Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

CVEs (1,445)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-5911 1Banco Santander Mexico Sa 1Supermovil May 13, 2026 May 5, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 The Banco Santander Mexico SA Supermovil app 3.5 through 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a c...Show more The Banco Santander Mexico SA Supermovil app 3.5 through 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2017-5909 1Electronic Funds Source Llc 1Efs Mobile Driver Source May 13, 2026 May 5, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 The Electronic Funds Source (EFS) Mobile Driver Source app 2.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a...Show more The Electronic Funds Source (EFS) Mobile Driver Source app 2.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2017-5907 1Great Southern Bank 1Great Southern Mobile Banking May 13, 2026 May 5, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 The Great Southern Bank Great Southern Mobile Banking app before 4.0.4 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive informati...Show more The Great Southern Bank Great Southern Mobile Banking app before 4.0.4 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2017-5906 1Everyday Health Inc 1Diabetes In Check\ May 13, 2026 May 5, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 The Everyday Health Diabetes in Check: Blood Glucose & Carb Tracker app 3.4.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive in...Show more The Everyday Health Diabetes in Check: Blood Glucose & Carb Tracker app 3.4.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2017-5905 1Dollar Bank 1Dollar Bank Mobile May 13, 2026 May 5, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 The Dollar Bank Mobile app 2.6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2017-5902 1Payquicker 1Mypayquicker May 13, 2026 May 5, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 The PayQuicker app 1.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2017-5901 1State Bank Of India 1State Bank Anywhere May 13, 2026 May 5, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 The State Bank of India State Bank Anywhere app 5.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...Show more The State Bank of India State Bank Anywhere app 5.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2017-3213 1Think Mutual Bank 1Think Mutual Bank Mobile Banking App May 13, 2026 May 5, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 The Think Mutual Bank Mobile Banking app 3.1.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certifi...Show more The Think Mutual Bank Mobile Banking app 3.1.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2017-3212 1Sccu 1Space Coast Credit Union May 13, 2026 May 5, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 The Space Coast Credit Union Mobile app 2.2 for iOS and 2.1.0.1104 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive informati...Show more The Space Coast Credit Union Mobile app 2.2 for iOS and 2.1.0.1104 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2016-4467 1Apache 1Qpid Proton May 13, 2026 May 2, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltNam...Show more The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when using the SChannel-based security layer, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.Show less
CVE-2017-2110 1Nissan Securities 1Access Cx May 13, 2026 Apr 28, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 The Access CX App for Android prior to 2.0.0.1 and for iOS prior to 2.0.2 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information vi...Show more The Access CX App for Android prior to 2.0.0.1 and for iOS prior to 2.0.2 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2016-7815 1Cybozu 1Remote Service Manager May 13, 2026 Apr 28, 2017 N/A· v4 4.2 MEDIUM· v3 4.9 MEDIUM· v2 Remote Service Manager 3.0.0 to 3.1.4 fails to verify client certificates, which may allow remote attackers to gain access to systems on the network.
CVE-2017-8301 1Openbsd 1Libressl May 13, 2026 Apr 27, 2017 N/A· v4 5.3 MEDIUM· v3 2.6 LOW· v2 LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied upon for a later check of a verification result, in a use case where a user-provided verification callback returns 1, as demon...Show more LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied upon for a later check of a verification result, in a use case where a user-provided verification callback returns 1, as demonstrated by acceptance of invalid certificates by nginx.Show less
CVE-2017-3563 1Oracle 1Vm Virtualbox May 13, 2026 Apr 24, 2017 N/A· v4 8.8 HIGH· v3 4.6 MEDIUM· v2 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.0.38 and Prior to 5.1.20. Easily "exploitable" vulnerability allows l...Show more Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.0.38 and Prior to 5.1.20. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).Show less
CVE-2016-5016 1Pivotal Software 4Cloud Foundry Cloud Foundry Elastic RuntimeCloud Foundry Uaa+1 more May 13, 2026 Apr 24, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elasti...Show more Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired.Show less
CVE-2016-1519 1Grandstream 1Wave May 13, 2026 Apr 21, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-the-middle attackers to spoof the Grandstream provisioning se...Show more The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-the-middle attackers to spoof the Grandstream provisioning server via a crafted certificate.Show less
CVE-2016-1221 1Jetstar 1Jetstar May 13, 2026 Apr 21, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 Jetstar App for iOS before 3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2016-1210 1The Hyakugo Bank 1105 Bank May 13, 2026 Apr 21, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 The 105 BANK app 1.0 and 1.1 for Android and 1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certi...Show more The 105 BANK app 1.0 and 1.1 for Android and 1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less
CVE-2016-1198 1Ntt 1Photopt May 13, 2026 Apr 21, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 Photopt for Android before 2.0.1 does not verify SSL certificates.
CVE-2016-1186 1Cybozu 1Kintone May 13, 2026 Apr 21, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 Kintone mobile for Android 1.0.0 through 1.0.5 does not verify SSL server certificates.

Previous 1...686970...73 Next