CWE-296 Improper Following of a Certificate's Chain of Trust
baseThe product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (24)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-48057US | critical9.8 | — | ||
Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. Prior to versions 2.12.… | ||||
| CVE-2020-26117US | high8.1 | — | ||
In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that… | ||||
| CVE-2021-23162US | high8.1 | — | ||
Improper validation of the cloud certificate chain in Mobile Connect allows man-in-the-middle attack to impersonate the legitimate Command Centre Server. This issue affects: Gallag… | ||||
| CVE-2019-3890US | high8.1 | — | ||
It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the use… | ||||
| CVE-2025-12383US | high7.4 | — | ||
In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and othe… | ||||
| CVE-2021-1566US | high7.4 | — | ||
A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco Web Security Appliance… | ||||
| CVE-2019-3762US | high7.5 | — | ||
Data Protection Central versions 1.0, 1.0.1, 18.1, 18.2, and 19.1 contains an Improper Certificate Chain of Trust Vulnerability. A remote unauthenticated attacker could potentially… | ||||
| CVE-2021-23155US | medium6.8 | — | ||
Improper validation of the cloud certificate chain in Mobile Client allows man-in-the-middle attack to impersonate the legitimate Command Centre Server. This issue affects: Gallagh… | ||||
| CVE-2020-12421US | medium6.5 | — | ||
When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.) This could have cause… | ||||
| CVE-2021-44532US | medium5.3 | — | ||
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames… | ||||
| CVE-2026-42789US | medium4.8 | — | ||
Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issue… | ||||
| CVE-2025-22459US | medium4.8 | — | ||
Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to intercept limited traffic… | ||||
| CVE-2021-34462US | medium4.6OT elevated | — | ||
Windows AppX Deployment Extensions Elevation of Privilege Vulnerability | ||||
| CVE-2026-96770US | — | — | ||
All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is fa… | ||||
| CVE-2026-73542US | — | — | ||
Multiple SEIKO EPSON printers and scanners contain revoked root certificates. A man-in-the-middle attack may allow an attacker to obtain communication data transmitted by the produ… | ||||
| CVE-2026-24066US | — | — | ||
Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.pr… | ||||
| CVE-2026-44852US | — | — | ||
An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface. A vulnerability in the certificate download functionality could… | ||||
| CVE-2025-10539US | —OT elevated | — | ||
Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client an… | ||||
| CVE-2026-33779US | — | — | ||
An Improper Following of a Certificate's Chain of Trust vulnerability in J-Web of Juniper Networks Junos OS on SRX Series allows a PITM to intercept the communication of the device… | ||||
| CVE-2026-4370US | —OT elevated | — | ||
A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to perform proper TLS clie… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan