CWE-295
AllowedImproper Certificate Validation
Abstraction: Base · Status: Draft
The product does not validate, or incorrectly validates, a certificate.
2039 vulnerabilities reference this CWE, most recent first.
GHSA-MMPQ-GQVM-78GF
Vulnerability from github – Published: 2022-05-14 04:03 – Updated: 2022-05-14 04:03The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain sensitive information via a revoked certificate when a Puppet master runs with Apache 2.4.
{
"affected": [],
"aliases": [
"CVE-2014-3250"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-12-11T17:29:00Z",
"severity": "MODERATE"
},
"details": "The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain sensitive information via a revoked certificate when a Puppet master runs with Apache 2.4.",
"id": "GHSA-mmpq-gqvm-78gf",
"modified": "2022-05-14T04:03:23Z",
"published": "2022-05-14T04:03:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3250"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1101347"
},
{
"type": "WEB",
"url": "https://puppet.com/security/cve/CVE-2014-3250"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MMQQ-P5MV-JC88
Vulnerability from github – Published: 2026-02-03 03:30 – Updated: 2026-02-19 18:31A third-party NAT traversal module fails to validate SSL/TLS certificates when connecting to the signaling server. While subsequent access to device services requires additional authentication, a Man-in-the-Middle (MitM) attacker can intercept or redirect the NAT tunnel establishment. This could allow an attacker to disrupt service availability or facilitate further targeted attacks by acting as a proxy between the user and the device services. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.
{
"affected": [],
"aliases": [
"CVE-2026-24935"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-03T03:15:53Z",
"severity": "MODERATE"
},
"details": "A third-party NAT traversal module fails to validate SSL/TLS certificates when connecting to the signaling server. While subsequent access to device services requires additional authentication, a Man-in-the-Middle (MitM) attacker can intercept or redirect the NAT tunnel establishment. This could allow an attacker to disrupt service availability or facilitate further targeted attacks by acting as a proxy between the user and the device services.\nAffected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.",
"id": "GHSA-mmqq-p5mv-jc88",
"modified": "2026-02-19T18:31:43Z",
"published": "2026-02-03T03:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24935"
},
{
"type": "WEB",
"url": "https://www.asustor.com/security/security_advisory_detail?id=50"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-MMR3-C33J-H2F2
Vulnerability from github – Published: 2026-04-02 09:30 – Updated: 2026-04-16 21:31SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to cause attacker-controlled certificates to be used for future encryption to a victim by adding the certificates to S/MIME signatures.
{
"affected": [],
"aliases": [
"CVE-2026-29140"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-02T09:16:22Z",
"severity": "HIGH"
},
"details": "SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to cause attacker-controlled certificates to be used for future encryption to a victim by adding the certificates to S/MIME signatures.",
"id": "GHSA-mmr3-c33j-h2f2",
"modified": "2026-04-16T21:31:10Z",
"published": "2026-04-02T09:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29140"
},
{
"type": "WEB",
"url": "https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#seppmail-vulnerability-disclosure-1503"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-MP53-VXQR-3F76
Vulnerability from github – Published: 2026-01-12 18:30 – Updated: 2026-01-12 18:30An issue in Automai BotManager v.25.2.0 allows a remote attacker to execute arbitrary code via the BotManager.exe component
{
"affected": [],
"aliases": [
"CVE-2025-46070"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-12T17:15:51Z",
"severity": "CRITICAL"
},
"details": "An issue in Automai BotManager v.25.2.0 allows a remote attacker to execute arbitrary code via the BotManager.exe component",
"id": "GHSA-mp53-vxqr-3f76",
"modified": "2026-01-12T18:30:30Z",
"published": "2026-01-12T18:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46070"
},
{
"type": "WEB",
"url": "https://gist.github.com/ZeroBreach-GmbH/776dd7e927d9b2f8ef10807abe124f8e"
},
{
"type": "WEB",
"url": "https://www.automai.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-MP65-95XH-R2CH
Vulnerability from github – Published: 2022-04-23 00:40 – Updated: 2024-04-03 23:53Cisco IronPort Web Security Appliance does not check for certificate revocation which could lead to MITM attacks
{
"affected": [],
"aliases": [
"CVE-2012-1316"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-01-15T14:15:00Z",
"severity": "MODERATE"
},
"details": "Cisco IronPort Web Security Appliance does not check for certificate revocation which could lead to MITM attacks",
"id": "GHSA-mp65-95xh-r2ch",
"modified": "2024-04-03T23:53:12Z",
"published": "2022-04-23T00:40:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1316"
},
{
"type": "WEB",
"url": "https://www.secureworks.com/research/transitive-trust"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/52981"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MPFM-FPGX-647Q
Vulnerability from github – Published: 2026-04-29 20:33 – Updated: 2026-05-14 20:39Impact
Configured SMTP server may be spoofed with any certificate (e.g. self-signed), leaving credentials and all emails sent open to MITM attacks.
Patches
The vulnerability has been patched in CKAN 2.10.10 and CKAN 2.11.5
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.11.4"
},
"package": {
"ecosystem": "PyPI",
"name": "ckan"
},
"ranges": [
{
"events": [
{
"introduced": "2.11.0"
},
{
"fixed": "2.11.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "ckan"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.10.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-41132"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-29T20:33:20Z",
"nvd_published_at": "2026-05-13T19:17:21Z",
"severity": "MODERATE"
},
"details": "### Impact\nConfigured SMTP server may be spoofed with any certificate (e.g. self-signed), leaving credentials and all emails sent open to MITM attacks.\n\n### Patches\nThe vulnerability has been patched in CKAN 2.10.10 and CKAN 2.11.5",
"id": "GHSA-mpfm-fpgx-647q",
"modified": "2026-05-14T20:39:37Z",
"published": "2026-04-29T20:33:20Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ckan/ckan/security/advisories/GHSA-mpfm-fpgx-647q"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41132"
},
{
"type": "WEB",
"url": "https://docs.ckan.org/en/2.10/changelog.html#v-2-10-10-2026-04-29"
},
{
"type": "WEB",
"url": "https://docs.ckan.org/en/2.11/changelog.html#v-2-11-5-2026-04-29"
},
{
"type": "PACKAGE",
"url": "https://github.com/ckan/ckan"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "CKAN has no certificate validation on STMP connection"
}
GHSA-MPVX-WHPP-99XJ
Vulnerability from github – Published: 2024-07-31 21:32 – Updated: 2025-03-19 15:35Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification process when sending out email verification codes, possibly allowing attackers to access sensitive data via a man-in-the-middle attack.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mickael-kerjean/filestash"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-41256"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2024-08-02T16:40:57Z",
"nvd_published_at": "2024-07-31T21:15:18Z",
"severity": "HIGH"
},
"details": "Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification process when sending out email verification codes, possibly allowing attackers to access sensitive data via a man-in-the-middle attack.",
"id": "GHSA-mpvx-whpp-99xj",
"modified": "2025-03-19T15:35:13Z",
"published": "2024-07-31T21:32:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41256"
},
{
"type": "WEB",
"url": "https://github.com/mickael-kerjean/filestash/issues/709"
},
{
"type": "WEB",
"url": "https://gist.github.com/nyxfqq/a6da3fe6128b978ea1aaa5df639d5f98"
},
{
"type": "PACKAGE",
"url": "https://github.com/mickael-kerjean/filestash"
},
{
"type": "WEB",
"url": "https://github.com/mickael-kerjean/filestash/blob/master/server/model/share.go#L132"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2024-3035"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Filestash skips TLS certificate verification process when sending out email verification codes"
}
GHSA-MQFH-36P4-43QX
Vulnerability from github – Published: 2022-07-29 00:00 – Updated: 2022-08-06 00:00When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients. The issue could be exploited by an adversary that places a MITM (Man in the Middle) between a zero client and AWS session provisioner in the network. This issue is only applicable when connecting to an Amazon Workspace from a PCoIP Zero Client.
{
"affected": [],
"aliases": [
"CVE-2022-1805"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-28T15:15:00Z",
"severity": "HIGH"
},
"details": "When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients. The issue could be exploited by an adversary that places a MITM (Man in the Middle) between a zero client and AWS session provisioner in the network. This issue is only applicable when connecting to an Amazon Workspace from a PCoIP Zero Client.",
"id": "GHSA-mqfh-36p4-43qx",
"modified": "2022-08-06T00:00:54Z",
"published": "2022-07-29T00:00:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1805"
},
{
"type": "WEB",
"url": "https://support.hp.com/us-en/document/ish_6545906-6545930-16/hpsbhf03794"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-MQJV-J25Q-VX8X
Vulnerability from github – Published: 2024-04-23 21:30 – Updated: 2024-04-23 21:30A vulnerability was found in EZVIZ CS-C6-21WFR-8 5.2.7 Build 170628. It has been classified as problematic. This affects an unknown part of the component Davinci Application. The manipulation leads to improper certificate validation. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The identifier VDB-261789 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2024-4063"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-23T19:15:46Z",
"severity": "LOW"
},
"details": "A vulnerability was found in EZVIZ CS-C6-21WFR-8 5.2.7 Build 170628. It has been classified as problematic. This affects an unknown part of the component Davinci Application. The manipulation leads to improper certificate validation. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The identifier VDB-261789 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-mqjv-j25q-vx8x",
"modified": "2024-04-23T21:30:33Z",
"published": "2024-04-23T21:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4063"
},
{
"type": "WEB",
"url": "https://github.com/kzLiu2017/CVE_Document/blob/main/CVE_%20advisory_ezviz.pdf"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.261789"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.261789"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.316408"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MQV2-J79J-4GQF
Vulnerability from github – Published: 2021-11-19 00:00 – Updated: 2024-02-27 18:44Improper validation of the cloud certificate chain in Mobile Client allows man-in-the-middle attack to impersonate the legitimate Command Centre Server. This issue affects: Gallagher Command Centre Mobile Client for Android 8.60 versions prior to 8.60.065; version 8.50 and prior versions.
{
"affected": [],
"aliases": [
"CVE-2021-23155"
],
"database_specific": {
"cwe_ids": [
"CWE-295",
"CWE-296"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-18T18:15:00Z",
"severity": "MODERATE"
},
"details": "Improper validation of the cloud certificate chain in Mobile Client allows man-in-the-middle attack to impersonate the legitimate Command Centre Server. This issue affects: Gallagher Command Centre Mobile Client for Android 8.60 versions prior to 8.60.065; version 8.50 and prior versions.",
"id": "GHSA-mqv2-j79j-4gqf",
"modified": "2024-02-27T18:44:57Z",
"published": "2021-11-19T00:00:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23155"
},
{
"type": "WEB",
"url": "https://security.gallagher.com/Security-Advisories/CVE-2021-23155"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Mitigation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
CAPEC-459: Creating a Rogue Certification Authority Certificate
An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.
CAPEC-475: Signature Spoofing by Improper Validation
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.