CWE-1188: Initialization of a Resource with an Insecure Default
The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
A kind of CWE-1419 Incorrect Initialization of Resource.
From the CWE List. © The MITRE Corporation.
Newest
- tianocore edk2, canonical lxd, canonical ltd. ubuntu edk ii +1 more +3 moreAn insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an...6.7 Medium
- hid global iclass se cp1000 encoder, iclass se processors, iclass se reader modules +13 more +15 moreInsecure Default Initialization of Resource in HID Global5.9 Medium
- fastify fastify-swagger-ui, smartbear swagger ui +1 moreDefault swagger-ui configuration exposes all files in the module5.3 Medium
- senec storage box v1, enbw senec storage box firmware, senec storage box v2 +1 more +3 moreSENEC: Storage Box V1,V2 and V3 using default credentials9.8 Critical
- unitronics visilogic, samba 3.5 firmware, samba 4.3 firmware +15 more +17 moreUnitronics VisiLogic uses a default administrative password9.8 Critical
- softether vpnAn authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther...7.3 High
- mtproto mt proto proxyMTProto proxy remote code execution vulnerability8.8 High
- freebsdmsdosfs data disclosure6.5 Medium
- opto 22 snap pac s1, opto22 snap pac s1 firmware +1 moreImproper Access Control in OPTO 22 SNAP PAC S15.8 Medium
- etic telecom remote access server (ras), etictelecom remote access server firmware +1 moreETIC Telecom Insecure Default Initialization of Resource7.1 High
- google androidIn checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb...7.8 High
- debian linux, linux kernel, fedoraproject fedora +6 more +8 moreKernel: tap: tap_open(): correctly initialize socket uid next fix of i_uid to current_fsuid5.5 Medium
- temporal, temporal technologies inc. server +1 moreInsecure Default Authorization in Temporal Server3.0 Low
- huawei emuiConfiguration defects in the secure OS module.Successful exploitation of this vulnerability will...7.5 High
- huawei emuiConfiguration defects in the secure OS module.Successful exploitation of this vulnerability will...7.5 High
- liferay dxp, portal, digital experience platform +2 moreInsecure Default Initialization In Liferay Portal5.3 Medium
- apache inlongApache InLong: Users who joined later can see the data of deleted users6.5 Medium
- mitsubishi electric corporation melsec ws series ws0-geth00200, mitsubishielectric melsec ws0-geth00200 firmware +1 moreAuthentication Bypass Vulnerability in MELSEC WS Series Ethernet Interface Module7.5 High
- apache supersetApache Superset: Session validation vulnerability when using provided default SECRET_KEY8.9 High
- juniper junos os evolvedJunos OS Evolved: Read access to some confidential user information is possible5.3 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed.5.2 Medium
- apache openofficeApache OpenOffice: Empty entry in Java class path7.8 High
- codesys control for beaglebone sl, control for empc-a/imx6 sl, control for iot2000 sl +21 more +23 moreCODESYS: Exposure of Resource to Wrong Sphere in CODESYS V38.8 High
- jetbrains teamcityIn JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents.5.2 Medium
- ghostAn insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation...9.0 Critical
- ghostAn insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation...9.0 Critical
- debian linux, linux kernel +1 moreSpeculative execution attacks in KVM VMX5.8 Medium
- jetbrains teamcityIn JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default...6.6 Medium
- redhat openshiftA flaw was found in Openshift. A pod with a DNSPolicy of "ClusterFirst" may incorrectly resolve...8.1 High
- google androidIn applyKeyguardFlags of NotificationShadeWindowControllerImpl.java, there is a possible way to...5.5 Medium
- intel nuc board nuc5i3mybe firmware, nuc kit nuc5i3myhe firmware +1 moreInsecure default variable initialization in BIOS firmware for some Intel(R) NUC Boards and Intel...5.2 Medium
- heidenhain controller tnc 640 nc software, heros, tnc 640 programming station +2 moreThe HEIDENHAIN Controller TNC 640, version 340590 07 SP5, running HEROS 5.08.3 controlling the...9.2 Critical
- apache isish2 webconsole (available only in prototype mode) should nevertheless be disabled by default.5.3 Medium
- tinyproxy project tinyproxyTinyproxy commit 84f203f and earlier does not process HTTP request lines in the process_request()...7.5 High
- red hat wildfly, redhat amq, amq online +5 more +7 moreWildFly vulnerable to Insecure Default Initialization of Resource7.5 High
- dell powerscale onefs, emc powerscale onefs +1 moreDell PowerScale OneFS, versions 9.0.0, up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0...4.3 Medium
- redhat servicemesh-operator, openshift service mesh +1 moreA flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do...9.8 Critical
- google androidIn WiFi, there is a possible disclosure of WiFi password to the end user due to an insecure...3.3 Low
- codesys plcwinnt, runtime toolkit 32 bit full, runtime toolkit +2 moreInsecure default settings in CODESYS Runtime Toolkit 32 bit full and CODESYS PLCWinNT9.8 Critical
- intel realsense id f450 firmwareInsecure default variable initialization of Intel(R) RealSense(TM) ID Solution F450 before...4.6 Medium
- siemens simatic pcs 7 v8.2, simatic pcs 7 v9.0, simatic pcs 7 v9.1 +8 more +10 moreA vulnerability has been identified in SIMATIC PCS 7 V9.0 and earlier (All versions), SIMATIC PCS...7.8 High
- apache couchdbRemote Code Execution Vulnerability in Packaging9.8 Critical
- google androidIn miniadb, there is a possible way to get read/write access to recovery system properties due to...7.8 High
- motioneye project motioneyeMotionEye allows attackers to access sensitive information7.5 High
- raspberrypi raspberry pi os liteRaspberry Pi OS through 5.10 has the raspberry default password for the pi account. If not...9.8 Critical
- wokkalokka wokka watch q50 firmwareWokka Lokka Q50 devices through 2021-11-30 allow remote attackers (who know the SIM phone number...8.1 High
- getredash redashInsecure default configuration8.1 High
- hitachi energy relion 670 series, relion 670/650 series, relion 670/650/sam600-io +3 more +5 moreInsufficient Security Control Vulnerability8.1 High
- cisco catalyst pon series, catalyst pon switch cgp-ont-1p firmware, catalyst pon switch cgp-ont-4p firmware +3 more +5 moreCisco Catalyst PON Series Switches Optical Network Terminal Vulnerabilities10.0 Critical
- vitec avediastream m9305 firmware, avediastream m9325 firmware, avediastream m9400 firmware +7 more +9 moreVITEC Exterity IPTV products through 2021-04-30 allow privilege escalation to root.9.8 Critical
- Show moreLoading…