CWE-599: Missing Validation of OpenSSL Certificate
The product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.
A kind of CWE-295 Improper Certificate Validation.
From the CWE List. © The MITRE Corporation.
Newest
- netgear xr1000, mr70, ms70 +1 more +3 more Certificate validation vulnerability in NETGEAR Gaming Router and certain Nighthawk models 4.9 Medium
- aws sagemaker python sdk TLS disabled by default in select aws/sagemaker-python-sdk configurations 8.2 High
- openlistteam openlist OpenList Insecure TLS Default Configuration 8.1 High
- xtooltech xtool anyscan Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate... 4.6 Medium
- cdprojekt gog galaxy GOG Galaxy 2.0.0.2 suffers from Missing SSL Certificate Validation. An attacker who controls the... 6.8 Medium
- tencent docs Tencent Docs Desktop 3.9.20 and earlier suffers from Missing SSL Certificate Validation in the... 7.5 High
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 more Server Certificate Verification Disabled 10.0 Critical
- No product listed Indian Bank IndSMART Android App 3.8.1 is vulnerable to Missing SSL Certificate Validation in... 5.3 Medium
- linuxfoundation cortex cortex establishes TLS connections with `InsecureSkipVerify` set to `true` 7.5 High
- goframe goframe v2.7.2 is configured to skip TLS certificate verification, possibly allowing attackers to... 7.1 High
- beego Beego privilege escalation vulnerability 8.8 High
- d-link dir-1950 firmware D-Link DIR-1950 up to v1.11B03 does not validate SSL certificates when requesting the latest... 6.8 Medium
- ibm security verify access appliance, security verify access +1 more IBM Security Verify Access Appliance missing certificate validation 7.5 High
- httpie HTTPie allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack 7.4 High
- argoproj argo cd, argo-cd +1 more Argo CD's certificate verification is skipped for connections to OIDC providers 8.3 High
- nim-lang nim, embysupport security +1 more Nimble fails to validate certificates due to insecure httpClient defaults 8.1 High