目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-295 证书验证不恰当 类漏洞列表 823

CWE-295 证书验证不恰当 类弱点 823 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-295 属于证书验证不当漏洞，指软件未正确验证数字证书的有效性或完整性。攻击者常利用此缺陷实施中间人攻击，通过伪造证书拦截并篡改通信数据，窃取敏感信息或注入恶意代码。开发者应确保严格校验证书链、域名匹配及有效期，禁用弱算法，并启用证书固定机制，以保障传输层安全，防止身份冒充和数据泄露。

MITRE CWE 官方描述
CWE：CWE-295 证书验证不当 英文：产品未对证书进行验证，或验证不正确。
常见影响 (1)
Integrity, Authentication Bypass Protection Mechanism, Gain Privileges or Assume Identity
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting s…
缓解措施 (2)
Architecture and Design, Implementation Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
代码示例 (2)
This code checks the certificate of a connected peer.
if ((cert = SSL_get_peer_certificate(ssl)) && host) foo=SSL_get_verify_result(ssl); if ((X509_V_OK==foo) || X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN==foo)) // certificate looks good, host can be trusted
Bad · C
The following OpenSSL code obtains a certificate and verifies it.
cert = SSL_get_peer_certificate(ssl); if (cert && (SSL_get_verify_result(ssl)==X509_V_OK)) { // do secret things }
Bad · C
CVE ID 标题 CVSS 风险等级 Published
CVE-2025-1193 Devolutions Remote Desktop Manager 信任管理问题漏洞 — Remote Desktop Manager 7.4 - 2025-02-10
CVE-2024-47258 2N Access Commander 安全漏洞 — 2N Access Commander 8.1 High 2025-02-06
CVE-2024-23928 Pioneer DMH-WT7600NEX 安全漏洞 — DMH-WT7600NEX 6.5 Medium 2025-01-31
CVE-2024-23970 ChargePoint Home Flex 安全漏洞 — Home Flex 6.5 Medium 2025-01-30
CVE-2023-38009 IBM Cognos Mobile Client 信任管理问题漏洞 — Cognos Analytics Mobile 4.2 Medium 2025-01-26
CVE-2024-52330 ECOVACS robot lawnmowers和vacuums 信任管理问题漏洞 — DEEBOT X5 PRO PLUS 7.4 High 2025-01-23
CVE-2024-52329 ECOVACS HOME mobile app plugins 信任管理问题漏洞 — ECOVACS HOME 7.4 High 2025-01-23
CVE-2024-42186 HCL BigFix Patch Management 信任管理问题漏洞 — BigFix Patch Management Download Plug-ins 2.8 Low 2025-01-23
CVE-2025-0501 Amazon WorkSpaces 信任管理问题漏洞 — WorkSpaces Client 7.5 High 2025-01-15
CVE-2025-0500 Amazon多款产品 信任管理问题漏洞 — WorkSpaces Client 7.5 High 2025-01-15
CVE-2025-20126 Cisco ThousandEyes Endpoint Agent 信任管理问题漏洞 — Cisco ThousandEyes Endpoint Agent 4.8 Medium 2025-01-08
CVE-2024-40702 IBM Cognos Controller 信任管理问题漏洞 — Controller 8.2 High 2025-01-07
CVE-2024-56521 TCPDF 安全漏洞 — tcpdf 5.3 - 2024-12-27
CVE-2024-47119 IBM Storage Defender 信任管理问题漏洞 — Storage Defender - Resiliency Service 5.9 Medium 2024-12-18
CVE-2024-6001 Lenovo Display Control Center和Lenovo Accessories and Display Manager 安全漏洞 — Accessories and Display Manager 8.1 High 2024-12-16
CVE-2024-4762 Lenovo Display Control Center和Lenovo Accessories and Display Manager 安全漏洞 — Accessories and Display Manager 7.8 High 2024-12-16
CVE-2024-12174 Tenable Security Center 安全漏洞 — Security Center 2.7 Low 2024-12-09
CVE-2024-54147 Altair 信任管理问题漏洞 — altair 6.8 Medium 2024-12-09
CVE-2024-48865 QNAP Systems QTS和QuTS hero 安全漏洞 — QTS 9.8 - 2024-12-06
CVE-2024-53846 Erlang/OTP 信任管理问题漏洞 — otp 5.5 Medium 2024-12-05
CVE-2024-5921 Palo Alto Networks GlobalProtect 信任管理问题漏洞 — GlobalProtect App 8.0AI High AI 2024-11-27
CVE-2023-51634 NETGEAR RAX30 信任管理问题漏洞 — RAX30 8.8 - 2024-11-22
CVE-2024-52510 Nextcloud Desktop Client 信任管理问题漏洞 — security-advisories 4.2 Medium 2024-11-15
CVE-2022-20814 Cisco Expressway Series和Cisco TelePresence Video Communication Server 安全漏洞 — Cisco TelePresence Video Communication Server (VCS) Expressway 7.4 High 2024-11-15
CVE-2024-5918 Palo Alto Networks PAN-OS 信任管理问题漏洞 — Cloud NGFW 8.1AI High AI 2024-11-14
CVE-2024-49369 Icinga 信任管理问题漏洞 — icinga2 9.8 Critical 2024-11-12
CVE-2024-30149 HCL AppScan 安全漏洞 — AppScan Source 4.8 Medium 2024-10-31
CVE-2024-43177 IBM Concert 信任管理问题漏洞 — Concert 5.9 Medium 2024-10-22
CVE-2024-47241 Dell Secure Connect Gateway 信任管理问题漏洞 — Secure Connect Gateway (SCG) 5.0 Appliance - SRS 5.5 Medium 2024-10-18
CVE-2023-49570 Bitdefender Total Security 信任管理问题漏洞 — Total Security 7.4 - 2024-10-18

CWE-295（证书验证不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 823 条 CVE 漏洞。