CWE-295 · Improper Certificate Validation (page 9)
Page 9 of 17 — CVEs classified under CWE-295, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-46153 | High | 8.1 | 2022-12-08 | Traefik is an open source HTTP reverse proxy and load balancer. In affected versions there is a potential vulnerability in Traefik managing TLS connections. A… |
CVE-2022-43705 | Critical | 9.1 | 2022-11-27 | In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 20… |
CVE-2022-39334 | Low | 3.9 | 2022-11-25 | Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to… |
CVE-2022-45391 | High | 7.5 | 2022-11-15 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier globally and unconditionally disables SSL/TLS certificate and hostname validation… |
CVE-2022-38666 | High | 7.5 | 2022-11-15 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificate and hostname validation for several f… |
CVE-2022-42131 | Medium | 4.8 | 2022-11-15 | Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers. This affects Liferay Por… |
CVE-2022-20960 | High | 7.5 | 2022-11-04 | A vulnerability in Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated remote attacker to cause a denial of service… |
CVE-2022-33684 | High | 8.1 | 2022-11-04 | The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureC… |
CVE-2022-42813 | Critical | 9.8 | 2022-11-01 | A certificate validation issue existed in the handling of WKWebView. This issue was addressed with improved validation. This issue is fixed in tvOS 16.1, iOS 1… |
CVE-2022-41316 | Medium | 5.3 | 2022-10-12 | HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on… |
CVE-2022-40147 | High | 7.4 | 2022-10-11 | A vulnerability has been identified in Industrial Edge Management (All versions < V1.5.1). The affected software does not properly validate the server certific… |
CVE-2022-41747 | High | 7.8 | 2022-10-10 | An improper certification validation vulnerability in Trend Micro Apex One agents could allow a local attacker to load a DLL file with system service privilege… |
CVE-2022-39264 | High | 8.6 | 2022-09-28 | nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which cou… |
CVE-2022-34394 | Low | 3.7 | 2022-09-28 | Dell OS10, version 10.5.3.4, contains an Improper Certificate Validation vulnerability in Support Assist. A remote unauthenticated attacker could potentially e… |
CVE-2021-45035 | Medium | 6.3 | 2022-09-23 | Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default. This could allow an attacker that has access to the… |
CVE-2022-33683 | Medium | 5.9 | 2022-09-23 | Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is di… |
CVE-2022-33682 | Medium | 5.9 | 2022-09-23 | TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client… |
CVE-2022-33681 | Medium | 5.9 | 2022-09-23 | Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy make each client vulnerable to a man in the middle attack. Connections from th… |
CVE-2022-41244 | High | 8.1 | 2022-09-21 | Jenkins View26 Test-Reporting Plugin 1.0.7 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abuse… |
CVE-2022-41243 | High | 8.1 | 2022-09-21 | Jenkins SmallTest Plugin 1.0.4 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abused using a ma… |
CVE-2022-29908 | High | 7.8 | 2022-09-19 | The folioupdate service in Fabasoft Cloud Enterprise Client 22.4.0043 allows Local Privilege Escalation. |
CVE-2022-34831 | Critical | 9.8 | 2022-09-14 | An issue was discovered in Keyfactor PrimeKey EJBCA before 7.9.0, related to possible inconsistencies in DNS identifiers submitted in an ACME order and the cor… |
CVE-2022-36173 | High | 8.1 | 2022-09-12 | FreshService macOS Agent < 4.4.0 and FreshServce Linux Agent < 3.4.0 are vulnerable to TLS Man-in-The-Middle via the FreshAgent client and scheduled update ser… |
CVE-2022-1632 | Medium | 6.5 | 2022-09-01 | An Improper Certificate Validation attack was found in Openshift. A re-encrypt Route with destinationCACertificate explicitly set to the default serviceCA skip… |
CVE-2022-2996 | High | 7.4 | 2022-09-01 | A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified. This issue opens up… |
CVE-2021-43767 | Medium | 5.9 | 2022-08-25 | Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication… |
CVE-2021-43766 | High | 8.1 | 2022-08-25 | Odyssey passes to server unencrypted bytes from man-in-the-middle When Odyssey is configured to use certificate Common Name for client authentication, a man-in… |
CVE-2020-35509 | Medium | 5.4 | 2022-08-23 | A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0. An expired certificate would be accepted by the direct-grant authenticator because of missin… |
CVE-2022-37437 | High | 7.4 | 2022-08-16 | When using Ingest Actions to configure a destination that resides on Amazon Simple Storage Service (S3) in Splunk Web, TLS certificate validation is not correc… |
CVE-2022-34156 | Medium | 4.8 | 2022-08-16 | 'Hulu / フールー' App for iOS versions prior to 3.0.81 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encrypted communicat… |
CVE-2022-34865 | Medium | 4.8 | 2022-08-04 | In BIG-IP Versions 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, Traffic Intelligence feeds, which use HTTPS, do not verify the rem… |
CVE-2022-31183 | Critical | 9.1 | 2022-08-01 | fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode `TLSSocket` using `fs2-io` on Node.js, the parameter `requestCert = tr… |
CVE-2022-1805 | High | 8.1 | 2022-07-28 | When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients. The issue could be exploited by… |
CVE-2022-36881 | High | 8.1 | 2022-07-27 | Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle… |
CVE-2022-26305 | High | 7.5 | 2022-07-25 | An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only matching t… |
CVE-2022-20860 | High | 7.4 | 2022-07-21 | A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to alter communications with associated… |
CVE-2021-29755 | High | 7.5 | 2022-07-20 | IBM QRadar SIEM 7.3, 7.4, and 7.5 does not preform proper certificate validation for some inter-host communications. IBM X-Force ID: 202015. |
CVE-2021-22131 | Medium | 6.4 | 2022-07-18 | A improper validation of certificate with host mismatch in Fortinet FortiTokenAndroid version 5.0.3 and below, Fortinet FortiTokeniOS version 5.2.0 and below… |
CVE-2020-16093 | High | 7.5 | 2022-07-18 | In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because… |
CVE-2022-32210 | Medium | 6.5 | 2022-07-14 | `Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that p… |
CVE-2022-31105 | High | 8.3 | 2022-07-12 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 is vulnerab… |
CVE-2022-20813 | Critical | 9.0 | 2022-07-06 | Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS… |
CVE-2014-8164 | Critical | 9.1 | 2022-07-06 | A insecure configuration for certificate verification (http.verify_mode = OpenSSL::SSL::VERIFY_NONE) may lead to verification bypass in Red Hat CloudForms 5.x. |
CVE-2022-31083 | High | 8.6 | 2022-06-17 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 4.10.11 and 5.2.2, the certificate in… |
CVE-2022-32156 | High | 8.1 | 2022-06-15 | In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface (CLI) did not validate TLS certificates while connecting to… |
CVE-2022-32153 | High | 8.1 | 2022-06-15 | Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates durin… |
CVE-2022-32152 | High | 8.1 | 2022-06-15 | Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates durin… |
CVE-2022-32151 | High | 7.4 | 2022-06-15 | The httplib and urllib Python libraries that Splunk shipped with Splunk Enterprise did not validate certificates using the certificate authority (CA) certifica… |
CVE-2022-29482 | Low | 3.7 | 2022-06-14 | 'Mobaoku-Auction&Flea Market' App for iOS versions prior to 5.5.16 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encr… |
CVE-2022-32563 | Critical | 9.8 | 2022-06-10 | An issue was discovered in Couchbase Sync Gateway 3.x before 3.0.2. Admin credentials are not verified when using X.509 client-certificate authentication from… |
CVE-2022-26493 | Critical | 9.8 | 2022-06-03 | Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability. An attacker wi… |
CVE-2022-27782 | High | 7.5 | 2022-06-02 | libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previ… |
CVE-2022-26491 | Medium | 5.9 | 2022-06-02 | An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to a malicious server. The clie… |
CVE-2020-26184 | High | 7.5 | 2022-06-01 | Dell BSAFE Micro Edition Suite, versions prior to 4.5.1, contain an Improper Certificate Validation vulnerability. |
CVE-2022-26766 | Medium | 5.5 | 2022-05-26 | A certificate parsing issue was addressed with improved checks. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, Security Update 2022-004 Catalina… |
CVE-2022-29082 | Low | 3.7 | 2022-05-26 | Dell EMC NetWorker versions 19.1.x, 19.1.0.x, 19.1.1.x, 19.2.x, 19.2.0.x, 19.2.1.x 19.3.x, 19.3.0.x, 19.4.x, 19.4.0.x, 19.5.x,19.5.0.x, 19.6 and 19.6.0.1 and 1… |
CVE-2022-22306 | Medium | 5.4 | 2022-05-24 | An improper certificate validation vulnerability [CWE-295] in FortiOS 6.0.0 through 6.0.14, 6.2.0 through 6.2.10, 6.4.0 through 6.4.8, 7.0.0 may allow a networ… |
CVE-2022-29222 | Medium | 5.9 | 2022-05-21 | Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses… |
CVE-2022-22787 | Medium | 5.9 | 2022-05-18 | The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.10.0 fails to properly validate the hostname during a server switch… |
CVE-2021-29726 | Medium | 5.3 | 2022-05-17 | IBM Sterling Secure Proxy 6.0.3 and IBM Secure External Authentication Server 6.0.3 does not properly ensure that a certificate is actually associated with the… |
CVE-2013-10001 | Medium | 4.8 | 2022-05-17 | A vulnerability was found in HTC One/Sense 4.x. It has been rated as problematic. Affected by this issue is the certification validation of the mail client. An… |
CVE-2021-27768 | Medium | 6.3 | 2022-05-12 | Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account information was able to be i… |
CVE-2022-26923 | High | 8.8 | 2022-05-10 | Active Directory Domain Services Elevation of Privilege Vulnerability |
CVE-2022-24901 | High | 7.5 | 2022-05-04 | Improper validation of the Apple certificate URL in the Apple Game Center authentication adapter allows attackers to bypass authentication, making the server v… |
CVE-2022-1343 | Medium | 5.3 | 2022-05-03 | The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the r… |
CVE-2021-3898 | Medium | 6.8 | 2022-04-22 | Versions of Motorola Ready For and Motorola Device Help Android applications prior to 2021-04-08 do not properly verify the server certificate which could lead… |
CVE-2022-27536 | High | 7.5 | 2022-04-20 | Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a… |
CVE-2022-22549 | High | 7.5 | 2022-04-12 | Dell PowerScale OneFS, 8.2.x-9.3.x, contains a Improper Certificate Validation. A unauthenticated remote attacker could potentially exploit this vulnerability… |
CVE-2022-20081 | Medium | 5.9 | 2022-04-11 | In A-GPS, there is a possible man in the middle attack due to improper certificate validation. This could lead to remote information disclosure with no additio… |
CVE-2022-20071 | Medium | 6.7 | 2022-04-11 | In ccu, there is a possible escalation of privilege due to a missing certificate validation. This could lead to local escalation of privilege with System execu… |
CVE-2022-28352 | Medium | 4.3 | 2022-04-02 | WeeChat (aka Wee Enhanced Environment for Chat) 3.2 to 3.4 before 3.4.1 does not properly verify the TLS certificate of the server, after certain GnuTLS option… |
CVE-2022-28142 | High | 7.5 | 2022-03-29 | Jenkins Proxmox Plugin 0.6.0 and earlier disables SSL/TLS certificate validation globally for the Jenkins controller JVM when configured to ignore SSL/TLS issu… |
CVE-2022-0123 | Medium | 5.9 | 2022-03-28 | An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL… |
CVE-2021-45490 | Critical | 9.1 | 2022-03-28 | The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for Android through 2022-03-17 lack SSL certificate validation. |
CVE-2022-0759 | High | 8.1 | 2022-03-25 | A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files… |
CVE-2022-27820 | Medium | 4.0 | 2022-03-24 | OWASP Zed Attack Proxy (ZAP) through w2022-03-21 does not verify the TLS certificate chain of an HTTPS server. |
CVE-2021-3618 | High | 7.4 | 2022-03-23 | ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, su… |
CVE-2022-25243 | Medium | 6.5 | 2022-03-10 | "Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard certificates to author… |
CVE-2022-21170 | Low | 3.7 | 2022-03-10 | Improper check for certificate revocation in i-FILTER Ver.10.45R01 and earlier, i-FILTER Ver.9.50R10 and earlier, i-FILTER Browser & Cloud MultiAgent for Windo… |
CVE-2021-3698 | High | 7.5 | 2022-03-10 | A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD)… |
CVE-2021-42017 | Medium | 5.9 | 2022-03-08 | A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2200, RUGG… |
CVE-2022-22946 | Medium | 5.5 | 2022-03-04 | In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be co… |
CVE-2021-44533 | Medium | 5.3 | 2022-02-24 | Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subj… |
CVE-2021-44532 | Medium | 5.3 | 2022-02-24 | Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certifica… |
CVE-2021-44531 | High | 7.4 | 2022-02-24 | Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-const… |
CVE-2022-25640 | High | 7.5 | 2022-02-24 | In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificate_verify mess… |
CVE-2022-25638 | Medium | 6.5 | 2022-02-24 | In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the s… |
CVE-2021-25636 | High | 7.5 | 2022-02-24 | LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since… |
CVE-2022-21657 | Medium | 6.8 | 2022-02-22 | Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions Envoy does not restrict the set of certificates it… |
CVE-2022-21656 | High | 7.4 | 2022-02-22 | Envoy is an open source edge and service proxy, designed for cloud-native applications. The default_validator.cc implementation used to implement the default c… |
CVE-2022-21654 | High | 7.4 | 2022-02-22 | Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have chang… |
CVE-2022-23649 | Low | 3.3 | 2022-02-18 | Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to… |
CVE-2021-29656 | Critical | 9.8 | 2022-02-18 | Pexip Infinity Connect before 1.8.0 mishandles TLS certificate validation. The allow list is not properly checked. |
CVE-2022-23632 | High | 7.4 | 2022-02-17 | Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.6.1, Traefik skips the router transport layer security (TLS) configuration when the host… |
CVE-2022-22885 | Critical | 9.8 | 2022-02-16 | Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation. |
CVE-2022-24968 | Medium | 5.9 | 2022-02-11 | In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their… |
CVE-2022-20703 | Critical | 10.0 | 2022-02-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbi… |
CVE-2022-24320 | Medium | 5.9 | 2022-02-09 | A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA… |
CVE-2022-24319 | Medium | 5.9 | 2022-02-09 | A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA… |
CVE-2022-20034 | Medium | 6.8 | 2022-02-09 | In Preloader XFLASH, there is a possible escalation of privilege due to an improper certificate validation. This could lead to local escalation of privilege fo… |