CWE-295
AllowedImproper Certificate Validation
Abstraction: Base · Status: Draft
The product does not validate, or incorrectly validates, a certificate.
1914 vulnerabilities reference this CWE, most recent first.
GHSA-58H4-9J5Q-GMVR
Vulnerability from github – Published: 2022-05-13 01:38 – Updated: 2022-05-13 01:38A vulnerability in the Cisco Network Plug and Play application of Cisco IOS 12.4 through 15.6 and Cisco IOS XE 3.3 through 16.4 could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data by using an invalid certificate. The vulnerability is due to insufficient certificate validation by the affected software. An attacker could exploit this vulnerability by supplying a crafted certificate to an affected device. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt confidential information on user connections to the affected software. Cisco Bug IDs: CSCvc33171.
{
"affected": [],
"aliases": [
"CVE-2017-12228"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-29T01:34:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the Cisco Network Plug and Play application of Cisco IOS 12.4 through 15.6 and Cisco IOS XE 3.3 through 16.4 could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data by using an invalid certificate. The vulnerability is due to insufficient certificate validation by the affected software. An attacker could exploit this vulnerability by supplying a crafted certificate to an affected device. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt confidential information on user connections to the affected software. Cisco Bug IDs: CSCvc33171.",
"id": "GHSA-58h4-9j5q-gmvr",
"modified": "2022-05-13T01:38:12Z",
"published": "2022-05-13T01:38:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12228"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-pnp"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/101065"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1039450"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-58JG-FMCG-GCX4
Vulnerability from github – Published: 2022-05-13 01:06 – Updated: 2022-05-13 01:06Tokyo Star bank App for Android before 1.4 and Tokyo Star bank App for iOS before 1.4 do not validate SSL certificates.
{
"affected": [],
"aliases": [
"CVE-2016-1184"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-04-21T14:59:00Z",
"severity": "MODERATE"
},
"details": "Tokyo Star bank App for Android before 1.4 and Tokyo Star bank App for iOS before 1.4 do not validate SSL certificates.",
"id": "GHSA-58jg-fmcg-gcx4",
"modified": "2022-05-13T01:06:06Z",
"published": "2022-05-13T01:06:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1184"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN00272277/index.html"
},
{
"type": "WEB",
"url": "http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000049.html"
},
{
"type": "WEB",
"url": "http://www.tokyostarbank.co.jp/important151222.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-58Q5-M5PM-JWPV
Vulnerability from github – Published: 2022-05-14 02:48 – Updated: 2022-05-14 02:48FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.
{
"affected": [],
"aliases": [
"CVE-2015-4680"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-04-05T17:59:00Z",
"severity": "HIGH"
},
"details": "FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.",
"id": "GHSA-58q5-m5pm-jwpv",
"modified": "2022-05-14T02:48:27Z",
"published": "2022-05-14T02:48:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-4680"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1234975"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00010.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/132415/FreeRADIUS-Insufficient-CRL-Application.html"
},
{
"type": "WEB",
"url": "http://www.ocert.org/advisories/ocert-2015-008.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/535810/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/75327"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1032690"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-594F-3595-C47V
Vulnerability from github – Published: 2026-03-18 12:59 – Updated: 2026-03-18 12:59Summary
The terraform-provider-argocd might have been vulnerable to GO-2026-4337 / CVE-2025-68121 ("Unexpected session resumption in crypto/tls").
Details
See https://pkg.go.dev/vuln/GO-2026-4337 for the upstream vulnerability.
Provider versions starting with v7.15.1 are using go 1.25.8 for building and are thus no longer affected.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/argoproj-labs/terraform-provider-argocd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.3-0.20260316182343-b3364f3f32e7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1395",
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-18T12:59:01Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\nThe terraform-provider-argocd might have been vulnerable to GO-2026-4337 / CVE-2025-68121 (\"Unexpected session resumption in crypto/tls\").\n\n### Details\n\nSee https://pkg.go.dev/vuln/GO-2026-4337 for the upstream vulnerability.\n\nProvider versions starting with `v7.15.1` are using `go 1.25.8` for building and are thus no longer affected.",
"id": "GHSA-594f-3595-c47v",
"modified": "2026-03-18T12:59:01Z",
"published": "2026-03-18T12:59:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/argoproj-labs/terraform-provider-argocd/security/advisories/GHSA-594f-3595-c47v"
},
{
"type": "WEB",
"url": "https://github.com/argoproj-labs/terraform-provider-argocd/commit/b3364f3f32e70f1563c5f3162d370db704430294"
},
{
"type": "PACKAGE",
"url": "https://github.com/argoproj-labs/terraform-provider-argocd"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121"
}
GHSA-5957-VGCR-MR9H
Vulnerability from github – Published: 2022-05-17 00:34 – Updated: 2022-05-17 00:34GANMA! App for iOS does not verify SSL certificates.
{
"affected": [],
"aliases": [
"CVE-2015-7785"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-25T21:29:00Z",
"severity": "MODERATE"
},
"details": "GANMA! App for iOS does not verify SSL certificates.",
"id": "GHSA-5957-vgcr-mr9h",
"modified": "2022-05-17T00:34:48Z",
"published": "2022-05-17T00:34:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7785"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN44541100/index.html"
},
{
"type": "WEB",
"url": "http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000191.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-59H3-RQ7P-JQMV
Vulnerability from github – Published: 2022-05-13 01:01 – Updated: 2025-04-20 03:38A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting in potential certificate validation vulnerabilities, denial of service and possible remote code execution. In order to trigger this vulnerability, the attacker needs to supply a malicious x509 certificate to either a server or a client application using this library.
{
"affected": [],
"aliases": [
"CVE-2017-2800"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-24T14:29:00Z",
"severity": "CRITICAL"
},
"details": "A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting in potential certificate validation vulnerabilities, denial of service and possible remote code execution. In order to trigger this vulnerability, the attacker needs to supply a malicious x509 certificate to either a server or a client application using this library.",
"id": "GHSA-59h3-rq7p-jqmv",
"modified": "2025-04-20T03:38:12Z",
"published": "2022-05-13T01:01:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2800"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2017-0293"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/41984"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-59J5-R3PJ-3Q9P
Vulnerability from github – Published: 2024-05-07 21:31 – Updated: 2024-07-03 18:39In TBD of TBD, there is a possible confusion of OEM and DRM certificates due to improperly used crypto. This could lead to local bypass of DRM content protection with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"affected": [],
"aliases": [
"CVE-2024-0042"
],
"database_specific": {
"cwe_ids": [
"CWE-295",
"CWE-843"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-07T21:15:08Z",
"severity": "MODERATE"
},
"details": "In TBD of TBD, there is a possible confusion of OEM and DRM certificates due to improperly used crypto. This could lead to local bypass of DRM content protection with no additional execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-59j5-r3pj-3q9p",
"modified": "2024-07-03T18:39:46Z",
"published": "2024-05-07T21:31:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0042"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-04-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-59PP-9G34-44F9
Vulnerability from github – Published: 2024-04-13 18:30 – Updated: 2024-04-13 18:30A vulnerability classified as critical has been found in cym1102 nginxWebUI up to 3.9.9. This affects the function handlePath of the file /adminPage/conf/saveCmd. The manipulation of the argument nginxPath leads to improper certificate validation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260577 was assigned to this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2024-3738"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-13T18:15:07Z",
"severity": "HIGH"
},
"details": "A vulnerability classified as critical has been found in cym1102 nginxWebUI up to 3.9.9. This affects the function handlePath of the file /adminPage/conf/saveCmd. The manipulation of the argument nginxPath leads to improper certificate validation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260577 was assigned to this vulnerability.",
"id": "GHSA-59pp-9g34-44f9",
"modified": "2024-04-13T18:30:50Z",
"published": "2024-04-13T18:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3738"
},
{
"type": "WEB",
"url": "https://github.com/cym1102/nginxWebUI/issues/138"
},
{
"type": "WEB",
"url": "https://github.com/cym1102/nginxWebUI/files/14818455/nginxwebui.rce.3.9.9.pdf"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.260577"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.260577"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-5CC8-PGP5-7MPM
Vulnerability from github – Published: 2023-06-30 20:30 – Updated: 2023-06-30 20:30A flaw was found in keycloak-core. This flaw considers the scenario when using X509 Client Certificate Authenticatior with the option "Revalidate Client Certificate". A user may be able to choose, if directly connect to keycloak (not passing via reverse proxy) a specific certificate. If there's a configuration error in KC_SPI_TRUSTSTORE_FILE_FILE the authenticator allows even with the "Cannot validate client certificate trust: Truststore not available" message as there's no certificate to trust against.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "21.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-1664"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2023-06-30T20:30:30Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "A flaw was found in keycloak-core. This flaw considers the scenario when using X509 Client Certificate Authenticatior with the option \"Revalidate Client Certificate\". A user may be able to choose, if directly connect to keycloak (not passing via reverse proxy) a specific certificate. If there\u0027s a configuration error in KC_SPI_TRUSTSTORE_FILE_FILE the authenticator allows even with the \"Cannot validate client certificate trust: Truststore not available\" message as there\u0027s no certificate to trust against.",
"id": "GHSA-5cc8-pgp5-7mpm",
"modified": "2023-06-30T20:30:30Z",
"published": "2023-06-30T20:30:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-5cc8-pgp5-7mpm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1664"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-1664"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182196\u0026comment#0"
},
{
"type": "PACKAGE",
"url": "https://github.com/keycloak/keycloak"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Keycloak Untrusted Certificate Validation vulnerability"
}
GHSA-5CGQ-3RG8-M6CV
Vulnerability from github – Published: 2026-06-25 22:22 – Updated: 2026-07-17 15:32Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "golang.org/x/crypto"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.52.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-42508"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-25T22:22:04Z",
"nvd_published_at": "2026-05-22T04:16:25Z",
"severity": "CRITICAL"
},
"details": "Previously, a revoked \u0027SignatureKey\u0027 belonging to a CA was not correctly checked for revocation. Now, both the \u0027key\u0027 and \u0027key.SignatureKey\u0027 are checked for @revoked.",
"id": "GHSA-5cgq-3rg8-m6cv",
"modified": "2026-07-17T15:32:15Z",
"published": "2026-06-25T22:22:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42508.json"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2026-5021"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"type": "WEB",
"url": "https://go.dev/issue/79568"
},
{
"type": "WEB",
"url": "https://go.dev/cl/781220"
},
{
"type": "PACKAGE",
"url": "https://cs.opensource.google/go/x/crypto"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480688"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-42508"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:41066"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:41064"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:41036"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:41031"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:41019"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:40945"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:40262"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:40138"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:40118"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:37387"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:37123"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:37072"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36808"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36797"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36796"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36651"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36648"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:35833"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26547"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26546"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:23264"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:23262"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status"
}
Mitigation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Mitigation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
CAPEC-459: Creating a Rogue Certification Authority Certificate
An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.
CAPEC-475: Signature Spoofing by Improper Validation
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.