Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Disabling TLS hostname verification enables Man-in-the-Middle (MitM) attacks by accepting certificates for arbitrary hostnames. Keep hostname verification enabled (true).
Iterating over the entire certificate chain (via `getPeerCertificates()`) to verify a hostname or Subject Alternative Name (SAN) is insecure. Only the leaf certificate (index 0) represents the actual peer server identity. Validating every certificate in the chain allows a Man-in-the-Middle (MITM) attacker to append a forged intermediate certificate containin
SSL/TLS peer or hostname verification is explicitly disabled. Disabling SSL verification allows man-in-the-middle (MitM) attackers to intercept sensitive communication and capture credentials.
When looking up trusted public keys, the expected connection identity must be used rather than the subject extracted directly from the presented certificate. Extracting the identity from the unverified certificate can allow an attacker to bypass authorization by presenting a different, trusted certificate. Pass the expected identity (e.g., `identification_t`
Server identity verification is disabled when making SSL connections.
KotlinCWE-297Server identity verification is disabled when making SSL connections.
ScalaCWE-297The Apache commons mail client by default does not enable TLS server identity. This allows for an adversary who is in between the application and the target host to intercept potentially sensitive information or transmit malicious data. Enable checking server identity by calling `Email.setSSLCheckServerIdentity(true)` Example email client that enables TLS an
JavaCWE-297
