目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-295 证书验证不恰当 类漏洞列表 822

CWE-295 证书验证不恰当 类弱点 822 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-295 属于证书验证不当漏洞，指软件未正确验证数字证书的有效性或完整性。攻击者常利用此缺陷实施中间人攻击，通过伪造证书拦截并篡改通信数据，窃取敏感信息或注入恶意代码。开发者应确保严格校验证书链、域名匹配及有效期，禁用弱算法，并启用证书固定机制，以保障传输层安全，防止身份冒充和数据泄露。

MITRE CWE 官方描述
CWE：CWE-295 证书验证不当 英文：产品未对证书进行验证，或验证不正确。
常见影响 (1)
Integrity, Authentication Bypass Protection Mechanism, Gain Privileges or Assume Identity
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting s…
缓解措施 (2)
Architecture and Design, Implementation Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
代码示例 (2)
This code checks the certificate of a connected peer.
if ((cert = SSL_get_peer_certificate(ssl)) && host) foo=SSL_get_verify_result(ssl); if ((X509_V_OK==foo) || X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN==foo)) // certificate looks good, host can be trusted
Bad · C
The following OpenSSL code obtains a certificate and verifies it.
cert = SSL_get_peer_certificate(ssl); if (cert && (SSL_get_verify_result(ssl)==X509_V_OK)) { // do secret things }
Bad · C
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-103502 hex_core默认HTTP适配器未验证TLS证书（OTP 24/25） — hex_core 5.9 Medium 2026-10-12
CVE-2026-78020 Dell SCG <5.34.00.16 证书验证错误漏洞 — Secure Connect Gateway (SCG) Policy Manager 7.5 High 2026-10-09
CVE-2026-96207 Microsoft Partner Center 提权漏洞 — Microsoft Partner Center 10.0 Critical 2026-10-08
CVE-2026-84032 IBM Guardium Data Protection 多漏洞 — Guardium Data Protection 5.6 Medium 2026-10-08
CVE-2026-107318 @fastify/reply-from HTTPS传输证书验证漏洞 — @fastify/reply-from 7.4 High 2026-10-08
CVE-2026-107587 hMailServer 证书验证不当漏洞 — hMailServer 5.9 Medium 2026-10-08
CVE-2026-87425 Brocade ASCG<3.5.0 TLS信任存储修改漏洞 — Brocade Active Support Connectivity Gateway 7.6 High 2026-10-08
CVE-2026-92543 Docker Engine 因恶意DNS响应导致不安全的注册表回退漏洞 — Docker Engine 7.6 High 2026-10-07
CVE-2026-63697 Dell System Update <2.3.0.0 远程执行漏洞 — System Update 7.6 High 2026-10-06
CVE-2026-67270 Dell CSM<1.18.0证书验证不当致凭据泄露 — Container Storage Modules (CSM) 8.2 High 2026-10-06
CVE-2026-105794 Microsoft.Native.Quic.MsQuic.OpenSSL 证书验证缺陷漏洞 — msquic 9.1 Critical 2026-10-06
CVE-2026-105223 maclof kubernetes-client 0.17.0-0.32.0 禁用TLS证书验证 — kubernetes-client 7.4 High 2026-10-05
CVE-2026-105222 google-maps 12.16 TLS证书验证禁用漏洞 — google-maps 7.4 High 2026-10-04
CVE-2026-105221 Gist RubyGem 6.1.0前版本禁用TLS证书验证漏洞 — gist 7.4 High 2026-10-04
CVE-2026-105218 gopay before 1.5.119 xhttp 客户端禁用 TLS 证书验证漏洞 — gopay 7.4 High 2026-10-04
CVE-2026-105217 Cockpit CMS 2.12.0-2.14.1 定时任务TLS验证绕过漏洞 — cockpit 3.1 Low 2026-10-04
CVE-2026-105216 go-micro 6.0.0 前版本 TLS证书验证绕过漏洞 — go-micro 7.4 High 2026-10-04
CVE-2026-71885 MLS X.509凭证未绑定到LeafNode签名密钥 — BC-JAVA 9.2 Critical 2026-10-03
CVE-2026-71889 PKIXCertPathReviewer X.509名称约束绕过漏洞 — BC-JAVA 8.7 High 2026-10-03
CVE-2026-85088 Apache Thrift C++/D客户端证书验证漏洞 — Apache Thrift 6.9 Medium 2026-10-02
CVE-2026-85087 Apache Thrift Python≥3.12主机名检查失效漏洞 — Apache Thrift 6.9 Medium 2026-10-02
CVE-2026-85086 Apache Thrift Perl TLS客户端默认禁用证书验证 — Apache Thrift 6.9 Medium 2026-10-02
CVE-2026-80443 HAVELSAN Sef平台API工具运行器TLS证书验证不安全漏洞 — Sef - AI Chatbot Platform 7.4 High 2026-10-02
CVE-2026-103602 RFC822Name/URI hosts后缀点绕过Name Constraints限制漏洞 — bc-csharp 8.2 High 2026-10-02
CVE-2026-63577 目录名称约束绕过漏洞 — bc-csharp 8.2 High 2026-10-02
CVE-2026-63576 URI名称约束对错误解析主机进行检查 — bc-csharp 8.2 High 2026-10-02
CVE-2026-102671 Joyland AI WebView 接受无效SSL证书漏洞 — Joyland.ai 5.3 Medium 2026-10-01
CVE-2026-102668 Joyland AI TLS证书验证缺失漏洞 — Joyland.ai 5.3 Medium 2026-10-01
CVE-2026-15911 Confluent Kafka Python TLS证书验证不当漏洞 — confluent-kafka 7.4 High 2026-10-01
CVE-2026-103921 GraphQL Tools 旧版WebSocket执行器TLS验证禁用漏洞 — graphql-tools 7.4 High 2026-10-01

CWE-295（证书验证不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 822 条 CVE 漏洞。