CWE-1188: Initialization of a Resource with an Insecure Default
The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
A kind of CWE-1419 Incorrect Initialization of Resource.
From the CWE List. © The MITRE Corporation.
Newest
- apache software foundation james Apache James: WebAdmin exposed without authentication on official Docker default No score
- apache software foundation ofbiz Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation No score
- rubyonrails active storage The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing... 9.8 Critical
- node-opcua node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions 9.1 Critical
- temporal technologies, inc. server Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service host 8.7 High
- No product listed WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page 7.5 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 more pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate 7.1 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 more pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials 7.1 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 more pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity 7.1 High
- opentext advanced authentication server Endpoint credential minting (insecure default allow-list) 2.9 Low
- gudong2003 xianyu-auto-reply-fix xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message 6.3 Medium
-
libmime-tools-perlDebian,perl-MIME-toolsopenSUSE +1 more MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion 7.5 High - apache software foundation kafka Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default 5.9 Medium
- authlib Authlib RFC 7592 examples omit registration-access-token client binding 8.8 High
- hallo welt! gmbh bluespice bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop 9.3 Critical
- authlib Authlib: Default JWT bearer grant accepts assertions for the wrong audience 6.8 Medium
- storybookjs storybook Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files 8.7 High
- dynamics365ninja d365fo-mcp-server D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disabled by default, exposing proprietary X++ source over the public internet 7.5 High
- polonel trudesk Trudesk through 1.2.11 Missing Authentication on Debug Routes 8.3 High
- a2aproject a2a-java A2A Java SDK has a fail-open default task authorization 7.5 High
- letta-ai letta Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access 9.3 Critical
- bytedance coze-studio Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner 8.7 High
- cognicellai cognition Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backend 9.2 Critical
- apache software foundation kylin Apache Kylin: default startup profile miss security settings 7.5 High
- google sam Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM) 9.3 Critical
- error311 filerise FileRise: Insecure default cryptographic key fallback in manual installs 5.9 Medium
- holaboss-ai holaos holaOS through 2026.822.1 Missing Authorization in Channel-Gateway Connectors 8.3 High
- moghtech komodo Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration 9.3 Critical
- epic games unreal engine Epic Games Unreal Engine Insecure Default URL Scheme Allowance in LaunchURL 7.7 High
- ibm mcp-context-forge MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery 9.8 Critical
- sap se abap platform Missing authorization check in SAP ABAP Platform 7.1 High
- sap se sap/cloud-security-services-integration-library Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-services-integration-library 4.2 Medium
- th0rgal sandboxed.sh sandboxed.sh through 1.3.0 Container Escape via nsenter Missing Root Namespace 9.3 Critical
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 more Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an... 6.3 Medium
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 more Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an... 5.2 Medium
- obsidian desktop Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass 8.4 High
- obsidian desktop Obsidian Desktop < 1.14.0 RCE via Slides Plugin Markdown 8.5 High
- splunk, splunk enterprise +1 more Information Disclosure in the Discover Splunk Observability Cloud app through Splunk Web for Splunk Enterprise 4.3 Medium
- ovhcloud Authenticated SMTP Sender Address Forgery 6.3 Medium
- docling, docling-project docling-slim +1 more Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine 7.5 High
- aws loom Missing authentication for critical function in Loom for AWS 10.0 Critical
- apache software foundation thrift Apache Thrift: Perl TLS client disables certificate verification by default 6.9 Medium
- apache software foundation thrift Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a pee… 8.7 High
- apache software foundation thrift Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default 8.2 High
- johnson controls easyio fs32 : Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32... 5.6 Medium
- jetbrains youtrack In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a... 5.3 Medium
- anjvision yssd-rtmp-h5 Initialization of a resource with an insecure default in Anjvision YSSD-RTMP-H5 9.3 Critical
- electron Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions 8.3 High
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 more Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an... 3.8 Low
- gimanh taskview-community Taskview Community Missing Authentication via OAuth Dynamic Client Registration 8.5 High
- Show olderLoading…