CWE-295

{
  "affected": [],
  "aliases": [
    "CVE-2024-27440"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-13T06:15:52Z",
    "severity": "MODERATE"
  },
  "details": "The Toyoko Inn official App for iOS versions prior to 1.13.0 and Toyoko Inn official App for Android versions prior 1.3.14 don\u0027t properly verify server certificates, which allows a man-in-the-middle attacker to spoof servers and obtain sensitive information via a crafted certificate.",
  "id": "GHSA-6h99-8764-6j4p",
  "modified": "2024-08-05T15:30:50Z",
  "published": "2024-03-13T06:30:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27440"
    },
    {
      "type": "WEB",
      "url": "https://apps.apple.com/jp/app/%E3%83%9B%E3%83%86%E3%83%AB%E6%9D%B1%E6%A8%AAinn-%E6%9D%B1%E6%A8%AA%E3%82%A4%E3%83%B3-%E5%85%AC%E5%BC%8F%E3%82%A2%E3%83%97%E3%83%AA/id1439388270"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN52919306"
    },
    {
      "type": "WEB",
      "url": "https://play.google.com/store/apps/details?id=com.toyoko_inn.toyokoandroid"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "tweetstream"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-24393"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-03-29T22:54:38Z",
    "nvd_published_at": "2021-02-19T23:15:00Z",
    "severity": "MODERATE"
  },
  "details": "TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack.",
  "id": "GHSA-6hrm-jqp3-64cv",
  "modified": "2023-01-26T22:35:31Z",
  "published": "2021-04-13T15:42:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24393"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tweetstream/tweetstream"
    },
    {
      "type": "ADVISORY",
      "url": "https://securitylab.github.com/advisories/GHSL-2020-096-tweetstream-tweetstream"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Certificate Validation in TweetStream"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-23114"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-05T02:15:28Z",
    "severity": "CRITICAL"
  },
  "details": "A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected server. This issue occurs due to a failure to properly validate TLS certificate.",
  "id": "GHSA-6j39-893g-q8cf",
  "modified": "2025-02-05T03:32:13Z",
  "published": "2025-02-05T03:32:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23114"
    },
    {
      "type": "WEB",
      "url": "https://www.veeam.com/kb4712"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-14419"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-09-13T17:29:00Z",
    "severity": "MODERATE"
  },
  "details": "The D-Link NPAPI extension, as used on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices, participates in mydlink Cloud Services by establishing a TCP relay service for HTTP, even though a TCP relay service for HTTPS is also established.",
  "id": "GHSA-6jmw-p67p-7q5c",
  "modified": "2022-05-17T00:51:52Z",
  "published": "2022-05-17T00:51:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14419"
    },
    {
      "type": "WEB",
      "url": "https://pierrekim.github.io/blog/2017-09-08-dlink-850l-mydlink-cloud-0days-vulnerabilities.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-5961"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-07-05T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "The Android App \u0027Tootdon for Mastodon\u0027 version 3.4.1 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.",
  "id": "GHSA-6jvh-7frh-6572",
  "modified": "2024-04-04T01:12:03Z",
  "published": "2022-05-24T16:49:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5961"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN57806517/index.html"
    },
    {
      "type": "WEB",
      "url": "http://blog.mastodon-tootdon.com/entry/2019/05/20/204019"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-56231"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-05T18:15:33Z",
    "severity": "CRITICAL"
  },
  "details": "Tonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate Validation, which allows attackers to bypass update protections.",
  "id": "GHSA-6mv5-ch6p-7g97",
  "modified": "2025-11-05T21:31:01Z",
  "published": "2025-11-05T18:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-56231"
    },
    {
      "type": "WEB",
      "url": "https://www.notion.so/CVE-2025-56231-2a04e9f2a40d80b184f4d02be58d3600"
    },
    {
      "type": "WEB",
      "url": "http://tonec.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-1000417"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-01-22T23:29:00Z",
    "severity": "MODERATE"
  },
  "details": "MatrixSSL version 3.7.2 adopts a collision-prone OID comparison logic resulting in possible spoofing of OIDs (e.g. in ExtKeyUsage extension) on X.509 certificates.",
  "id": "GHSA-6p29-jhc3-fmfm",
  "modified": "2022-05-14T03:44:57Z",
  "published": "2022-05-14T03:44:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000417"
    },
    {
      "type": "WEB",
      "url": "https://github.com/matrixssl/matrixssl/blob/master/doc/CHANGES.md"
    },
    {
      "type": "WEB",
      "url": "https://www.ieee-security.org/TC/SP2017/papers/231.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.youtube.com/watch?v=FW--c_F_cY8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2016-1198"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-04-21T20:59:00Z",
    "severity": "MODERATE"
  },
  "details": "Photopt for Android before 2.0.1 does not verify SSL certificates.",
  "id": "GHSA-6p5v-6rvf-wf2m",
  "modified": "2022-05-17T02:48:18Z",
  "published": "2022-05-17T02:48:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1198"
    },
    {
      "type": "WEB",
      "url": "https://mypocket.ntt.com/photopt/info/info_001.html"
    },
    {
      "type": "WEB",
      "url": "http://jvn.jp/en/jp/JVN11815655/index.html"
    },
    {
      "type": "WEB",
      "url": "http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000050.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-6144"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-10-20T15:29:00Z",
    "severity": "HIGH"
  },
  "details": "In F5 BIG-IP PEM 12.1.0 through 12.1.2 when downloading the Type Allocation Code (TAC) database file via HTTPS, the server\u0027s certificate is not verified. Attackers in a privileged network position may be able to launch a man-in-the-middle attack against these connections. TAC databases are used in BIG-IP PEM for Device Type and OS (DTOS) and Tethering detection. Customers not using BIG-IP PEM, not configuring downloads of TAC database files, or not using HTTP for that download are not affected.",
  "id": "GHSA-6p94-89qp-5g52",
  "modified": "2022-05-17T00:23:46Z",
  "published": "2022-05-17T00:23:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6144"
    },
    {
      "type": "WEB",
      "url": "https://support.f5.com/csp/article/K81601350"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-55581"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-26T22:15:14Z",
    "severity": "HIGH"
  },
  "details": "When AdaCore Ada Web Server 25.0.0 is linked with GnuTLS, the default behaviour of AWS.Client is vulnerable to a man-in-the-middle attack because of lack of verification of an HTTPS server\u0027s certificate (unless the using program specifies a TLS configuration).",
  "id": "GHSA-6pc8-5263-hvgq",
  "modified": "2025-03-10T21:31:11Z",
  "published": "2025-02-27T00:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55581"
    },
    {
      "type": "WEB",
      "url": "https://docs.adacore.com/corp/security-advisories/SEC.AWS-0056-v1.pdf"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00007.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}