CWE-1188: Initialization of a Resource with an Insecure Default
The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
A kind of CWE-1419 Incorrect Initialization of Resource.
From the CWE List. © The MITRE Corporation.
Newest
- ibm open power, p9 openpower +1 moreIBM Open Power Firmware OP910 and OP920 could allow access to BMC via IPMI using default OpenBMC...8.1 High
- progradegrill wifi grilling thermometer firmwareLierda Grill Temperature Monitor V1.00_50006 has a default password of admin for the admin...9.1 Critical
- google androidAn application with overlay permission can display overlays on top of settings UI. This could...7.8 High
- google androidIn OatFileAssistant::GenerateOatFile of oat_file_assistant.cc, there is a possible file...7.8 High
- nortekcontrol linear emerge elite firmware, linear emerge essential firmware +1 moreLinear eMerge E3-Series devices have Default Credentials.9.8 Critical
- netapp aff a700s baseboard management controller, aff a700s firmware, clustered data ontap +2 moreNetApp AFF A700s Baseboard Management Controller (BMC) firmware versions 1.22 and higher were...9.8 Critical
- primasystems flexairPrima Systems FlexAir devices have Default Credentials.9.8 Critical
- hewlett packard enterprise hpe intelligent management center (imc) plat, hp intelligent management center +1 moreA remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC)...9.8 Critical
- google androidIn SmsDefaultDialog.onStart of SmsDefaultDialog.java, there is a possible escalation of privilege...7.3 High
- cisco nx-os software for nexus 9000 series fabric switches aci mode 11.0.1b, nexus 93108tc-ex firmware, nexus 93120tx firmware +11 more +13 moreCisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Default SSH Key Vulnerability9.8 Critical
- doorgets cmsdoorGets 7.0 has a default administrator credential vulnerability. A remote attacker can use this...9.8 Critical
- sonicwall global management system (gms), global management system +1 moreA vulnerability in SonicWall Global Management System (GMS), allow a remote user to gain access...8.1 High
- cerner connectivity engine 4 firmwareAn issue was discovered on Cerner Connectivity Engine (CCE) 4 devices. The user running the main...7.8 High
- androidIn the configuration of NFC modules on certain devices, there is a possible failure to...7.3 High
- mitel inattend, cmg suite +1 moreThe BluStar component in Mitel InAttend before 2.5 SP3 and CMG before 8.4 SP3 Suite Servers has a...9.8 Critical
- netapp service processor, netapp, inc. netapp service processor +1 moreCertain versions between 2.x to 5.x (refer to advisory) of the NetApp Service Processor firmware...9.8 Critical
- thresholdsecurity evisitorpasseVisitorPass contains default administrative credentials. An attacker could exploit this...8.4 High
- jolly technologies lobby track desktop, jollytech lobby track +1 moreLobby Track Desktop contains default administrative credentials. An attacker could exploit this...8.4 High
- cloud foundry stratosCloud Foundry Stratos Deploys With Public Default Session Store Secret8.7 High
- androidIn refresh of DevelopmentTiles.java, there is the possibility of leaving development settings...8.8 High
- identicard premisys idPremisys Identicard version 3.1.190 database uses default credentials. Users are unable to change...9.8 Critical
- safe fme serverSafe Software FME Server through 2018.1 creates and enables three additional accounts in addition...8.8 High
- philips intellispace pacs, isite pacs +1 morePhilips iSite and IntelliSpace PACS, iSite PACS, all versions, and IntelliSpace PACS, all...8.8 High
- martem telem-gw6/gwm, telem-gw6 firmware, telem-gwm firmware +2 moreMartem TELEM GW6/GWM versions prior to 2.0.87-4018403-k4 may allow unprivileged users to modify...8.8 High
- linknet-usa lw-n605r firmwareLINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell...8.8 High
- elastic cloud enterprise (ece), cloud enterprise +1 moreIn Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used...5.9 Medium
- electronjs electronElectron webPreferences vulnerability can be used to perform remote code execution8.1 High
- kaspersky lab kraftway, kraftway 24f2xg router firmware +1 moreRouter Default Credentials in Kraftway 24F2XG Router firmware version 3.5.30.1118 allow remote...9.8 Critical
- ibm maximo asset management, maximo for aviation, maximo for life sciences +5 more +7 moreIBM Maximo Asset Management 7.6 through 7.6.3 installs with a default administrator account that...8.8 High
- intel processor diagnostic toolInstallation tool IPDT (Intel Processor Diagnostic Tool) 4.1.0.24 sets permissions of installed...7.8 High
- cisco meeting serverA vulnerability in Cisco Meeting Server (CMS) could allow an unauthenticated, adjacent attacker...7.4 High
- google android, qualcomm, inc. android for msm, firefox os for msm, qrd android +1 moredcc_curr_list is initialized with a default invalid value that is expected to be programmed by...7.8 High
- d-link dir-550a firmware, dir-604m firmware +1 moreOn D-Link DIR-550A and DIR-604M devices through v2.10KR, a malicious user can use a default...9.8 Critical
- apache tomcat, canonical ubuntu linux, debian linux +5 more +7 moreThe defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins9.8 Critical
- commscope arris tg1682g firmwareArris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices are distributed by some ISPs with a...6.6 Medium
- sierrawireless aleosA vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware...9.8 Critical
- qualcomm mdm9206 firmware, mdm9607 firmware, mdm9635m firmware +25 more +27 moreIn Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon...9.8 Critical
- tendacn ac15 firmwareAn issue was discovered on Tenda AC15 devices. A remote, unauthenticated attacker can make a...9.8 Critical
- cisco elastic services controller, virtual managed services +1 moreA vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic...9.8 Critical
- siemens ruggedcom ros, ruggedcom i800, ruggedcom i800nc +251 more +253 moreA vulnerability has been identified in RUGGEDCOM ROS for RSL910 devices (All versions < ROS V5.0...8.8 High
- broadcom spring web flowInsecure Default Initialization of Resource in Pivotal Spring Web Flow5.9 Medium
- siemens sm-2556 firmwareAn issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants...9.8 Critical
- dell elastic cloud storageEMC Elastic Cloud Storage (ECS) before 3.1 is affected by an undocumented account vulnerability...9.8 Critical
- cisco web security appliance, web security virtual appliance +1 moreA vulnerability in AsyncOS for the Cisco Web Security Appliance (WSA) could allow an...7.5 High
- cisco ultra services framework element managerA vulnerability in Cisco Ultra Services Framework Element Manager could allow an authenticated,...8.8 High
- cisco elastic services controllerA vulnerability in the ConfD CLI of Cisco Elastic Services Controllers could allow an...8.8 High
- cisco elastic services controllerA vulnerability in Cisco Elastic Services Controllers could allow an authenticated, remote...8.8 High
- cisco ultra services framework element managerA vulnerability in Cisco Ultra Services Framework Element Manager could allow an authenticated,...8.8 High
- cisco ultra services framework element managerA vulnerability in Cisco Ultra Services Framework Element Manager could allow an authenticated,...8.8 High
- cisco ultra services framework staging serverA vulnerability in Cisco Ultra Services Framework Staging Server could allow an authenticated,...8.8 High
- Show moreLoading…