目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-295 证书验证不恰当 类漏洞列表 822

CWE-295 证书验证不恰当 类弱点 822 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-295 属于证书验证不当漏洞，指软件未正确验证数字证书的有效性或完整性。攻击者常利用此缺陷实施中间人攻击，通过伪造证书拦截并篡改通信数据，窃取敏感信息或注入恶意代码。开发者应确保严格校验证书链、域名匹配及有效期，禁用弱算法，并启用证书固定机制，以保障传输层安全，防止身份冒充和数据泄露。

MITRE CWE 官方描述
CWE：CWE-295 证书验证不当 英文：产品未对证书进行验证，或验证不正确。
常见影响 (1)
Integrity, Authentication Bypass Protection Mechanism, Gain Privileges or Assume Identity
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting s…
缓解措施 (2)
Architecture and Design, Implementation Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
代码示例 (2)
This code checks the certificate of a connected peer.
if ((cert = SSL_get_peer_certificate(ssl)) && host) foo=SSL_get_verify_result(ssl); if ((X509_V_OK==foo) || X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN==foo)) // certificate looks good, host can be trusted
Bad · C
The following OpenSSL code obtains a certificate and verifies it.
cert = SSL_get_peer_certificate(ssl); if (cert && (SSL_get_verify_result(ssl)==X509_V_OK)) { // do secret things }
Bad · C
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-111494 MatchPoint Android 应用 TLS 证书验证错误漏洞 — Matchpoint 9.1 Critical 2026-11-05
CVE-2026-116789 FreeSWITCH DTLS-SRTP 证书未绑定 SDP 指纹漏洞 — freeswitch 7.4 High 2026-11-05
CVE-2026-96453 Keycloak Admin CLI 任意自签名证书信任漏洞 — Red Hat AMQ Broker 7 8.0 High 2026-11-05
CVE-2026-61813 ModSecurity HttpsClient 远程代码执行漏洞 — ModSecurity 3.7 Low 2026-11-05
CVE-2026-33965 IMS设备SIP信令流程信息泄露漏洞 — Exynos 1080 - - 2026-11-05
CVE-2026-122318 Kyverno 1.19.2 之前版本空 SAN 证书绕过漏洞 — kyverno 7.7 High 2026-11-05
CVE-2026-54372 VitaFit Android <2.8.1.0 不安全 TLS 证书验证漏洞 — VitaFit 8.8 High 2026-11-04
CVE-2026-110281 IBM Db2 Genius Hub 多个漏洞 — Db2 Genius Hub 5.9 Medium 2026-11-04
CVE-2026-121638 WatchGuard AuthPoint Gateway 证书验证不当中间人攻击漏洞 — AuthPoint Authentication Gateway 9.1 Critical 2026-11-04
CVE-2026-121147 Tata Motors iRA 和 iRA.ev 应用配置错误漏洞 — Tata Motors iRA 2.0 8.5 High 2026-11-04
CVE-2026-121565 Tanium 多产品证书验证不当漏洞 — TanOS 7.4 High 2026-11-03
CVE-2026-121624 Nanosystems Supremo 5.0.2.3874 TLS 证书验证漏洞 — Supremo 6.8 Medium 2026-11-03
CVE-2026-115714 Elastic Docker 镜像 TLS 连接拦截漏洞 — Elastic Docker images 7.4 High 2026-11-03
CVE-2026-121452 bbs-go 4.4.6 SMTP服务TLS证书验证绕过漏洞 — bbs-go 6.5 Medium 2026-11-03
CVE-2026-121392 FreeRDP 3.32.2 前证书身份验证绕过漏洞 — FreeRDP 7.4 High 2026-11-03
CVE-2026-91897 Dell AWCC 6.14.54 证书验证漏洞致代码执行 — Alienware Command Center (AWCC) 6.4 Medium 2026-11-02
CVE-2026-120250 OpenAlgo SMTP 证书验证不当漏洞 — OpenAlgo 5.3 Medium 2026-11-01
CVE-2026-118147 Visual Studio 伪造漏洞 — Microsoft Visual Studio 2017 version 15.9 7.4 High 2026-10-31
CVE-2026-117681 Konflux-ci 非 OpenShift 集群代理跳过 TLS 验证导致令牌泄露漏洞 8.0 High 2026-10-31
CVE-2026-118697 JetBrains Toolbox 及 IDEA 中间证书信任漏洞 — Toolbox App 9.0 Critical 2026-10-30
CVE-2026-112816 LXD HTTPS 监听器证书验证不当漏洞 — LXD 10.0 Critical 2026-10-30
CVE-2026-119559 OpenLiteSpeed 1.9.4 mTLS 绕过漏洞 — openlitespeed 5.9 Medium 2026-10-30
CVE-2026-119190 Forge X.509 basicConstraints 绕过漏洞 — forge 7.4 High 2026-10-29
CVE-2026-119189 Forge 证书链验证路径长度约束绕过漏洞 — forge 5.9 Medium 2026-10-29
CVE-2026-118780 Forge verifyCertificateChain 可信 CA 证书移除漏洞 — forge 3.7 Low 2026-10-29
CVE-2026-119118 Crawl4AI 0.9.5 之前版本证书验证漏洞 — crawl4ai 6.5 Medium 2026-10-29
CVE-2026-106036 Szafir 证书验证不当漏洞 — Szafir 6.9 Medium 2026-10-29
CVE-2026-105031 Apache Qpid Proton C 证书信任配置漏洞 — Apache Qpid Proton C - - 2026-10-29
CVE-2026-117611 eMudhra 根证书被捆绑 CA 库信任漏洞 — Checkmk 7.1 High 2026-10-29
CVE-2026-116641 DB Tools 信任 eMudhra 中间 CA 证书漏洞 — Database Tools 6.8 Medium 2026-10-28

CWE-295（证书验证不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 822 条 CVE 漏洞。