← Back
CWE-295

1,445 CVEs • Abstraction: Base

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

JSON object

Loading...

CVEs (1,445)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2017-9568
1Myfpcu
1Financial Plus Mobile Banking
May 13, 2026
Jun 16, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
The financial-plus-mobile-banking/id731070564 app 3.0.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafte...Show more
The financial-plus-mobile-banking/id731070564 app 3.0.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2017-9567
1Meafinancial
1Avb Bank Mobile Banking
May 13, 2026
Jun 16, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
The avb-bank-mobile-banking/id592565443 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted cert...Show more
The avb-bank-mobile-banking/id592565443 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2017-9566
1Meafinancial
1Fsb Dequeen Mobile Banking
May 13, 2026
Jun 16, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
The fsb-dequeen-mobile-banking/id1091025340 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...Show more
The fsb-dequeen-mobile-banking/id1091025340 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2017-9565
1Meafinancial
1First Security Bank Sleepy Eye Mobile
May 13, 2026
Jun 16, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
The first-security-bank-sleepy-eye-mobile/id870531890 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via...Show more
The first-security-bank-sleepy-eye-mobile/id870531890 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2017-9564
1Meafinancial
1Community Banks Cb2go
May 13, 2026
Jun 16, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
The community-banks-cb2go/id445828071 app 3.1.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certif...Show more
The community-banks-cb2go/id445828071 app 3.1.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2017-9563
1Meafinancial
1Fccb
May 13, 2026
Jun 16, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
The First Citizens Community Bank fccb/id809930960 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a c...Show more
The First Citizens Community Bank fccb/id809930960 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2017-9562
1Meafinancial
1Freedom 1st Credit Union Mobile Banking
May 13, 2026
Jun 16, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
The Freedom First freedom-1st-credit-union-mobile-banking/id1085229458 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive...Show more
The Freedom First freedom-1st-credit-union-mobile-banking/id1085229458 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2017-9561
1Lbtc
1Lee Bank & Trust
May 13, 2026
Jun 16, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
The Lee Bank & Trust lbtc-mobile/id1068984753 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafte...Show more
The Lee Bank & Trust lbtc-mobile/id1068984753 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2017-9560
1Cayugalakenationalbank
1Cayuga Lake National Bank
May 13, 2026
Jun 16, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
The cayuga-lake-national-bank/id1151601539 app 4.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted c...Show more
The cayuga-lake-national-bank/id1151601539 app 4.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2017-9559
1Meafinancial
1Vision Bank
May 13, 2026
Jun 16, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
The MEA Financial vision-bank/id420406345 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted ce...Show more
The MEA Financial vision-bank/id420406345 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2017-9558
1Wawacu
1Wawa Employees Credit Union Mobile
May 13, 2026
Jun 16, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
The wawa-employees-credit-union-mobile/id1158082793 app 4.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a...Show more
The wawa-employees-credit-union-mobile/id1158082793 app 4.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2017-4981
1Dell
1Bsafe Cert C
May 13, 2026
Jun 14, 2017
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
EMC RSA BSAFE Cert-C before 2.9.0.5 contains a potential improper certificate processing vulnerability.
CVE-2016-7816
1Cybozu
1Kintone
May 13, 2026
Jun 9, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
The Cybozu kintone mobile for Android 1.0.6 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certif...Show more
The Cybozu kintone mobile for Android 1.0.6 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2016-7805
1Unisys
1Mobigate
May 13, 2026
Jun 9, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
The mobiGate App for Android version 2.2.1.2 and earlier and mobiGate App for iOS version 2.2.4.1 and earlier do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers a...Show more
The mobiGate App for Android version 2.2.1.2 and earlier and mobiGate App for iOS version 2.2.4.1 and earlier do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2016-5648
1Acer
1Acer Portal
May 13, 2026
Jun 8, 2017
N/A· v4
5.3 MEDIUM· v3
4.3 MEDIUM· v2
Acer Portal app before 3.9.4.2000 for Android does not properly validate SSL certificates, which allows remote attackers to perform a Man-in-the-middle attack via a crafted SSL certificate.
CVE-2016-8231
1Lenovo
1Lenovo Service Bridge
May 13, 2026
Jun 4, 2017
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
In Lenovo Service Bridge before version 4, a bug found in the signature verification logic of the code signing certificate could be exploited by an attacker to insert a forged code signing certificate.
CVE-2016-3083
1Apache
1Hive
May 13, 2026
May 30, 2017
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes). While validating the server's certificate during the connection setup, the client in Apache Hive befo...Show more
Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes). While validating the server's certificate during the connection setup, the client in Apache Hive before 1.2.2 and 2.0.x before 2.0.1 doesn't seem to be verifying the common name attribute of the certificate. In this way, if a JDBC client sends an SSL request to server abc.com, and the server responds with a valid certificate (certified by CA) but issued to xyz.com, the client will accept that as a valid certificate and the SSL handshake will go through.Show less
CVE-2017-2800
1Wolfssl
1Wolfssl
May 13, 2026
May 24, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting in potential certificate validation vulnerabilities, denial of service and possible remote code exe...Show more
A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting in potential certificate validation vulnerabilities, denial of service and possible remote code execution. In order to trigger this vulnerability, the attacker needs to supply a malicious x509 certificate to either a server or a client application using this library.Show less
CVE-2017-6988
1Apple
1Mac Os X
May 13, 2026
May 22, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "802.1X" component. It allows remote attackers to discover the network credentials of arbitrary users by operati...Show more
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "802.1X" component. It allows remote attackers to discover the network credentials of arbitrary users by operating a crafted network that requires 802.1X authentication, because EAP-TLS certificate validation mishandles certificate changes.Show less
CVE-2017-2498
1Apple
1Iphone Os
May 13, 2026
May 22, 2017
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. The issue involves the "Security" component. It allows attackers to bypass intended access restrictions via an untrusted certificate.