← Back
CWE-295

1,533 CVEs • Abstraction: Base

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

JSON object

Loading...

CVEs (1,533)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2015-5619
2Elastic
Elasticsearch
2Logstash
Logstash
May 13, 2026
Aug 9, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack output or the Logstash forwarder does not validate SSL/TLS certificates from the Logstash server, which might allow attackers to obtain sensitive informa...Show more
Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack output or the Logstash forwarder does not validate SSL/TLS certificates from the Logstash server, which might allow attackers to obtain sensitive information via a man-in-the-middle attack.Show less
CVE-2017-11506
1Tenable
1Nessus
May 13, 2026
Aug 9, 2017
N/A· v4
7.4 HIGH· v3
5.8 MEDIUM· v2
When linking a Nessus scanner or agent to Tenable.io or other manager, Nessus 6.x before 6.11 does not verify the manager's TLS certificate when making the initial outgoing connection. This could allow man-in-the-middle...Show more
When linking a Nessus scanner or agent to Tenable.io or other manager, Nessus 6.x before 6.11 does not verify the manager's TLS certificate when making the initial outgoing connection. This could allow man-in-the-middle attacks.Show less
CVE-2017-7932
1Nxp
30I.mx 28 Firmware
I.mx 50 FirmwareI.mx 53 Firmware+27 more
May 13, 2026
Aug 7, 2017
N/A· v4
6.0 MEDIUM· v3
4.4 MEDIUM· v2
An improper certificate validation issue was discovered in NXP i.MX 28 i.MX 50, i.MX 53, i.MX 7Solo i.MX 7Dual Vybrid VF3xx, Vybrid VF5xx, Vybrid VF6xx, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualL...Show more
An improper certificate validation issue was discovered in NXP i.MX 28 i.MX 50, i.MX 53, i.MX 7Solo i.MX 7Dual Vybrid VF3xx, Vybrid VF5xx, Vybrid VF6xx, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, and i.MX 6QuadPlus. When the device is configured in security enabled configuration, under certain conditions it is possible to bypass the signature verification by using a specially crafted certificate leading to the execution of an unsigned image.Show less
CVE-2017-6664
1Cisco
1Ios Xe
May 13, 2026
Aug 7, 2017
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
A vulnerability in the Autonomic Networking feature of Cisco IOS XE Software could allow an unauthenticated, remote, autonomic node to access the Autonomic Networking infrastructure of an affected system, after the certi...Show more
A vulnerability in the Autonomic Networking feature of Cisco IOS XE Software could allow an unauthenticated, remote, autonomic node to access the Autonomic Networking infrastructure of an affected system, after the certificate for the autonomic node has been revoked. This vulnerability affected devices that are running Release 16.x of Cisco IOS XE Software and are configured to use Autonomic Networking. This vulnerability does not affect devices that are running an earlier release of Cisco IOS XE Software or devices that are not configured to use Autonomic Networking. More Information: CSCvd22328. Known Affected Releases: 15.5(1)S3.1 Denali-16.2.1.Show less
CVE-2017-10819
1Intercom
1Malion
May 13, 2026
Aug 4, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
MaLion for Mac 4.3.0 to 5.2.1 does not properly validate certificates, which may allow an attacker to eavesdrop on an encrypted communication.
CVE-2017-2278
1Iid
1Rbb Speed Test
May 13, 2026
Aug 2, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
The RBB SPEED TEST App for Android version 2.0.3 and earlier, RBB SPEED TEST App for iOS version 2.1.0 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof se...Show more
The RBB SPEED TEST App for Android version 2.0.3 and earlier, RBB SPEED TEST App for iOS version 2.1.0 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2017-11364
1Joomla
1Joomla
May 13, 2026
Aug 2, 2017
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain control of the target application by leveraging Certificate Transparency logs.
CVE-2017-11132
1Heinekingmedia
1Stashcat
May 13, 2026
Aug 1, 2017
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
An issue was discovered in heinekingmedia StashCat before 1.5.18 for Android. No certificate pinning is implemented; therefore the attacker could issue a certificate for the backend and the application would not notice i...Show more
An issue was discovered in heinekingmedia StashCat before 1.5.18 for Android. No certificate pinning is implemented; therefore the attacker could issue a certificate for the backend and the application would not notice it.Show less
CVE-2015-0904
1Shidax
1Restaurant Karaoke
May 13, 2026
Jul 25, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
The Restaurant Karaoke SHIDAX app 1.3.3 and earlier on Android does not verify SSL certificates, which allows remote attackers to obtain sensitive information via a man-in-the-middle attack.
CVE-2015-3886
1Libinfinity Project
1Libinfinity
May 13, 2026
Jul 21, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
libinfinity before 0.6.6-1 does not validate expired SSL certificates, which allows remote attackers to have unspecified impact via unknown vectors.
CVE-2017-11501
1Nixos Project
1Nixos
May 13, 2026
Jul 20, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication against LDAP servers via a PAM module. It was found that if TLS...Show more
NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication against LDAP servers via a PAM module. It was found that if TLS is enabled to connect to the LDAP server with users.ldap.useTLS, peer verification will be unconditionally disabled in /etc/ldap.conf.Show less
CVE-2017-1000007
1Twistedmatrix
1Txaws
May 13, 2026
Jul 17, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
txAWS (all current versions) fail to perform complete certificate verification resulting in vulnerability to MitM attacks and information disclosure.
CVE-2017-7726
1Ismartalarm
1Cubeone Firmware
May 13, 2026
Jul 11, 2017
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
iSmartAlarm cube devices have an SSL Certificate Validation Vulnerability.
CVE-2017-7406
1Dlink
1Dir 615
May 13, 2026
Jul 7, 2017
N/A· v4
9.8 CRITICAL· v3
5.0 MEDIUM· v2
The D-Link DIR-615 device before v20.12PTb04 doesn't use SSL for any of the authenticated pages. Also, it doesn't allow the user to generate his own SSL Certificate. An attacker can simply monitor network traffic to stea...Show more
The D-Link DIR-615 device before v20.12PTb04 doesn't use SSL for any of the authenticated pages. Also, it doesn't allow the user to generate his own SSL Certificate. An attacker can simply monitor network traffic to steal a user's credentials and/or credentials of users being added while sniffing the traffic.Show less
CVE-2017-3218
1Samsung
1Magician
May 13, 2026
Jun 21, 2017
N/A· v4
8.8 HIGH· v3
8.3 HIGH· v2
Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician uses HTTP for software updates.
CVE-2017-9601
1Fnbkemp
1Fnb Kemp Mobile Banking
May 13, 2026
Jun 16, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
The "FNB Kemp Mobile Banking" by First National Bank of Kemp app 3.0.2 -- aka fnb-kemp-mobile-banking/id571448725 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to s...Show more
The "FNB Kemp Mobile Banking" by First National Bank of Kemp app 3.0.2 -- aka fnb-kemp-mobile-banking/id571448725 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2017-9600
1Meafinancial
1Peoples Bank Tulsa
May 13, 2026
Jun 16, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
The "Peoples Bank Tulsa" by Peoples Bank - OK app 3.0.2 -- aka peoples-bank-tulsa/id1074279285 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and ob...Show more
The "Peoples Bank Tulsa" by Peoples Bank - OK app 3.0.2 -- aka peoples-bank-tulsa/id1074279285 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2017-9599
1Fountaintrust
1Fountain Trust Mobile Banking
May 13, 2026
Jun 16, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
The "Fountain Trust Mobile Banking" by FOUNTAIN TRUST COMPANY app before 3.2.0 -- aka fountain-trust-mobile-banking/id891343006 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle...Show more
The "Fountain Trust Mobile Banking" by FOUNTAIN TRUST COMPANY app before 3.2.0 -- aka fountain-trust-mobile-banking/id891343006 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2017-9598
1Meafinancial
1Morton Credit Union Mobile Banking
May 13, 2026
Jun 16, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
The "Morton Credit Union Mobile Banking" by Morton Credit Union app 3.0.1 -- aka morton-credit-union-mobile-banking/id1119623070 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle...Show more
The "Morton Credit Union Mobile Banking" by Morton Credit Union app 3.0.1 -- aka morton-credit-union-mobile-banking/id1119623070 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2017-9597
1Meafinancial
1Blue Ridge Bank And Trust Co. Mobile Banking
May 13, 2026
Jun 16, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
The "Blue Ridge Bank and Trust Co. Mobile Banking" by Blue Ridge Bank and Trust Co. app 3.0.1 -- aka blue-ridge-bank-and-trust-co-mobile-banking/id699679197 for iOS does not verify X.509 certificates from SSL servers, wh...Show more
The "Blue Ridge Bank and Trust Co. Mobile Banking" by Blue Ridge Bank and Trust Co. app 3.0.1 -- aka blue-ridge-bank-and-trust-co-mobile-banking/id699679197 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less