目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-295 证书验证不恰当 类漏洞列表 823

CWE-295 证书验证不恰当 类弱点 823 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-295 属于证书验证不当漏洞，指软件未正确验证数字证书的有效性或完整性。攻击者常利用此缺陷实施中间人攻击，通过伪造证书拦截并篡改通信数据，窃取敏感信息或注入恶意代码。开发者应确保严格校验证书链、域名匹配及有效期，禁用弱算法，并启用证书固定机制，以保障传输层安全，防止身份冒充和数据泄露。

MITRE CWE 官方描述
CWE：CWE-295 证书验证不当 英文：产品未对证书进行验证，或验证不正确。
常见影响 (1)
Integrity, Authentication Bypass Protection Mechanism, Gain Privileges or Assume Identity
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting s…
缓解措施 (2)
Architecture and Design, Implementation Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
代码示例 (2)
This code checks the certificate of a connected peer.
if ((cert = SSL_get_peer_certificate(ssl)) && host) foo=SSL_get_verify_result(ssl); if ((X509_V_OK==foo) || X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN==foo)) // certificate looks good, host can be trusted
Bad · C
The following OpenSSL code obtains a certificate and verifies it.
cert = SSL_get_peer_certificate(ssl); if (cert && (SSL_get_verify_result(ssl)==X509_V_OK)) { // do secret things }
Bad · C
CVE ID 标题 CVSS 风险等级 Published
CVE-2023-49567 Bitdefender Total Security 信任管理问题漏洞 — Total Security 7.4 - 2024-10-18
CVE-2023-6058 Bitdefender Total Security 信任管理问题漏洞 — Total Security 7.4 - 2024-10-18
CVE-2023-6057 Bitdefender Total Security 信任管理问题漏洞 — Total Security 5.9 - 2024-10-18
CVE-2023-6056 Bitdefender Total Security 信任管理问题漏洞 — Total Security 7.4 - 2024-10-18
CVE-2023-6055 Bitdefender Total Security 信任管理问题漏洞 — Total Security 7.4 - 2024-10-18
CVE-2024-22030 Rancher 信任管理问题漏洞 — rancher 8.0 High 2024-10-16
CVE-2024-48915 Agent Dart 信任管理问题漏洞 — agent_dart 7.5 - 2024-10-15
CVE-2024-43550 Microsoft Windows Secure Channel 信任管理问题漏洞 — Windows 10 Version 1507 7.4 High 2024-10-08
CVE-2024-7206 eWeLink 安全漏洞 — Zigbee Bridge Pro 7.8AI High AI 2024-10-08
CVE-2024-20385 Cisco Nexus Dashboard 安全漏洞 — Cisco Nexus Dashboard Orchestrator 5.9 Medium 2024-10-02
CVE-2024-9160 Puppet Enterprise Administration Module 安全漏洞 — PEADM Forge Module 9.1AI Critical AI 2024-09-27
CVE-2024-38861 Checkmk Exchange plugin MikroTik 安全漏洞 5.9AI Medium AI 2024-09-27
CVE-2024-43201 Planet Fitness Workouts 安全漏洞 — Planet Fitness Workouts 8.8 High 2024-09-23
CVE-2024-8287 Anbox Management Service 安全漏洞 — Anbox Cloud 7.5 High 2024-09-18
CVE-2022-45856 Fortinet FortiClient 信任管理问题漏洞 — FortiClientiOS 4.6 Medium 2024-09-10
CVE-2024-31489 Fortinet FortiClient 信任管理问题漏洞 — FortiClientMac 6.4 Medium 2024-09-10
CVE-2024-38642 QNAP QuMagie 信任管理问题漏洞 — QuMagie 7.8 - 2024-09-06
CVE-2024-37311 Collabora Online 安全漏洞 — online 8.2 High 2024-08-23
CVE-2024-8007 Red Hat OpenStack Platform 安全漏洞 8.1 High 2024-08-21
CVE-2023-50314 IBM WebSphere Application Server Liberty 安全漏洞 — WebSphere Application Liberty 5.3 Medium 2024-08-14
CVE-2023-50315 IBM WebSphere Application Server 信任管理问题漏洞 — WebSphere Application Server 5.3 Medium 2024-08-14
CVE-2024-7570 Ivanti ITSM 安全漏洞 — ITSM 8.3 High 2024-08-13
CVE-2024-5445 N-able Ecosystem Agent 安全漏洞 — Ecosystem Agent 3.8 Low 2024-08-08
CVE-2024-7383 libnbd 信任管理问题漏洞 7.4 High 2024-08-05
CVE-2024-6472 LibreOffice 安全漏洞 — LibreOffice 7.8 High 2024-08-05
CVE-2024-32865 Johnson Controls exacqVision Server 安全漏洞 — exacqVision 6.4 Medium 2024-08-01
CVE-2024-4786 Lenovo Tab K10 信任管理问题漏洞 — Tab K10 2.8 Low 2024-07-26
CVE-2023-50178 Fortinet FortiADC 信任管理问题漏洞 — FortiADC 7.2 High 2024-07-09
CVE-2023-50179 Fortinet FortiADC 信任管理问题漏洞 — FortiADC 4.7 Medium 2024-07-09
CVE-2024-33509 Fortinet FortiWeb 信任管理问题漏洞 — FortiWeb 4.4 Medium 2024-07-09

CWE-295（证书验证不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 823 条 CVE 漏洞。