CWE-295

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "kubeclient"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.9.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-0759"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-03-30T13:12:44Z",
    "nvd_published_at": "2022-03-25T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).",
  "id": "GHSA-69p3-xp37-f692",
  "modified": "2022-04-08T21:45:06Z",
  "published": "2022-03-26T00:00:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0759"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ManageIQ/kubeclient/issues/554"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ManageIQ/kubeclient/issues/555"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ManageIQ/kubeclient/pull/556"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ManageIQ/kubeclient/commit/109ea71de5a8881748f03ebbe103b49f0f1c7887"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ManageIQ/kubeclient"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/kubeclient/CVE-2022-0759.yml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Certificate Validation in kubeclient"
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-14980"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-06-22T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The Sophos Secure Email application through 3.9.4 for Android has Missing SSL Certificate Validation.",
  "id": "GHSA-6c5p-crmr-mrgh",
  "modified": "2023-01-27T18:30:33Z",
  "published": "2022-05-24T17:21:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14980"
    },
    {
      "type": "WEB",
      "url": "https://www.info-sec.ca/advisories/Sophos-Secure-Email.html"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/158322/Sophos-Secure-Email-Android-Application-3.9.4-Man-In-The-Middle.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/hashicorp/vault"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.20.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-6037"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-01T21:09:19Z",
    "nvd_published_at": "2025-08-01T18:15:57Z",
    "severity": "MODERATE"
  },
  "details": "Vault and Vault Enterprise (\u201cVault\u201d) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [+trusted certificate+|https://developer.hashicorp.com/vault/api-docs/auth/cert#certificate]. In this configuration, an attacker may be able to craft a malicious certificate that could be used to impersonate another user. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.",
  "id": "GHSA-6c5r-4wfc-3mcx",
  "modified": "2025-08-01T21:09:19Z",
  "published": "2025-08-01T18:31:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6037"
    },
    {
      "type": "WEB",
      "url": "https://discuss.hashicorp.com/t/hcsec-2025-18-vault-certificate-auth-method-did-not-validate-common-name-for-non-ca-certificates/76037"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/hashicorp/vault"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Hashicorp Vault has Incorrect Validation for Non-CA Certificates"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mongodb/mongo-tools"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "100.0.0"
            },
            {
              "fixed": "100.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-7924"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-13T20:32:52Z",
    "nvd_published_at": "2021-04-12T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates.This issue affects: MongoDB Inc. MongoDB Database Tools 3.6 versions later than 3.6.5; 3.6 versions prior to 3.6.21; 4.0 versions prior to 4.0.21; 4.2 versions prior to 4.2.11; 100 versions prior to 100.2.0. MongoDB Inc. Mongomirror 0 versions later than 0.6.0.",
  "id": "GHSA-6cwm-wm82-hgrw",
  "modified": "2024-07-03T21:05:45Z",
  "published": "2022-05-24T17:47:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7924"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mongodb/mongo-tools/commit/8c1800b5155084f954a39a1f2f259efac3bb86de"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-6cwm-wm82-hgrw"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mongodb/mongo-tools"
    },
    {
      "type": "WEB",
      "url": "https://jira.mongodb.org/browse/TOOLS-2587"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MongoDB Tools Improper Certificate Validation vulnerability"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-35193"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-30T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "Patterson Application Service in Patterson Eaglesoft 18 through 21 accepts the same certificate authentication across different customers\u0027 installations (that have the same software version). This provides remote access to SQL database credentials. (In the normal use of the product, retrieving those credentials only occurs after a username/password authentication step; however, this authentication step is on the client side, and an attacker can develop their own client that skips this step.)",
  "id": "GHSA-6cxj-8mc8-27h3",
  "modified": "2022-05-24T19:09:19Z",
  "published": "2022-05-24T19:09:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35193"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jshafer817/Eaglesoft"
    },
    {
      "type": "WEB",
      "url": "https://justinshafer.blogspot.com/2021/07/eaglesoft-18-through-21-vulnerability.html"
    },
    {
      "type": "WEB",
      "url": "http://patterson.eaglesoft.net/Home/Contact-Us"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-9601"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-06-16T12:29:00Z",
    "severity": "MODERATE"
  },
  "details": "The \"FNB Kemp Mobile Banking\" by First National Bank of Kemp app 3.0.2 -- aka fnb-kemp-mobile-banking/id571448725 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.",
  "id": "GHSA-6f5f-6fg8-34q8",
  "modified": "2025-04-20T03:39:14Z",
  "published": "2022-05-14T02:57:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9601"
    },
    {
      "type": "WEB",
      "url": "https://medium.com/%40chronic_9612/advisory-44-credit-union-apps-for-ios-may-allow-login-credential-exposure-4d2f380b85c5"
    },
    {
      "type": "WEB",
      "url": "https://medium.com/@chronic_9612/advisory-44-credit-union-apps-for-ios-may-allow-login-credential-exposure-4d2f380b85c5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:mailer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.32"
            },
            {
              "fixed": "1.32.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.32"
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:mailer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.30"
            },
            {
              "fixed": "1.31.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:mailer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.29.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-2252"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-23T23:19:44Z",
    "nvd_published_at": "2020-09-16T14:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Jenkins Mailer Plugin prior to 1.32.1, 1.31.1, and 1.29.1 does not perform hostname validation when connecting to the configured SMTP server. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections.\n\nMailer Plugin 1.32.1, 1.31.1, and 1.29.1 validates the SMTP hostname when connecting via TLS by default. In Mailer Plugin 1.32 and earlier, administrators can set the Java system property mail.smtp.ssl.checkserveridentity to true on startup to enable this protection.\n\nIn case of problems, this protection can be disabled again by setting the Java system property mail.smtp.ssl.checkserveridentity to false on startup.",
  "id": "GHSA-6fr3-286q-q3cr",
  "modified": "2023-05-23T20:56:20Z",
  "published": "2022-05-24T17:28:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2252"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jenkinsci/mailer-plugin/commit/e1893c6d105669f134ee5c5212ef9f3944d7d00d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/CVEProject/cvelist/blob/16860a328d970faa6e4350b0fa446f64a52e52ca/2020/2xxx/CVE-2020-2252.json"
    },
    {
      "type": "WEB",
      "url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1813"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2020/09/16/3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Validation of Certificate with Host Mismatch in Jenkins Mailer Plugin"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-86889"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-14T21:17:39Z",
    "severity": "MODERATE"
  },
  "details": "A certificate validation issue was addressed with improved certificate validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker in a privileged network position may be able to intercept network traffic.",
  "id": "GHSA-6fvx-gp4r-8x93",
  "modified": "2026-09-15T18:32:20Z",
  "published": "2026-09-14T21:31:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86889"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/149035"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/149042"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/149043"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-32581"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-08-05T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "Acronis True Image prior to 2021 Update 4 for Windows, Acronis True Image prior to 2021 Update 5 for Mac, Acronis Agent prior to build 26653, Acronis Cyber Protect prior to build 27009 did not implement SSL certificate validation.",
  "id": "GHSA-6fw4-x9r3-mvgh",
  "modified": "2022-05-24T19:10:10Z",
  "published": "2022-05-24T19:10:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32581"
    },
    {
      "type": "WEB",
      "url": "https://kb.acronis.com/content/68413"
    },
    {
      "type": "WEB",
      "url": "https://kb.acronis.com/content/68419"
    },
    {
      "type": "WEB",
      "url": "https://kb.acronis.com/content/68648"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.1.34"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@graphql-tools/executor-legacy-ws"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.35"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-103921"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-05T22:56:56Z",
    "nvd_published_at": "2026-10-01T17:17:19Z",
    "severity": "HIGH"
  },
  "details": "## Impact\n\n`buildWSLegacyExecutor()` in `@graphql-tools/executor-legacy-ws` previously hardcoded `rejectUnauthorized: false` when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle (MITM) attack against applications that use this executor with a `wss://` endpoint. Credentials passed via `connectionParams` or `headers` could be intercepted, and subscription data could be tampered with.\n\n**Who is impacted:** Applications using `@graphql-tools/executor-legacy-ws` (directly or via `@graphql-tools/url-loader` with `SubscriptionProtocol.LEGACY_WS`) to connect to a `wss://` endpoint from Node.js while sending authentication material over the connection.\n\nBrowser WebSocket clients are unaffected by this option (browsers always validate certificates).\n\n## Patches\n\nUpgrade to `@graphql-tools/executor-legacy-ws@1.1.35` or later (and `@graphql-tools/url-loader@9.1.9` or later if you use the loader). TLS certificate validation is enabled by default. Callers that intentionally use self-signed certificates in trusted environments can opt out with `rejectUnauthorized: false`.\n\n## Workarounds\n\n- Prefer the modern `graphql-ws` / `SubscriptionProtocol.WS` path where possible.\n- Until upgraded, avoid sending secrets over legacy WSS connections, or terminate TLS at a trusted proxy and use `ws://` only on trusted networks.\n- Supply a custom `webSocketImpl` that enforces certificate validation.",
  "id": "GHSA-6fw5-9hq8-w87g",
  "modified": "2026-10-05T22:56:56Z",
  "published": "2026-10-05T22:56:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-6fw5-9hq8-w87g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103921"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ardatan/graphql-tools/pull/8426"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ardatan/graphql-tools/commit/3831a0661514c91d99971052f983552556880402"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ardatan/graphql-tools"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/executor-legacy-ws@1.1.35"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor"
}