718
Reference Description
CVE-2012-5810 Mobile banking application does not verify hostname, leading to financial loss.
https://www.cve.org/CVERecord?id=CVE-2012-5810
CVE-2012-3446 Cloud-support library written in Python uses incorrect regular expression when
matching hostname.
https://www.cve.org/CVERecord?id=CVE-2012-3446
CVE-2009-2408 Web browser does not correctly handle '\0' character (NUL) in Common Name,
allowing spoofing of https sites.
https://www.cve.org/CVERecord?id=CVE-2009-2408
CVE-2012-2993 Smartphone device does not verify hostname, allowing spoofing of mail
services.
https://www.cve.org/CVERecord?id=CVE-2012-2993
CVE-2012-5822 Application uses third-party library that does not validate hostname.
https://www.cve.org/CVERecord?id=CVE-2012-5822
CVE-2012-5819 Cloud storage management application does not validate hostname.
https://www.cve.org/CVERecord?id=CVE-2012-5819
CVE-2012-5817 Java library uses JSSE SSLSocket and SSLEngine classes, which do not
verify the hostname.
https://www.cve.org/CVERecord?id=CVE-2012-5817
CVE-2010-1378 chain: incorrect calculation allows attackers to bypass certificate checks.
https://www.cve.org/CVERecord?id=CVE-2010-1378
CVE-2005-3170 LDAP client accepts certificates even if they are not from a trusted CA.
https://www.cve.org/CVERecord?id=CVE-2005-3170
CVE-2009-0265 chain: DNS server does not correctly check return value from the OpenSSL
EVP_VerifyFinal function allows bypass of validation of the certificate chain.
https://www.cve.org/CVERecord?id=CVE-2009-0265
CVE-2003-1229 chain: product checks if client is trusted when it intended to check if the server
is trusted, allowing validation of signed code.
https://www.cve.org/CVERecord?id=CVE-2003-1229
CVE-2002-0862 Cryptographic API, as used in web browsers, mail clients, and other software,
does not properly validate Basic Constraints.
https://www.cve.org/CVERecord?id=CVE-2002-0862
CVE-2009-1358 chain: OS package manager does not check properly check the return value,
allowing bypass using a revoked certificate.
https://www.cve.org/CVERecord?id=CVE-2009-1358
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 731 OWASP Top Ten 2004 Category A10 - Insecure
Configuration Management
711 2339
MemberOf 1029 OWASP Top Ten 2017 Category A3 - Sensitive Data
Exposure
1026 2436
MemberOf 1200 Weaknesses in the 2019 CWE Top 25 Most Dangerous
Software Errors
1200 2587
MemberOf 1353 OWASP Top Ten 2021 Category A07:2021 -
Identification and Authentication Failures
1344 2494
MemberOf 1382 ICS Operations (& Maintenance): Emerging Energy
Technologies
1358 2517
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
CWE Version 4.14
CWE-296: Improper Following of a Certificate's Chain of Trust
CWE-296: Improper Following of a Certificate's Chain of Trust