Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Setting `InsecureSkipVerify: true` unconditionally disables TLS certificate verification, exposing connections to man-in-the-middle (MitM) attacks. Ensure certificate verification is enabled by default or configurable.
Use of `ssl._create_unverified_context()` disables TLS certificate verification and hostname checks, making HTTPS connections vulnerable to Man-in-the-Middle (MITM) attacks.
Calling `useSystemProperties()` after `setSSLSocketFactory()` or `setSSLContext()` on an Apache `HttpClientBuilder` can override the configured SSL socket factory or SSL context with system defaults, potentially disabling custom truststore and certificate validation configurations (CWE-295). Always call `useSystemProperties()` before configuring custom SSL s
Disabling TLS hostname verification enables Man-in-the-Middle (MitM) attacks by accepting certificates for arbitrary hostnames. Keep hostname verification enabled (true).
Database credentials may be sent in the initial handshake response before validating authentication plugin security requirements and MitM resistance, potentially exposing plaintext credentials to a rogue server or MitM attacker.
Authentication plugin capabilities are validated against the previous plugin instance before instantiating the target plugin during an authentication switch, which can allow cleartext password transmission before certificate validation.
Inverted `memcmp` comparison: `memcmp` returns 0 when buffers are equal and non-zero when they differ. Using `!!memcmp(...)` to set a match or validation flag treats mismatches as valid and matching data as invalid, which can lead to TLS certificate validation bypass.
TLS certificate verification is disabled with `verify = False`. This allows network-positioned attackers to perform man-in-the-middle (MitM) attacks and decrypt or tamper with sensitive traffic.
When validating TLS/SSL peer keys or certificates against expected key metadata, a key mismatch must throw an exception or return a failure status. Returning normally without throwing causes validation to succeed on mismatched credentials, leading to authentication bypass.
A variable implying insecure behavior (e.g., 'accept_invalid', 'insecure', 'skip') is passed directly to `verify_hostname` or `set_verify_hostname`. This function expects `true` to enable verification and `false` to disable it. Passing an 'insecure' flag directly without negation inadvertently disables hostname verification when a secure configuration was ex
Explicitly disabling SSL certificate verification by setting `verify_mode = OpenSSL::SSL::VERIFY_NONE` completely bypasses TLS validation. This allows a Man-in-the-Middle (MitM) attacker to intercept and modify communications.
SSL/TLS peer or hostname verification is explicitly disabled. Disabling SSL verification allows man-in-the-middle (MitM) attackers to intercept sensitive communication and capture credentials.
DNSPattern provides an inner_name() method which strips wildcard prefixes. Using the inner domain name for name constraint matching allows wildcard certificates to bypass excluded subtree constraints.
Identifying a leaf certificate in an unordered PKCS#7 bag by simply finding a certificate whose subject does not match any other certificate's issuer is insecure. An attacker can trick this heuristic by injecting a spoofed certificate that matches the target requirements and does not act as an issuer. Instead, identify the leaf certificate using cryptographi
Disabling TLS certificate verification by default allows Man-in-the-Middle (MitM) attacks. Relying on insecure default configurations can compromise all subsequent communications. Ensure the default configuration requires secure TLS validation by setting this parameter to 'false'.
TLS certificate validation was explicitly disabled by setting `SSL_verify_mode` to `SSL_VERIFY_NONE` or `0`. This failure to validate the cryptographic boundary permits Man-in-the-Middle (MITM) attacks. Use `SSL_VERIFY_PEER` to securely resolve this issue.
Explicitly disabling TLS certificate validation by passing `ssl_verify_cert=False` to DAVClient makes the application vulnerable to Man-in-the-Middle (MitM) attacks.
Signer certificate is validated against extendedKeyUsage XKU_CODE_SIGN but the X.509 keyUsage extension is not checked for X509v3_KU_DIGITAL_SIGNATURE. RFC 5280 section 4.2.1.3 requires that, when keyUsage is present, a certificate used for signing must assert digitalSignature. Failing to enforce this allows certificates whose issuing CA did not authorize di
The application invokes the WinGUp updater without explicitly enforcing cryptographic signature checks. An attacker in a privileged network position could intercept the HTTP(S) update request and serve a malicious executable payload, leading to arbitrary code execution. Ensure that '-chkCertSig=yes' is passed.
The LDAP TLS configuration defaults to `ssl.CERT_NONE`, disabling server certificate validation. This enables Man-in-the-Middle (MitM) attacks. Ensure `ssl.CERT_REQUIRED` is used by default, and only fallback to `ssl.CERT_NONE` conditionally through deliberate user configuration.
cURL TLS certificate verification is disabled. Setting CURLOPT_SSL_VERIFYPEER to false/0 disables peer certificate chain validation, and setting CURLOPT_SSL_VERIFYHOST to false/0/1 disables proper hostname verification. With these disabled, libcurl accepts any TLS certificate (including self-signed, expired, or hostname-mismatched ones), enabling man-in-the-
The application was found using the `requests` module without configuring a timeout value for connections. The `verify=False` argument has been set, which effectively disables the validation of server certificates. This allows for an adversary who is in between the application and the target host to intercept potentially sensitive information or transmit mal
PythonCWE-295The application was found creating a SSL context using the `_create_unverified_context`. This effectively disables the validation of server certificates. This allows for an adversary who is in between the application and the target host to intercept potentially sensitive information or transmit malicious data. To remediate this issue remove the call to `_cre
PythonCWE-295The Sequelize connection string indicates that TLS certificate validation of database server is disabled. This is equivalent to not having TLS. An attacker can present any invalid certificate and Sequelize will make database connection ignoring certificate errors. This setting make the connection susceptible to man in the middle (MITM) attacks. Not applicabl
JSCWE-295
