CWE-295
AllowedImproper Certificate Validation
Abstraction: Base · Status: Draft
The product does not validate, or incorrectly validates, a certificate.
2164 vulnerabilities reference this CWE, most recent first.
GHSA-2VFX-6MJQ-9CCV
Vulnerability from github – Published: 2022-05-17 00:35 – Updated: 2022-05-17 00:35pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon registration.
{
"affected": [],
"aliases": [
"CVE-2015-5263"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-25T21:29:00Z",
"severity": "HIGH"
},
"details": "pulp-consumer-client 2.4.0 through 2.6.3 does not check the server\u0027s TLS certificate signatures when retrieving the server\u0027s public key upon registration.",
"id": "GHSA-2vfx-6mjq-9ccv",
"modified": "2022-05-17T00:35:08Z",
"published": "2022-05-17T00:35:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5263"
},
{
"type": "WEB",
"url": "https://github.com/pulp/pulp/commit/b542d7465f7e6e02e1ea1aec059ac607a65cefe7#diff-17110211f89c042a9267e2167dedd754"
},
{
"type": "WEB",
"url": "https://github.com/pulp/pulp/blob/aa432bf58497b5e3682333b1d5f5ae4f45788a61/client_consumer/pulp/client/consumer/cli.py#L103"
},
{
"type": "WEB",
"url": "http://cve.killedkenny.io/cve/CVE-2015-5263"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2015/09/24/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2VXX-6J6V-P885
Vulnerability from github – Published: 2026-09-09 12:32 – Updated: 2026-09-09 12:32Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.
{
"affected": [],
"aliases": [
"CVE-2026-79637"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-09T12:17:13Z",
"severity": "HIGH"
},
"details": "Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.",
"id": "GHSA-2vxx-6j6v-p885",
"modified": "2026-09-09T12:32:14Z",
"published": "2026-09-09T12:32:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79637"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-in/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-virtual-edition-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-2W9P-8X38-7X8F
Vulnerability from github – Published: 2026-07-29 12:31 – Updated: 2026-07-29 12:31The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
{
"affected": [],
"aliases": [
"CVE-2026-58162"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-29T10:16:41Z",
"severity": "HIGH"
},
"details": "The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI.\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.\n\nUsers are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.",
"id": "GHSA-2w9p-8x38-7x8f",
"modified": "2026-07-29T12:31:21Z",
"published": "2026-07-29T12:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58162"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-2WGW-4X82-63XQ
Vulnerability from github – Published: 2022-05-24 19:20 – Updated: 2022-05-24 19:20FORT Validator versions prior to 1.5.2 will crash if an RPKI CA publishes an X.509 EE certificate. This will lead to RTR clients such as BGP routers to lose access to the RPKI VRP data set, effectively disabling Route Origin Validation.
{
"affected": [],
"aliases": [
"CVE-2021-43114"
],
"database_specific": {
"cwe_ids": [
"CWE-295",
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-09T13:15:00Z",
"severity": "HIGH"
},
"details": "FORT Validator versions prior to 1.5.2 will crash if an RPKI CA publishes an X.509 EE certificate. This will lead to RTR clients such as BGP routers to lose access to the RPKI VRP data set, effectively disabling Route Origin Validation.",
"id": "GHSA-2wgw-4x82-63xq",
"modified": "2022-05-24T19:20:08Z",
"published": "2022-05-24T19:20:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43114"
},
{
"type": "WEB",
"url": "https://github.com/NICMx/FORT-validator/commit/274dc14aed1eb9b3350029d1063578a6b9c77b54"
},
{
"type": "WEB",
"url": "https://github.com/NICMx/FORT-validator/commit/425e0f4037b4543fe8044ac96ca71d6d02d7d8c5"
},
{
"type": "WEB",
"url": "https://github.com/NICMx/FORT-validator/commit/673c679b6bf3f4187cd5242c31a795bf8a6c22b3"
},
{
"type": "WEB",
"url": "https://github.com/NICMx/FORT-validator/commit/eb68ebbaab50f3365aa51bbaa17cb862bf4607fa"
},
{
"type": "WEB",
"url": "https://github.com/NICMx/FORT-validator/releases/tag/1.5.2"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2021/dsa-5033"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2WJM-H2WV-PRMJ
Vulnerability from github – Published: 2022-05-17 02:40 – Updated: 2025-04-20 03:39The MEA Financial vision-bank/id420406345 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
{
"affected": [],
"aliases": [
"CVE-2017-9559"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-16T12:29:00Z",
"severity": "MODERATE"
},
"details": "The MEA Financial vision-bank/id420406345 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.",
"id": "GHSA-2wjm-h2wv-prmj",
"modified": "2025-04-20T03:39:12Z",
"published": "2022-05-17T02:40:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9559"
},
{
"type": "WEB",
"url": "https://medium.com/%40chronic_9612/advisory-44-credit-union-apps-for-ios-may-allow-login-credential-exposure-4d2f380b85c5"
},
{
"type": "WEB",
"url": "https://medium.com/@chronic_9612/advisory-44-credit-union-apps-for-ios-may-allow-login-credential-exposure-4d2f380b85c5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2X53-82M9-JCGF
Vulnerability from github – Published: 2026-07-14 18:32 – Updated: 2026-07-14 18:32Improper certificate validation in Windows Active Directory allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2026-55001"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-14T17:17:07Z",
"severity": "HIGH"
},
"details": "Improper certificate validation in Windows Active Directory allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-2x53-82m9-jcgf",
"modified": "2026-07-14T18:32:09Z",
"published": "2026-07-14T18:32:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55001"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55001"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2X8H-GGXV-WW4J
Vulnerability from github – Published: 2026-02-05 18:30 – Updated: 2026-02-12 18:30An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept and modify encrypted device-cloud communications. This may compromise the confidentiality and integrity of device-to-cloud communication, enabling manipulation of device data or operations.
{
"affected": [],
"aliases": [
"CVE-2025-15557"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-05T18:16:09Z",
"severity": "HIGH"
},
"details": "An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept and modify encrypted device-cloud communications.\u00a0 This may compromise the confidentiality and integrity of device-to-cloud communication, enabling manipulation of device data or operations.",
"id": "GHSA-2x8h-ggxv-ww4j",
"modified": "2026-02-12T18:30:20Z",
"published": "2026-02-05T18:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15557"
},
{
"type": "WEB",
"url": "https://www.tp-link.com/en/support/download/tapo-h100"
},
{
"type": "WEB",
"url": "https://www.tp-link.com/en/support/download/tapo-p100"
},
{
"type": "WEB",
"url": "https://www.tp-link.com/us/support/download/tapo-h100"
},
{
"type": "WEB",
"url": "https://www.tp-link.com/us/support/download/tapo-p100"
},
{
"type": "WEB",
"url": "https://www.tp-link.com/us/support/faq/4949"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-2XGV-7Q8P-67GC
Vulnerability from github – Published: 2026-09-06 18:34 – Updated: 2026-09-08 21:33When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable
standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and
CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on
connections established without a presented server certificate. Bypassing the
pinning check under these disabled-verification conditions allows
unauthenticated connections to succeed when they should be rejected.
{
"affected": [],
"aliases": [
"CVE-2026-80230"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-06T18:17:22Z",
"severity": "HIGH"
},
"details": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected.",
"id": "GHSA-2xgv-7q8p-67gc",
"modified": "2026-09-08T21:33:02Z",
"published": "2026-09-06T18:34:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80230"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/3969300"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2026-80230.html"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2026-80230.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2XVR-QGR6-H5F7
Vulnerability from github – Published: 2022-05-13 01:39 – Updated: 2022-05-13 01:39The Shein Group Ltd. "SHEIN - Fashion Shopping" app -- aka shein fashion-shopping/id878577184 -- for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
{
"affected": [],
"aliases": [
"CVE-2017-14710"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-12T16:29:00Z",
"severity": "MODERATE"
},
"details": "The Shein Group Ltd. \"SHEIN - Fashion Shopping\" app -- aka shein fashion-shopping/id878577184 -- for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.",
"id": "GHSA-2xvr-qgr6-h5f7",
"modified": "2022-05-13T01:39:42Z",
"published": "2022-05-13T01:39:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14710"
},
{
"type": "WEB",
"url": "https://www.crissyfield.de/blog/2017/12/14/missing-certificate-validation"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2XXP-9232-MWJ8
Vulnerability from github – Published: 2022-05-17 19:57 – Updated: 2024-04-03 23:59duplicity 0.6.24 has improper verification of SSL certificates
{
"affected": [],
"aliases": [
"CVE-2014-3495"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-12-13T14:15:00Z",
"severity": "HIGH"
},
"details": "duplicity 0.6.24 has improper verification of SSL certificates",
"id": "GHSA-2xxp-9232-mwj8",
"modified": "2024-04-03T23:59:42Z",
"published": "2022-05-17T19:57:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3495"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/cve-2014-3495"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3495"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2014-3495"
},
{
"type": "WEB",
"url": "https://security-tracker.debian.org/tracker/CVE-2014-3495"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Mitigation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
CAPEC-459: Creating a Rogue Certification Authority Certificate
An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.
CAPEC-475: Signature Spoofing by Improper Validation
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.