CWE-295
AllowedImproper Certificate Validation
Abstraction: Base · Status: Draft
The product does not validate, or incorrectly validates, a certificate.
2243 vulnerabilities reference this CWE, most recent first.
GHSA-P6Q5-CMW8-PQQG
Vulnerability from github – Published: 2026-10-04 18:30 – Updated: 2026-10-04 18:30go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic, including authentication tokens and credentials.
{
"affected": [],
"aliases": [
"CVE-2026-105216"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-04T18:16:34Z",
"severity": "CRITICAL"
},
"details": "go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic, including authentication tokens and credentials.",
"id": "GHSA-p6q5-cmw8-pqqg",
"modified": "2026-10-04T18:30:21Z",
"published": "2026-10-04T18:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105216"
},
{
"type": "WEB",
"url": "https://github.com/micro/go-micro/issues/2963"
},
{
"type": "WEB",
"url": "https://github.com/micro/go-micro/commit/c7657f73f45cf839e643db10f28703eeab7299c3"
},
{
"type": "WEB",
"url": "https://github.com/micro/go-micro"
},
{
"type": "WEB",
"url": "https://github.com/micro/go-micro/blob/v5.30.0/internal/util/tls/tls.go#L43-L67"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/go-micro-before-6.0.0-disabled-tls-certificate-verification-via-tls-config-helper"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-P75Q-98C9-C3H5
Vulnerability from github – Published: 2022-05-24 19:04 – Updated: 2022-05-24 19:04While processing server certificate from IPSec server, certificate validation for subject alternative name API can cause heap overflow which can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile
{
"affected": [],
"aliases": [
"CVE-2020-11176"
],
"database_specific": {
"cwe_ids": [
"CWE-295",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-09T07:15:00Z",
"severity": "CRITICAL"
},
"details": "While processing server certificate from IPSec server, certificate validation for subject alternative name API can cause heap overflow which can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile",
"id": "GHSA-p75q-98c9-c3h5",
"modified": "2022-05-24T19:04:42Z",
"published": "2022-05-24T19:04:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11176"
},
{
"type": "WEB",
"url": "https://www.qualcomm.com/company/product-security/bulletins/june-2021-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-P75R-F57H-PG5W
Vulnerability from github – Published: 2022-05-24 17:13 – Updated: 2024-01-23 18:31X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.509 certificates are unaffected.
{
"affected": [],
"aliases": [
"CVE-2020-7922"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-04-09T18:15:00Z",
"severity": "MODERATE"
},
"details": "X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.509 certificates are unaffected.",
"id": "GHSA-p75r-f57h-pg5w",
"modified": "2024-01-23T18:31:08Z",
"published": "2022-05-24T17:13:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7922"
},
{
"type": "WEB",
"url": "https://github.com/mongodb/mongodb-enterprise-kubernetes/releases/tag/1.2.5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P774-6CP5-X7CJ
Vulnerability from github – Published: 2024-01-31 21:31 – Updated: 2024-01-31 21:31In Zscaler Internet Access (ZIA) a mismatch between Connect Host and Client Hello's Server Name Indication (SNI) enables attackers to evade network security controls by hiding their communications within legitimate traffic.
{
"affected": [],
"aliases": [
"CVE-2023-28807"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-31T20:15:44Z",
"severity": "MODERATE"
},
"details": "In Zscaler Internet Access (ZIA) a mismatch between Connect Host and Client Hello\u0027s Server Name Indication (SNI) enables attackers to evade network security controls by hiding their communications within legitimate traffic.",
"id": "GHSA-p774-6cp5-x7cj",
"modified": "2024-01-31T21:31:03Z",
"published": "2024-01-31T21:31:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28807"
},
{
"type": "WEB",
"url": "https://help.zscaler.com/zia/configuring-advanced-settings#dns-optimization"
},
{
"type": "WEB",
"url": "https://help.zscaler.com/zia/configuring-advanced-settings#domain-fronting"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P788-RJ37-357W
Vulnerability from github – Published: 2020-09-01 15:26 – Updated: 2021-09-23 21:28Affected versions of ezseed-transmission download and run a script over an HTTP connection.
An attacker in a privileged network position could launch a Man-in-the-Middle attack and intercept the script, replacing it with malicious code, completely compromising the system running ezseed-transmission.
Recommendation
Update to version 0.0.15 or later.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.0.14"
},
"package": {
"ecosystem": "npm",
"name": "ezseed-transmission"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.10"
},
{
"fixed": "0.0.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-1000224"
],
"database_specific": {
"cwe_ids": [
"CWE-295",
"CWE-300"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:11:16Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "Affected versions of `ezseed-transmission` download and run a script over an HTTP connection.\n\nAn attacker in a privileged network position could launch a Man-in-the-Middle attack and intercept the script, replacing it with malicious code, completely compromising the system running `ezseed-transmission`.\n\n\n\n## Recommendation\n\nUpdate to version 0.0.15 or later.",
"id": "GHSA-p788-rj37-357w",
"modified": "2021-09-23T21:28:12Z",
"published": "2020-09-01T15:26:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1000224"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/npm:ezseed-transmission:20160729"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/114"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Insecure Defaults Leads to Potential MITM in ezseed-transmission"
}
GHSA-P7PQ-M3XX-W733
Vulnerability from github – Published: 2022-05-14 03:22 – Updated: 2022-05-14 03:22X509 certificate verification was not correctly implemented in the IP Intelligence Subscription and IP Intelligence feed-list features, and thus the remote server's identity is not properly validated in F5 BIG-IP 12.0.0-12.1.2, 11.6.0-11.6.2, or 11.5.0-11.5.5.
{
"affected": [],
"aliases": [
"CVE-2017-6143"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-13T13:29:00Z",
"severity": "MODERATE"
},
"details": "X509 certificate verification was not correctly implemented in the IP Intelligence Subscription and IP Intelligence feed-list features, and thus the remote server\u0027s identity is not properly validated in F5 BIG-IP 12.0.0-12.1.2, 11.6.0-11.6.2, or 11.5.0-11.5.5.",
"id": "GHSA-p7pq-m3xx-w733",
"modified": "2022-05-14T03:22:27Z",
"published": "2022-05-14T03:22:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6143"
},
{
"type": "WEB",
"url": "https://support.f5.com/csp/article/K11464209"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P7QF-9C5Q-FW2W
Vulnerability from github – Published: 2025-04-08 09:31 – Updated: 2025-04-08 09:31A vulnerability has been identified in Siemens License Server (SLS) (All versions < V4.3). The affected application does not properly restrict permissions of the users. This could allow a lowly-privileged attacker to escalate their privileges.
{
"affected": [],
"aliases": [
"CVE-2025-30000"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-08T09:15:27Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been identified in Siemens License Server (SLS) (All versions \u003c V4.3). The affected application does not properly restrict permissions of the users. This could allow a lowly-privileged attacker to escalate their privileges.",
"id": "GHSA-p7qf-9c5q-fw2w",
"modified": "2025-04-08T09:31:13Z",
"published": "2025-04-08T09:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30000"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-525431.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-P7QR-V5JX-7QV3
Vulnerability from github – Published: 2022-05-14 02:48 – Updated: 2025-04-12 13:00Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, aka a "BACKRONYM" attack.
{
"affected": [],
"aliases": [
"CVE-2015-3152"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-05-16T10:59:00Z",
"severity": "MODERATE"
},
"details": "Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, aka a \"BACKRONYM\" attack.",
"id": "GHSA-p7qr-v5jx-7qv3",
"modified": "2025-04-12T13:00:03Z",
"published": "2022-05-14T02:48:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3152"
},
{
"type": "WEB",
"url": "https://github.com/mysql/mysql-server/commit/3bd5589e1a5a93f9c224badf983cd65c45215390"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/cve-2015-3152"
},
{
"type": "WEB",
"url": "https://jira.mariadb.org/browse/MDEV-7937"
},
{
"type": "WEB",
"url": "https://www.duosecurity.com/blog/backronym-mysql-vulnerability"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161436.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161625.html"
},
{
"type": "WEB",
"url": "http://mysqlblog.fivefarmers.com/2014/04/02/redefining-ssl-option"
},
{
"type": "WEB",
"url": "http://mysqlblog.fivefarmers.com/2015/04/29/ssltls-in-5-6-and-5-5-ocert-advisory"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/131688/MySQL-SSL-TLS-Downgrade.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1646.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1647.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1665.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2015/dsa-3311"
},
{
"type": "WEB",
"url": "http://www.ocert.org/advisories/ocert-2015-003.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/535397/100/1100/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/74398"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1032216"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P7W9-8MXW-P3G7
Vulnerability from github – Published: 2022-02-17 00:00 – Updated: 2022-03-01 18:36Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "cn.hutool:hutool-http"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.7.19"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-22885"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2022-02-17T23:30:58Z",
"nvd_published_at": "2022-02-16T22:15:00Z",
"severity": "CRITICAL"
},
"details": "Hutool v5.7.18\u0027s HttpRequest was discovered to ignore all TLS/SSL certificate validation.",
"id": "GHSA-p7w9-8mxw-p3g7",
"modified": "2022-03-01T18:36:44Z",
"published": "2022-02-17T00:00:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22885"
},
{
"type": "WEB",
"url": "https://github.com/dromara/hutool/issues/2042"
},
{
"type": "WEB",
"url": "https://apidoc.gitee.com/dromara/hutool/cn/hutool/http/ssl/DefaultSSLInfo.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/dromara/hutool"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Certificate Validation in Hutool"
}
GHSA-P8HP-P5RW-J34R
Vulnerability from github – Published: 2022-05-24 19:11 – Updated: 2022-05-24 19:11In GNOME libgda through 6.0.0, gda-web-provider.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.
{
"affected": [],
"aliases": [
"CVE-2021-39359"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-22T19:15:00Z",
"severity": "MODERATE"
},
"details": "In GNOME libgda through 6.0.0, gda-web-provider.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.",
"id": "GHSA-p8hp-p5rw-j34r",
"modified": "2022-05-24T19:11:52Z",
"published": "2022-05-24T19:11:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39359"
},
{
"type": "WEB",
"url": "https://github.com/GNOME/libgda/commit/bd7b9568bcd9f6d3e6680bb04323a670c842a62d"
},
{
"type": "WEB",
"url": "https://blogs.gnome.org/mcatanzaro/2021/05/25/reminder-soupsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/libgda/-/issues/249"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRPPP47WRCAPAEJGRMEKYYJZBQCYXTLQ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLMVVIJNY5NMOT3FH36RFBWOTPVW7GME"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HRPPP47WRCAPAEJGRMEKYYJZBQCYXTLQ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLMVVIJNY5NMOT3FH36RFBWOTPVW7GME"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Mitigation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
CAPEC-459: Creating a Rogue Certification Authority Certificate
An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.
CAPEC-475: Signature Spoofing by Improper Validation
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.