CWE-295

{
  "affected": [],
  "aliases": [
    "CVE-2026-41119"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-18T11:16:16Z",
    "severity": "MODERATE"
  },
  "details": "Dell Live Optics Windows and Personal Edition collectors contain an improper certificate validation vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability leading to loss of confidentiality and integrity.",
  "id": "GHSA-58g4-m6h8-h97x",
  "modified": "2026-05-18T12:31:47Z",
  "published": "2026-05-18T12:31:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41119"
    },
    {
      "type": "WEB",
      "url": "https://www.dell.com/support/kbdoc/en-us/000464862/dsa-2026-221-security-update-for-dell-live-optics-collector-ssl-vulnerability"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-12228"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-09-29T01:34:00Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the Cisco Network Plug and Play application of Cisco IOS 12.4 through 15.6 and Cisco IOS XE 3.3 through 16.4 could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data by using an invalid certificate. The vulnerability is due to insufficient certificate validation by the affected software. An attacker could exploit this vulnerability by supplying a crafted certificate to an affected device. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt confidential information on user connections to the affected software. Cisco Bug IDs: CSCvc33171.",
  "id": "GHSA-58h4-9j5q-gmvr",
  "modified": "2022-05-13T01:38:12Z",
  "published": "2022-05-13T01:38:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12228"
    },
    {
      "type": "WEB",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-pnp"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/101065"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1039450"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2016-1184"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-04-21T14:59:00Z",
    "severity": "MODERATE"
  },
  "details": "Tokyo Star bank App for Android before 1.4 and Tokyo Star bank App for iOS before 1.4 do not validate SSL certificates.",
  "id": "GHSA-58jg-fmcg-gcx4",
  "modified": "2022-05-13T01:06:06Z",
  "published": "2022-05-13T01:06:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1184"
    },
    {
      "type": "WEB",
      "url": "http://jvn.jp/en/jp/JVN00272277/index.html"
    },
    {
      "type": "WEB",
      "url": "http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000049.html"
    },
    {
      "type": "WEB",
      "url": "http://www.tokyostarbank.co.jp/important151222.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2015-4680"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-04-05T17:59:00Z",
    "severity": "HIGH"
  },
  "details": "FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.",
  "id": "GHSA-58q5-m5pm-jwpv",
  "modified": "2022-05-14T02:48:27Z",
  "published": "2022-05-14T02:48:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-4680"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1234975"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00010.html"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/132415/FreeRADIUS-Insufficient-CRL-Application.html"
    },
    {
      "type": "WEB",
      "url": "http://www.ocert.org/advisories/ocert-2015-008.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/535810/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/75327"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1032690"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/argoproj-labs/terraform-provider-argocd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.3-0.20260316182343-b3364f3f32e7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395",
      "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-18T12:59:01Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe terraform-provider-argocd might have been vulnerable to GO-2026-4337 / CVE-2025-68121 (\"Unexpected session resumption in crypto/tls\").\n\n### Details\n\nSee https://pkg.go.dev/vuln/GO-2026-4337 for the upstream vulnerability.\n\nProvider versions starting with `v7.15.1` are using `go 1.25.8` for building and are thus no longer affected.",
  "id": "GHSA-594f-3595-c47v",
  "modified": "2026-03-18T12:59:01Z",
  "published": "2026-03-18T12:59:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/argoproj-labs/terraform-provider-argocd/security/advisories/GHSA-594f-3595-c47v"
    },
    {
      "type": "WEB",
      "url": "https://github.com/argoproj-labs/terraform-provider-argocd/commit/b3364f3f32e70f1563c5f3162d370db704430294"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/argoproj-labs/terraform-provider-argocd"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121"
}

{
  "affected": [],
  "aliases": [
    "CVE-2015-7785"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-09-25T21:29:00Z",
    "severity": "MODERATE"
  },
  "details": "GANMA! App for iOS does not verify SSL certificates.",
  "id": "GHSA-5957-vgcr-mr9h",
  "modified": "2022-05-17T00:34:48Z",
  "published": "2022-05-17T00:34:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7785"
    },
    {
      "type": "WEB",
      "url": "http://jvn.jp/en/jp/JVN44541100/index.html"
    },
    {
      "type": "WEB",
      "url": "http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000191.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-2800"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-05-24T14:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting in potential certificate validation vulnerabilities, denial of service and possible remote code execution. In order to trigger this vulnerability, the attacker needs to supply a malicious x509 certificate to either a server or a client application using this library.",
  "id": "GHSA-59h3-rq7p-jqmv",
  "modified": "2025-04-20T03:38:12Z",
  "published": "2022-05-13T01:01:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2800"
    },
    {
      "type": "WEB",
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2017-0293"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/41984"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-0042"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295",
      "CWE-843"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-07T21:15:08Z",
    "severity": "MODERATE"
  },
  "details": "In TBD of TBD, there is a possible confusion of OEM and DRM certificates due to improperly used crypto. This could lead to local bypass of DRM content protection with no additional execution privileges needed. User interaction is not needed for exploitation.",
  "id": "GHSA-59j5-r3pj-3q9p",
  "modified": "2024-07-03T18:39:46Z",
  "published": "2024-05-07T21:31:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0042"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2024-04-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-3738"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-13T18:15:07Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability classified as critical has been found in cym1102 nginxWebUI up to 3.9.9. This affects the function handlePath of the file /adminPage/conf/saveCmd. The manipulation of the argument nginxPath leads to improper certificate validation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260577 was assigned to this vulnerability.",
  "id": "GHSA-59pp-9g34-44f9",
  "modified": "2024-04-13T18:30:50Z",
  "published": "2024-04-13T18:30:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3738"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cym1102/nginxWebUI/issues/138"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cym1102/nginxWebUI/files/14818455/nginxwebui.rce.3.9.9.pdf"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.260577"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.260577"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.keycloak:keycloak-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "21.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-1664"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-06-30T20:30:30Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "A flaw was found in keycloak-core. This flaw considers the scenario when using X509 Client Certificate Authenticatior with the option \"Revalidate Client Certificate\". A user may be able to choose, if directly connect to keycloak (not passing via reverse proxy) a specific certificate. If there\u0027s a configuration error in KC_SPI_TRUSTSTORE_FILE_FILE the authenticator allows even with the \"Cannot validate client certificate trust: Truststore not available\" message as there\u0027s no certificate to trust against.",
  "id": "GHSA-5cc8-pgp5-7mpm",
  "modified": "2023-06-30T20:30:30Z",
  "published": "2023-06-30T20:30:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-5cc8-pgp5-7mpm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1664"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2023-1664"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182196\u0026comment#0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/keycloak/keycloak"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Keycloak Untrusted Certificate Validation vulnerability"
}