CWE-295
1,690 CVEs • Abstraction: Base
Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
CVEs (1,690)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Suse 2Studio Onsite Susestudio Ui ServerNov 21, 2024 Jan 27, 2020 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 A Improper Certificate Validation vulnerability in susestudio-common of SUSE Studio onsite allows remote attackers to MITM connections to the repositories, which allows the modification of packages received over these co...Show more |
Mozilla Firefox prior to 3.6 has a DoS vulnerability due to an issue in the validation of certificates. |
1Vmware 9Workspace One Boxer Workspace One ContentWorkspace One Intelligent Hub+6 moreJun 17, 2026 Jan 17, 2020 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 VMware Workspace ONE SDK and dependent mobile application updates address sensitive information disclosure vulnerability. |
The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust verification. However this configuration is not respected and the certificate verification disables trust verification in...Show more |
1Cisco 1Ironport Web Security Appliance Nov 21, 2024 Jan 15, 2020 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 Cisco IronPort Web Security Appliance does not check for certificate revocation which could lead to MITM attacks |
2Golang Microsoft13Go Windows 10 1507Windows 10 1607+10 moreJun 17, 2026 Jan 14, 2020 N/A· v4 8.1 HIGH· v3 5.8 MEDIUM· v2 A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate...Show more |
1Ovirt Engine Sdk Python Project 1Ovirt Engine Sdk Python Nov 21, 2024 Jan 2, 2020 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This...Show more |
In fence-agents before 4.0.17 does not verify remote SSL certificates in the fence_cisco_ucs.py script which can potentially allow for man-in-the-middle attackers to spoof SSL servers via arbitrary SSL certificates. |
1Redhat 1Mrg Management Console Nov 21, 2024 Dec 30, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An import error was introduced in Cumin in the code refactoring in r5310. Server certificate validation is always disabled when connecting to Aviary servers, even if the installed packages on a system support it. |
The NTV News24 prior to Ver.3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. |
1F5 1Big Ip Application Security Manager Jun 17, 2026 Dec 23, 2019 N/A· v4 7.4 HIGH· v3 5.8 MEDIUM· v2 On versions 15.0.0-15.0.1.1, the BIG-IP ASM Cloud Security Services profile uses a built-in verification mechanism that fails to properly authenticate the X.509 certificate of remote endpoints. |
Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins master JVM. |
Jenkins Spira Importer Plugin 3.2.3 and earlier disables SSL/TLS certificate validation for the Jenkins master JVM. |
Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0. |
1Barco 3Clickshare Cs 100 Firmware Clickshare Cse 200 FirmwareClickshare Cse 800 FirmwareJun 17, 2026 Dec 16, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Barco ClickShare Button R9861500D01 devices before 1.9.0 have Improper Following of a Certificate's Chain of Trust. The embedded 'dongle_bridge' program used to expose the functionalities of the ClickShare Button to a US...Show more |
2Debian Opensuse3Debian Linux DuplicityOpensuseNov 21, 2024 Dec 13, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 duplicity 0.6.24 has improper verification of SSL certificates |
The Audible application through 2.34.0 for Android has Missing SSL Certificate Validation for Adobe SDKs, allowing MITM attackers to cause a denial of service. |
A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case user authentication succeeds even if inv...Show more |
3Debian GnupgRedhat3Debian Linux Enterprise LinuxGnupgNov 21, 2024 Nov 27, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 dirmngr before 2.1.0 improperly handles certain system calls, which allows remote attackers to cause a denial of service (DOS) via a specially-crafted certificate. |
An issue was discovered in tls_verify_crl in ProFTPD before 1.3.6. A wrong iteration variable, used when checking a client certificate against CRL entries (installed by a system administrator), can cause some CRL entries...Show more |