CWE-295 · Cryptography
Improper Certificate Validation
1,654CVEs
5exploited
0with a public check
8likely (EPSS 10%+)
SortMost likely exploited
1,654 CVEs with CWE-295 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2020-0601In CISA KEVExploitedA spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by…Microsoft · Windows · CVSS 8.1 · 2020-01-14 | 8.1 | 89% | 2020-01-14 |
| CVE-2022-26923In CISA KEVExploitedActive Directory Domain Services Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 8.8 · 2022-05-10 | 8.8 | 84% | 2022-05-10 |
| CVE-2026-85102In CISA KEVExploitedImproper Certificate Validation in Quantum Security Gatewaycheckpoint · Quantum Security Gateway · CVSS 9.8 · 2026-09-09 | 9.8 | 54% | 2026-09-09 |
| CVE-2023-41991In CISA KEVExploitedA certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Appl…Apple · iOS and iPadOS · CVSS 5.5 · 2023-09-21 | 5.5 | 13% | 2023-09-21 |
| CVE-2023-20963In CISA KEVExploitedIn WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed…Android · Android · CVSS 7.8 · 2023-03-24 | 7.8 | 1.5% | 2023-03-24 |
| CVE-2015-4000The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-m…Openssl · Openssl · CVSS 3.7 · 2015-05-21 | 3.7 | 100% | 2015-05-21 |
| CVE-2023-27823An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials.Optoma · 1080pstx · CVSS 9.8 · 2023-05-12 | 9.8 | 54% | 2023-05-12 |
| CVE-2018-8034The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31,…Apache Software Foundation · Apache Tomcat · CVSS 7.5 · 2018-08-01 | 7.5 | 21% | 2018-08-01 |
| CVE-2019-15604Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificateNodeJS · Node · 2020-02-07 | – | 20% | 2020-02-07 |
| CVE-2021-3450CA certificate check bypass with X509_V_FLAG_X509_STRICTOpenSSL · OpenSSL · 2021-03-25 | – | 18% | 2021-03-25 |
| CVE-2002-0862The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 throu…Microsoft · Internet Explorer · 2002-09-10 | – | 16% | 2002-09-10 |
| CVE-2021-22939If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expire…NodeJS · Node · 2021-08-16 | – | 15% | 2021-08-16 |
| CVE-2017-5653JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to sp…Apache Software Foundation · Apache CXF · 2017-04-18 | – | 11% | 2017-04-18 |
| CVE-2021-44533Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a si…NodeJS · Node · 2022-02-24 | – | 9.4% | 2022-02-24 |
| CVE-2012-5783Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain na…Apache · Httpclient · 2012-11-04 | – | 9.3% | 2012-11-04 |
| CVE-2017-2800A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting in potential certificate validation vulnerabilities, denia…wolfSSL · wolfSSL · CVSS 8.1 · 2017-05-24 | 8.1 | 8.5% | 2017-05-24 |
| CVE-2021-44531Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates…NodeJS · Node · 2022-02-24 | – | 8.4% | 2022-02-24 |
| CVE-2020-9488Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which cou…Apache · Apache Log4j · CVSS 3.7 · 2020-04-27 | 3.7 | 8.2% | 2020-04-27 |
| CVE-2018-1320Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An asser…Apache Software Foundation · Apache Thrift · 2019-01-07 | – | 8.2% | 2019-01-07 |
| CVE-2017-0129Microsoft Lync for Mac 2011 fails to properly validate certificates, allowing remote attackers to alter server-client communications, aka "Microsoft Lync for Mac Certificate Valid…Microsoft Corporation · Lync for Mac · 2017-03-17 | – | 7.9% | 2017-03-17 |
| CVE-2016-1252The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and…Debian · Advanced Package Tool · 2017-12-05 | – | 7.2% | 2017-12-05 |
| CVE-2015-3152Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows ma…Oracle · Mysql · 2016-05-16 | – | 7.1% | 2016-05-16 |
| CVE-2021-34558The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key excha…Golang · Go · 2021-07-15 | – | 7.0% | 2021-07-15 |
| CVE-2018-11775TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using…Apache Software Foundation · Apache ActiveMQ · 2018-09-10 | – | 7.0% | 2018-09-10 |
| CVE-2026-42508Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhostsgolang.org/x/crypto · golang.org/x/crypto/ssh/knownhosts · CVSS 9.1 · 2026-05-22 | 9.1 | 6.9% | 2026-05-22 |
| CVE-2018-17612Sennheiser HeadSetup 7.3.4903 places Certification Authority (CA) certificates into the Trusted Root CA store of the local system, and publishes the private key in the SennComCCKe…Sennheiser · Headsetup · 2018-11-09 | – | 6.7% | 2018-11-09 |
| CVE-2020-1113Windows Task Scheduler Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 5.3 · 2020-05-21 | 5.3 | 6.3% | 2020-05-21 |
| CVE-2018-6221An unvalidated software update vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a man-in-the-middle attacker to tamper with an update file and inject their ow…Trend Micro · Trend Micro Email Encryption Gateway · 2018-03-15 | – | 6.1% | 2018-03-15 |
| CVE-2020-13254An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could re…Djangoproject · Django · 2020-06-03 | – | 6.1% | 2020-06-03 |
| CVE-2019-1006An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAML tokens with arbitrary symme…Microsoft · Windows · 2019-07-15 | – | 6.1% | 2019-07-15 |
| CVE-2020-8172TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.Nodejs · https://github.com/nodejs/node · 2020-06-08 | – | 6.1% | 2020-06-08 |
| CVE-2014-1266The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6…Apple · Iphone Os · 2014-02-22 | – | 5.7% | 2014-02-22 |
| CVE-2009-2408Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a…Mozilla · Firefox · 2009-07-30 | – | 5.7% | 2009-07-30 |
| CVE-2017-0248Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is inv…Microsoft Corporation · Microsoft .NET Framework · 2017-05-12 | – | 5.5% | 2017-05-12 |
| CVE-2017-11770.NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly parsing certificate da…Microsoft Corporation · .NET Core · 2017-11-15 | – | 5.4% | 2017-11-15 |
| CVE-2018-12829Adobe Creative Cloud Desktop Application before 4.6.1 has an improper certificate validation vulnerability. Successful exploitation could lead to privilege escalation.Adobe · Adobe Creative Cloud Desktop Application before 4.6.1 · 2018-08-29 | – | 5.0% | 2018-08-29 |
| CVE-2022-22946In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an i…Vmware · Spring Cloud Gateway · 2022-03-04 | – | 4.8% | 2022-03-04 |
| CVE-2026-50752Certificate Validation Bypass in VPN Site-to-Site Connections Using IKEv1checkpoint · Quantum Security Gateway · CVSS 7.4 · 2026-06-08 | 7.4 | 4.7% | 2026-06-08 |
| CVE-2020-8289Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in `bztransmit` helper due to hardcoded whitelist of st…Backblaze · Backblaze · 2020-12-27 | – | 4.7% | 2020-12-27 |
| CVE-2020-8286curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.Haxx · https://github.com/curl/curl · 2020-12-14 | – | 4.6% | 2020-12-14 |
| CVE-2003-1229X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01, (2) JSSE before 1.0.3, (3) Java Plug-in SDK and JRE 1.3.0 through 1.4.1, and (4)…Sun · Java Web Start · 2005-08-17 | – | 4.6% | 2005-08-17 |
| CVE-2020-28907Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to download of an untrust…Nagios · Fusion · 2021-05-24 | – | 4.5% | 2021-05-24 |
| CVE-2009-2409The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.5…Openssl · Openssl · 2009-07-30 | – | 4.3% | 2009-07-30 |
| CVE-2018-8020Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple entries) of certificate st…Apache Software Foundation · Apache Tomcat Native · 2018-07-31 | – | 4.2% | 2018-07-31 |
| CVE-2018-8019When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to…Apache Software Foundation · Apache Tomcat Native · 2018-07-31 | – | 4.0% | 2018-07-31 |
| CVE-2021-33907The Zoom Client for Meetings for Windows in all versions before 5.3.0 fails to properly validate the certificate information used to sign .msi files when performing an update of t…Zoom · Zoom Client for Meetings for Windows · 2021-09-27 | – | 4.0% | 2021-09-27 |
| CVE-2023-0464Excessive Resource Usage Verifying X.509 Policy ConstraintsOpenSSL · OpenSSL · CVSS 7.5 · 2023-03-22 | 7.5 | 4.0% | 2023-03-22 |
| CVE-2020-3342Cisco Webex Meetings Desktop App for Mac Update Feature Code Execution VulnerabilityCisco · Cisco WebEx Meetings Server · CVSS 8.8 · 2020-06-18 | 8.8 | 3.9% | 2020-06-18 |
| CVE-2018-4991Adobe Creative Cloud Desktop Application versions 4.4.1.298 and earlier have an exploitable Improper certificate validation vulnerability. Successful exploitation could lead to a…Adobe · Creative Cloud Desktop Application 4.4.1.298 and earlier versions · 2018-05-19 | – | 3.9% | 2018-05-19 |
| CVE-2018-6219An Insecure Update via HTTP vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to eavesdrop and tamper with certain types of update data.Trend Micro · Trend Micro Email Encryption Gateway · 2018-03-15 | – | 3.9% | 2018-03-15 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.