self-Service platform. Mifos-Mobile before commit e505f62 disa… |
CVE-2021-1471 | Critical | 9.9 | 2021-03-24 | Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrar… |
CVE-2021-28363 | Medium | 6.5 | 2021-03-15 | The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to… |
CVE-2020-15260 | Medium | 6.8 | 2021-03-10 | PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN… |
CVE-2021-27257 | Medium | 6.5 | 2021-03-05 | This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R7800 firmware… |
CVE-2021-27098 | High | 8.1 | 2021-03-05 | In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy… |
CVE-2021-22189 | Medium | 5.9 | 2021-03-04 | Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that… |
CVE-2020-35662 | High | 7.4 | 2021-02-27 | In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated. |
CVE-2020-28972 | Medium | 5.9 | 2021-02-27 | In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS cert… |
CVE-2021-3406 | Critical | 9.8 | 2021-02-25 | A flaw was found in keylime 5.8.1 and older. The issue in the Keylime agent and registrar code invalidates the cryptographic chain of trust from the Endorsemen… |
CVE-2021-20328 | Medium | 6.4 | 2021-02-25 | Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s… |
CVE-2021-20327 | Medium | 6.4 | 2021-02-25 | A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in c… |
CVE-2021-20230 | High | 7.5 | 2021-02-23 | A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options… |
CVE-2021-27189 | Medium | 5.9 | 2021-02-23 | The CIRA Canadian Shield app before 4.0.13 for iOS lacks SSL Certificate Validation. |
CVE-2020-24393 | Medium | 5.9 | 2021-02-19 | TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-… |
CVE-2020-24392 | Medium | 5.9 | 2021-02-19 | In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library (because… |
CVE-2021-26911 | High | 7.4 | 2021-02-17 | core/imap/MCIMAPSession.cpp in Canary Mail before 3.22 has Missing SSL Certificate Validation for IMAP in STARTTLS mode. |
CVE-2020-29457 | Medium | 4.4 | 2021-02-16 | A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 could allow a rogue application to establish a secure connection. |
CVE-2021-20649 | Medium | 4.8 | 2021-02-12 | ELECOM WRC-300FEBK-S contains an improper certificate validation vulnerability. Via a man-in-the-middle attack, an attacker may alter the communication respons… |
CVE-2021-0341 | High | 7.5 | 2021-02-10 | In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could le… |
CVE-2020-4791 | Medium | 5.3 | 2021-02-09 | IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to obtain sensitive information using main in the middle attacks due to imprope… |
CVE-2020-5812 | Medium | 5.9 | 2021-02-06 | Nessus AMI versions 8.12.0 and earlier were found to either not validate, or incorrectly validate, a certificate which could allow an attacker to spoof a trust… |
CVE-2021-1354 | Medium | 4.3 | 2021-02-04 | A vulnerability in the certificate registration process of Cisco Unified Computing System (UCS) Central Software could allow an authenticated, adjacent attacke… |
CVE-2021-3336 | High | 8.1 | 2021-01-29 | DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior (sending an ED22519, ED448, ECC, or R… |
CVE-2021-3309 | High | 8.1 | 2021-01-26 | packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store, |
CVE-2021-3285 | Medium | 5.3 | 2021-01-26 | jxbrowser in TI Code Composer Studio IDE 8.x through 10.x before 10.1.1 does not verify X.509 certificates for HTTPS. |
CVE-2021-1277 | High | 7.5 | 2021-01-20 | Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) could allow an attacker to spoof a trusted host or construct a man-in-the-middle attack to… |
CVE-2021-1276 | High | 7.5 | 2021-01-20 | Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) could allow an attacker to spoof a trusted host or construct a man-in-the-middle attack to… |
CVE-2021-3162 | High | 7.8 | 2021-01-15 | Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation. |
CVE-2020-35733 | High | 7.5 | 2021-01-15 | An issue was discovered in Erlang/OTP before 23.2.2. The ssl application 10.2 accepts and trusts an invalid X.509 certificate chain to a trusted root Certifica… |
CVE-2020-24025 | Medium | 5.3 | 2021-01-11 | Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path. |
CVE-2020-25680 | Medium | 5.4 | 2021-01-07 | A flaw was found in JBCS httpd in version 2.4.37 SP3, where it uses a back-end worker SSL certificate with the keystore file's ID is 'unknown'. The validation… |
CVE-2019-16281 | High | 7.5 | 2020-12-30 | Ptarmigan before 0.2.3 lacks API token validation, e.g., an "if (token === apiToken) {return true;} return false;" code block. |
CVE-2020-8289 | High | 7.8 | 2020-12-27 | Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in `bztransmit` helper due to hardc… |
CVE-2020-5684 | Medium | 4.8 | 2020-12-24 | iSM client versions from V5.1 prior to V12.1 running on NEC Storage Manager or NEC Storage Manager Express does not verify a server certificate properly, which… |
CVE-2020-29663 | Critical | 9.1 | 2020-12-15 | Icinga 2 v2.8.0 through v2.11.7 and v2.12.2 has an issue where revoked certificates due for renewal will automatically be renewed, ignoring the CRL. This issue… |
CVE-2020-8286 | High | 7.5 | 2020-12-14 | curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response. |
CVE-2012-0955 | Medium | 6.8 | 2020-12-02 | software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. software-properti… |
CVE-2020-29440 | Medium | 4.6 | 2020-11-30 | Tesla Model X vehicles before 2020-11-23 do not perform certificate validation during an attempt to pair a new key fob with the body control module (BCM). This… |
CVE-2020-28942 | Medium | 4.3 | 2020-11-19 | An issue exists in PrimeKey EJBCA before 7.4.3 when enrolling with EST while proxied through an RA over the Peers protocol. As a part of EJBCA's domain securit… |
CVE-2020-8279 | High | 7.4 | 2020-11-19 | Missing validation of server certificates for out-going connections in Nextcloud Social < 0.4.0 allowed a man-in-the-middle attack. |
CVE-2020-28362 | High | 7.5 | 2020-11-18 | Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. |
CVE-2020-27589 | High | 7.5 | 2020-11-06 | Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases. |
CVE-2020-27649 | High | 8.3 | 2020-10-29 | Improper certificate validation vulnerability in OpenVPN client in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof… |
CVE-2020-27648 | High | 8.3 | 2020-10-29 | Improper certificate validation vulnerability in OpenVPN client in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers t… |
CVE-2019-8531 | Critical | 9.8 | 2020-10-27 | A validation issue existed in Trust Anchor Management. This issue was addressed with improved validation. This issue is fixed in watchOS 5.2, macOS Mojave 10.1… |
CVE-2019-8642 | Low | 3.3 | 2020-10-27 | An issue existed in the handling of S-MIME certificates. This issue was addressed with improved validation of S-MIME certificates. This issue is fixed in macOS… |
CVE-2019-17007 | High | 7.5 | 2020-10-22 | In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service. |