Weakness (CWE)
CWE-599: Missing Validation of OpenSSL Certificate
The product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.
How to prevent it (2 mitigations)
-
Architecture and Design
Ensure that proper authentication is included in the system design.
-
Implementation
Understand and properly implement all checks necessary to ensure the identity of entities involved in encrypted communications.
Source: MITRE CWE-599
6 results · Clear filters · Feed
-
Medium 4.9
Certificate validation vulnerability in NETGEAR Gaming Router and certain Nighthawk models
A security flaw in the router's certificate validation process was discovered in the NETGEAR XR1000 Gaming Router and certain Nighthawk models that could allow an unauthorized person to remotely access and take control of the device.
-
Medium 5.9
TLS disabled by default in select aws/sagemaker-python-sdk configurations
Amazon SageMaker Python SDK before v3.1.1 or v2.256.0 disables TLS certificate verification for HTTPS connections made by the service when a Triton Python model is imported, incorrectly allowing for requests with invalid and self-signed certificates to succee…
-
Medium 4.6
Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate Validation. The application fa…
-
Medium 6.8
GOG Galaxy 2.0.0.2 suffers from Missing SSL Certificate Validation. An attacker who controls the local network, DNS, or…
-
Medium 5.3
Indian Bank IndSMART Android App 3.8.1 is vulnerable to Missing SSL Certificate Validation in NuWebViewActivity.
-
Medium 6.8
D-Link DIR-1950 up to v1.11B03 does not validate SSL certificates when requesting the latest firmware version and downl…