End-server vulnerabilities are caused by improper SSL protocol configuration in a domain server. Here is a list of vulnerabilities you should look out for:

1. BEAST 

Browser Exploit Against SSL/TLS (BEAST) is a browser exploitation affecting the Secure Sockets Layer (SSL) or the Transport Layer Security (TLS) protocol by weakening cipher block chaining (CBC).  

Impact

The impacts of a BEAST vulnerability can range from hijacking sessions to data breaches and encryption-related issues. 

Solution 

To protect against this vulnerability, the following measures can be taken: 

• Supporting TLS 1.1+ server-side 
  

• Removing TLS v 1.0 and SSL v3, SSL v2
  

• Removing insecure cipher suites
  

2. POODLE 

The Padding Oracle On Downgraded Legacy Encryption (POODLE) vulnerability 

impacts TLS implementations that don't ensure the proper structure of the padding used in the TLS packets. 

Impact

A POODLE vulnerability can open the door for man-in-the-middle (MITM) attacks and session hijackings. 

Solution

To avoid this vulnerability, you can: 

1. Avoid using SSL v3 and lower protocols.

2. Avoid using insecure cipher suites. 

3. POODLE (TLS) 

POODLE (TLS) is a protocol downgrade that allows exploits on an outdated form of encryption.  

If an attacker uses a man-in-the-middle attack to take control of a router at a public hot spot, they can force the user's browser to downgrade to SSL 3.0 (an older protocol) instead of using the much more modern TLS and can then hijack the user's browser sessions. 

Impact

This vulnerability can cause man-in-the-middle attacks, and dispatching spoof packets between a user and a website to force a protocol downgrade. 

Solution

To avoid this vulnerability, you can: 

1. Disable support for CBC encryption ciphers.

2. Enable the TLS v1.3 protocol.

4. Renegotiation Vulnerability

In this vulnerability, SSL and TLS protocols allow renegotiation requests that may enable an attacker to inject plain text into an application's protocol stream. This can result in a situation where an attacker can issue commands to the server, posing them as a request coming from a legitimate source.  

Impact

This vulnerability can cause session hijackings, plain text command injections, and MITM attacks. 

Solution

To avoid this vulnerability, you can: 

1. Avoid SSL v3 and lower protocols.

2. Use TLS v 1.2 and higher versions.

5. ROBOT  

The Return Of Bleichenbacher's Oracle Threat, or ROBOT vulnerability, affects web servers that are configured to use the Rivest–Shamir–Adleman (RSA) encryption key exchange. A hacker can recover the session key used for various sessions by exploiting the vulnerability and can decrypt communications to and from the webserver. 

Impact

The impacts of the vulnerability can vary from MITM attacks, recording traffic, and decryption to extracting data. 

Solution

To avoid issues arising due to this vulnerability, you can: 

1. Avoid using RSA ciphers. 

2. Avoid using older protocols.

6. RC4 vulnerability

Impact

The RC4 vulnerability can enable attackers to capture network traffic, decrypt messages from those networks, and access related cookies. 

Solution

To steer clear of this type of vulnerability, you can: 

1. Avoid RC ciphers.

2. Avoid using SSLv3 protocol and lower.

7. CBC vulnerability

A vulnerability exists in Secure Shell (SSH) messages that employ CBC mode, which may allow an attacker to recover the plain text from a block of ciphertext. CBC ciphers are less secure ciphers. 

Impact

This vulnerability may lead to the POODLE vulnerability. 

Solution

To prevent this kind of vulnerability, you can:

1. Avoid using CBC ciphers.

2. Avoid using TLSv1.1 and lower protocols.

8. AEAD

Authenticated Encryption with Additional Data (AEAD) implies that a built-in message authentication code is present for checking the integrity of the ciphertext and the additional authenticated data. The AEAD cipher suites in TLS are the ones using AES-GCM and ChaCha20-Poly1305 algorithms. 

It is true that algorithms are the most secure options, and indeed the only options that will be that will support TLS v1.3.AEAD. 

Impact

This vulnerability can cause many security issues. To avoid them, you can:

1. Avoid insecure ciphers.

2. Use AEAD ciphers for security.

9. Forward secrecy 

Forward secrecy (FS) is a feature of a specific key-agreement protocol that assures that even if the private key of the server is compromised, session keys will not be hampered. If forward secrecy is used, encrypted communications or sessions recorded in the past cannot be retrieved and decrypted. 

Impact

This vulnerability can cause session hijackings and breach of secure authentication. 

Solution

To avoid this vulnerability you can:

1. Avoid using insecure ciphers.

2. Avoid using older protocols.

3. Use Elliptic-curve Diffie–Hellman (ECDH) ciphers for secure authentication and maintaining sessions.

10. FREAK vulnerability

The Factoring RSA Export Keys (FREAK) vulnerability allows an attacker to view the transaction between a client and a server, thereby encroaching into a secure and private communication. The vulnerability occurs primarily due to a bug in the OpenSSL client software. This can put both clients and servers at risk. 

This type of vulnerability can affect a large number of browser-trusted sites, embedded systems, and software products that use TLS, all without disabling the cryptographic suites.

Solution

To avoid this vulnerability, you can: 

1. Avoid using export ciphers.

2. Avoid using lower protocol versions.

11. DROWN 

Decrypting RSA with Obsolete and Weakened eNcryption (DROWN) is a severe vulnerability that impacts HTTPS and other services that rely on SSL and TLS, the essential cryptography protocols for internet security. This vulnerability leads to attackers breaking the encryption, and reading or stealing sensitive communication information like passwords, credit card numbers, trade secrets, or financial data.  

Impact 

This vulnerability can lead to MITM attacks, and can enable attackers to steal user-related details like name, password, etc. 

Solution

To avoid this vulnerability, you can:

1. Avoid using SSL v2.

2. Avoid using insecure cipher suites.

12. Logjam vulnerability  

The Logjam vulnerability has been found to affect most common communication encryption services like TLS, IP security (IPsec), and SSH. It helps a man-in-the-middle attacker to downgrade the secure connection to 512-bit export-grade cryptography, which can be used to view and edit securely encrypted data.

Connections over vulnerable TLS protocols are more prone to this vulnerability. 

Impact

Solution

To avoid this vulnerability, you can:

1. Avoid using export ciphers.

2. Avoid using DH encryption ciphers.

3. Avoid using older versions of protocols.

13. Heartbleed 

Sensitive data, including user authentication credentials and secret keys, can be exposed by a remote attacker through incorrect memory handling in the TLS heartbeat extension. 

Impact 

This vulnerability can lead to man-in-the-middle attacks and session hijackings and can result in the exposure of user credentials. 

Solution

To avoid this vulnerability, you can: 

1. Avoid using insecure ciphers.

2. Avoid using lower versions of protocols.

3. Avoid using older OpenSSL versions.

14. Fallback SCSV

Fallback Signaling Cipher Suite Value (SCSV) prevents SSL/TLS protocol downgrades, as well as man-in-the-middle attacks.

15. CHACHA20

ChaCha [CHACHA] is a stream cipher that operates on a state of 16 32-bit words that are initialized from the input words. It consists of 20 rounds that alternate between "column" rounds and "diagonal" rounds. 

ChaCha provides better security and is also immune to most SSL attacks.

16. Self-signed certificate 

A self-signed certificate is one signed by the certifying entity itself. In technical terms, it is a certificate signed with its own private key. 

17. SSL Blacklist

The SSL Blacklist, or SSLBL, relies on IP addresses and SHA-1 fingerprints associated with certain cyberthreats. Users can access various pieces of information on each certificate, including its common name, the name of the issuer, the SSL version, associated malware binaries, and the reason for which it has been blacklisted.

18. Insecure key SSL 

Public key authentication with SSH is more secure than password authentication, as it provides a stronger identity screening. Both the private key and the correct passphrase must be present to authenticate itself.

 19. Revocation

20. Chain not valid 

A "certificate not trusted" error arises when the certificate installation is not properly completed on the server (or servers) hosting the site.  

Causes

1. Self-signed certificates

2. Intermediate certificate issues 

Solution

To avoid this vulnerability, you can: 

1. Avoid using self-signed certificates.

2. Avoid using a free SSL certificate.

21. Common name mismatch 

This error occurs when the common name or SAN of your SSL/TLS certificate doesn't match the domain or address bar in the browser. This can happen when you visit, for example, https://example.com instead of https://www.example.com, without listing both sites in the SAN of the certificate. 

Causes

1. The website address isn't in your common name.

2. The website does not have an SSL but shares it with another site.

3. Misconfigurations of your server or firewall. 

Impact

The website and the certificate may not load, and the connection may not be secure.