CWE-1188 · Initialization of a Resource with an Insecure Default (page 2)
Page 2 of 4 — CVEs classified under CWE-1188, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-61481 | Critical | 10.0 | 2025-10-27 | An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to… |
CVE-2025-41245 | Medium | 4.9 | 2025-09-29 | VMware Aria Operations contains an information disclosure vulnerability. A malicious actor with non-administrative privileges in Aria Operations may exploit th… |
CVE-2025-57295 | High | 8.0 | 2025-09-18 | H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials. The root user account has no passw… |
CVE-2025-43797 | Medium | 5.4 | 2025-09-15 | In Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and olde… |
CVE-2025-41713 | Medium | 6.5 | 2025-09-15 | During a short time frame while the device is booting an unauthenticated remote attacker can send traffic to unauthorized networks due to the switch operating… |
CVE-2025-36222 | High | 8.7 | 2025-09-11 | IBM Fusion 2.2.0 through 2.10.1, IBM Fusion HCI 2.2.0 through 2.10.0, and IBM Fusion HCI for watsonx 2.8.2 through 2.10.0 uses insecure default configurations… |
CVE-2025-59044 | Medium | 4.4 | 2025-09-09 | Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau 0.9.x derives numeric GIDs for Entra ID groups from the group displ… |
CVE-2025-32330 | Medium | 5.7 | 2025-09-04 | In generateRandomPassword of LocalBluetoothLeBroadcast.java, there is a possible way to intercept the Auracast audio stream due to an insecure default value. T… |
CVE-2025-38523 | High | 7.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: cifs: Fix the smbd_response slab to allow usercopy The handling of received data in the s… |
CVE-2025-7353 | | 2025-08-14 | A security issue exists due to the web-based debugger agent enabled on Rockwell Automation ControlLogix® Ethernet Modules. If a specific IP address is used to… | |
CVE-2025-54127 | Critical | 9.8 | 2025-07-21 | HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance. In versions 11.0.6 and below, the NodeJS version of HAXcms uses… |
CVE-2025-44647 | High | 7.3 | 2025-07-21 | In TRENDnet TEW-WLC100P 2.03b03, the i_dont_care_about_security_and_use_aggressive_mode_psk option is enabled in the strongSwan configuration file, so that IKE… |
CVE-2025-25271 | High | 8.8 | 2025-07-08 | An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface. |
CVE-2025-41672 | Critical | 10.0 | 2025-07-07 | A remote unauthenticated attacker may use default certificates to generate JWT Tokens and gain full access to the tool and all connected devices. |
CVE-2025-53602 | Medium | 5.3 | 2025-07-04 | Zipkin through 3.5.1 has a /heapdump endpoint (associated with the use of Spring Boot Actuator), a similar issue to CVE-2025-48927. |
CVE-2025-24288 | Critical | 9.8 | 2025-06-19 | The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts (most… |
CVE-2025-41438 | Critical | 9.8 | 2025-05-30 | The CS5000 Fire Panel is vulnerable due to a default account that exists on the panel. Even though it is possible to change this by SSHing into the device, i… |
CVE-2025-48927 | Medium | 5.3 | 2025-05-28 | The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in M… |
CVE-2025-47945 | Critical | 9.1 | 2025-05-17 | Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens (JWT) for authentication, but the sign… |
CVE-2025-31930 | High | 8.8 | 2025-05-13 | A vulnerability has been identified in IEC 1Ph 7.4kW Child socket (8EM1310-2EH04-0GA0) (All versions < V2.135), IEC 1Ph 7.4kW Child socket/ shutter (8EM1310-2E… |
CVE-2025-22248 | High | 7.5 | 2025-05-13 | The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated a… |
CVE-2025-46599 | Medium | 6.8 | 2025-04-25 | CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is se… |
CVE-2025-1863 | Critical | 9.8 | 2025-04-18 | Insecure default settings have been found in recorder products provided by Yokogawa Electric Corporation. The default setting of the authentication function is… |
CVE-2025-43015 | High | 8.3 | 2025-04-17 | In JetBrains RubyMine before 2025.1 remote Interpreter overwrote ports to listen on all interfaces |
CVE-2025-2442 | Medium | 6.8 | 2025-04-09 | CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could potentially lead to unauthorized access which could result in t… |
CVE-2025-2441 | Medium | 4.6 | 2025-04-09 | CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could lead to loss of confidentiality when a malicious user, having p… |
CVE-2025-27443 | Low | 2.8 | 2025-04-08 | Insecure default variable initialization in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a loss of integrity via local acces… |
CVE-2025-29985 | Medium | 6.5 | 2025-04-08 | Dell Common Event Enabler, version(s) CEE 9.0.0.0, contain(s) an Initialization of a Resource with an Insecure Default vulnerability in the Common Anti-Virus A… |
CVE-2025-27809 | Medium | 5.4 | 2025-03-25 | Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client… |
CVE-2024-8313 | | 2025-03-25 | An Exposure of Sensitive System Information to an Unauthorized Control Sphere and Initialization of a Resource with an Insecure Default vulnerability in the SN… | |
CVE-2024-41975 | Medium | 5.3 | 2025-03-18 | An unauthenticated remote attacker can gain limited information of the PLC network but the user management of the PLCs prevents the actual access to the PLCs. |
CVE-2025-1960 | Critical | 9.8 | 2025-03-12 | CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an attacker to execute unauthorized commands when a syste… |
CVE-2025-2129 | Medium | 5.6 | 2025-03-09 | A vulnerability was found in Mage AI 0.9.75. It has been classified as problematic. This affects an unknown part. The manipulation leads to insecure default in… |
CVE-2024-50390 | Critical | 9.8 | 2025-03-07 | A command injection vulnerability has been reported to affect QHora. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands… |
CVE-2022-49099 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Fix initialization of device object in vmbus_device_register() Initia… |
CVE-2024-48122 | Medium | 6.7 | 2025-01-15 | Insecure default configurations in HI-SCAN 6040i Hitrax HX-03-19-I allow authenticated attackers with low-level privileges to escalate to root-level privileges. |
CVE-2024-56433 | Low | 3.6 | 2024-12-26 | shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can r… |
CVE-2024-51758 | | 2024-11-07 | Filament is a collection of full-stack components for accelerated Laravel development. All Filament features that interact with storage use the `default_filesy… | |
CVE-2020-11917 | Medium | 4.3 | 2024-11-07 | An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. It uses a default SSID value, which makes it easier for remote attackers to discover the phy… |
CVE-2019-25219 | High | 7.5 | 2024-10-29 | Asio C++ Library before 1.13.0 lacks a fallback error code in the case of SSL_ERROR_SYSCALL with no associated error information from the SSL library being use… |
CVE-2024-9949 | Medium | 6.1 | 2024-10-23 | Denial of Service in Forescout SecureConnector 11.1.02.1019 on Windows allows Unprivileged user to corrupt the configuration file and cause Denial of Service i… |
CVE-2024-30124 | Medium | 4.0 | 2024-10-23 | HCL Sametime is impacted by insecure services in-use on the UIM client by default. An unused legacy REST service was enabled by default using the HTTP protocol… |
CVE-2024-45217 | High | 8.1 | 2024-10-16 | Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via a Restore command, which copy a configSet from t… |
CVE-2024-47295 | High | 8.1 | 2024-10-01 | Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the d… |
CVE-2024-0001 | Critical | 10.0 | 2024-09-23 | A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor… |
CVE-2024-44096 | Medium | 4.4 | 2024-09-13 | there is a possible arbitrary read due to an insecure default value. This could lead to local information disclosure with System execution privileges needed. U… |
CVE-2024-8383 | High | 7.5 | 2024-09-03 | Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did n… |
CVE-2024-45313 | Medium | 5.4 | 2024-09-02 | Overleaf is a web-based collaborative LaTeX editor. When installing Server Pro using the Overleaf Toolkit from before 2024-07-17 or legacy docker-compose.yml f… |
CVE-2024-34734 | High | 7.8 | 2024-08-15 | In onForegroundServiceButtonClicked of FooterActionsViewModel.kt, there is a possible way to disable the active VPN app from the lockscreen due to an insecure… |
CVE-2024-5801 | | 2024-08-12 | Enabled IP Forwarding feature in B&R Automation Runtime versions before 6.0.2 may allow remote attack-ers to compromise network security by routing IP-based pa… | |
CVE-2024-41995 | High | 7.5 | 2024-08-06 | Initialization of a resource with an insecure default vulnerability exists in JavaTM Platform Ver.12.89 and earlier. If this vulnerability is exploited, the pr… |
CVE-2024-31070 | Critical | 9.1 | 2024-07-17 | Initialization of a resource with an insecure default vulnerability in FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. al… |
CVE-2024-39916 | Medium | 6.4 | 2024-07-12 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. There is a security issue with the NFS configuration in /etc/exports genera… |
CVE-2021-47343 | High | 7.8 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved: dm btree remove: assign new_root only when removal succeeds remove_raw() in dm_btree_remo… |
CVE-2024-34063 | Low | 2.5 | 2024-05-03 | vodozemac is an implementation of Olm and Megolm in pure Rust. Versions 0.5.0 and 0.5.1 of vodozemac have degraded secret zeroization capabilities, due to chan… |
CVE-2024-32114 | High | 8.5 | 2024-05-02 | In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It… |
CVE-2024-2912 | Critical | 10.0 | 2024-04-16 | An insecure deserialization vulnerability exists in the BentoML framework, allowing remote code execution (RCE) by sending a specially crafted POST request. By… |
CVE-2024-28815 | Critical | 9.8 | 2024-03-27 | A vulnerability in the BluStar component of Mitel InAttend 2.6 SP4 through 2.7 and CMG 8.5 SP4 through 8.6 could allow access to sensitive information, changes… |
CVE-2024-25972 | High | 8.3 | 2024-03-01 | Initialization of a resource with an insecure default vulnerability in OET-213H-BTS1 sold in Japan by Atsumi Electric Co., Ltd. allows a network-adjacent unaut… |
CVE-2024-0387 | Medium | 6.5 | 2024-02-26 | The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to th… |
CVE-2024-26267 | Medium | 5.3 | 2024-02-20 | In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, an… |
CVE-2024-25610 | Critical | 9.0 | 2024-02-20 | In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 before fix pack 19, and… |
CVE-2023-48733 | Medium | 6.7 | 2024-02-14 | An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot. |
CVE-2024-22388 | Medium | 5.9 | 2024-02-06 | Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data… |
CVE-2024-22207 | Medium | 5.3 | 2024-01-15 | fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of `@fastify/swagger-ui` without `baseDir` set will l… |
CVE-2023-6448 | Critical | 9.8 | 2023-12-05 | Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with ne… |
CVE-2023-27516 | High | 7.3 | 2023-10-12 | An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially crafted network p… |
CVE-2023-45312 | High | 8.8 | 2023-10-10 | In the mtproto_proxy (aka MTProto proxy) component through 0.7.2 for Erlang, a low-privileged remote attacker can access an improperly secured default installa… |
CVE-2023-5368 | Medium | 6.5 | 2023-10-04 | On an msdosfs filesystem, the 'truncate' or 'ftruncate' system calls under certain circumstances populate the additional space in the file with unallocated dat… |
CVE-2023-40708 | Medium | 5.8 | 2023-08-24 | The File Transfer Protocol (FTP) port is open by default in the SNAP PAC S1 Firmware version R10.3b. This could allow an adversary to access some device files. |
CVE-2023-3453 | High | 7.1 | 2023-08-23 | ETIC Telecom RAS versions 4.7.0 and prior the web management portal authentication disabled by default. This could allow an attacker with adjacent network acc… |
CVE-2023-35689 | High | 7.8 | 2023-08-14 | In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure default value. This c… |
CVE-2023-3485 | Low | 3.0 | 2023-06-30 | Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other… |
CVE-2022-48493 | High | 7.5 | 2023-06-19 | Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability. |
CVE-2022-48492 | High | 7.5 | 2023-06-19 | Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability. |
CVE-2023-33949 | Medium | 5.3 | 2023-05-24 | In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email address, which allo… |
CVE-2023-31101 | Medium | 6.5 | 2023-05-22 | Insecure Default Initialization of Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.6… |
CVE-2023-1618 | High | 7.5 | 2023-05-19 | Active Debug Code vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 Serial number 2310 **** and prior allows a remote unauthentic… |
CVE-2023-27524 | High | 8.9 | 2023-04-24 | Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY accordi… |
CVE-2023-28978 | Medium | 5.3 | 2023-04-17 | An Insecure Default Initialization of Resource vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network based attacker to read cer… |
CVE-2022-48432 | Medium | 5.2 | 2023-03-29 | In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed. |
CVE-2022-38745 | High | 7.8 | 2023-03-24 | Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the curr… |
CVE-2022-4224 | High | 8.8 | 2023-03-23 | In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS re… |
CVE-2022-48342 | Medium | 5.2 | 2023-02-23 | In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents. |
CVE-2022-47196 | Medium | 5.4 | 2023-01-19 | An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administr… |
CVE-2022-47194 | Medium | 5.4 | 2023-01-19 | An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administr… |
CVE-2022-2196 | Medium | 5.8 | 2023-01-09 | A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 th… |
CVE-2022-20466 | Medium | 5.5 | 2022-12-13 | In applyKeyguardFlags of NotificationShadeWindowControllerImpl.java, there is a possible way to observe the user's password on a secondary display due to an in… |
CVE-2022-46831 | Medium | 6.6 | 2022-12-08 | In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project administrators to… |
CVE-2022-3262 | High | 8.1 | 2022-12-08 | A flaw was found in Openshift. A pod with a DNSPolicy of "ClusterFirst" may incorrectly resolve the hostname based on a service provided. This flaw allows an a… |
CVE-2022-36349 | Medium | 5.2 | 2022-11-11 | Insecure default variable initialization in BIOS firmware for some Intel(R) NUC Boards and Intel(R) NUC Kits before version MYi30060 may allow an authenticated… |
CVE-2022-41648 | Critical | 9.8 | 2022-10-28 | The HEIDENHAIN Controller TNC 640 NC software Version 340590 07 SP5, is vulnerable to improper authentication in its DNC communication for CNC machines. Authen… |
CVE-2022-42467 | Medium | 5.3 | 2022-10-19 | When running in prototype mode, the h2 webconsole module (accessible from the Prototype menu) is automatically made available with the ability to directly quer… |
CVE-2022-40468 | High | 7.5 | 2022-09-19 | Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier u… |
CVE-2022-1278 | High | 7.5 | 2022-09-13 | A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain. |
CVE-2022-32480 | Medium | 4.3 | 2022-08-22 | Dell PowerScale OneFS, versions 9.0.0, up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain an insecure default initialization of a resource v… |
CVE-2021-3586 | Critical | 9.8 | 2022-08-22 | A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify which ports may be accessed, allowing acces… |
CVE-2022-20342 | Low | 3.3 | 2022-08-12 | In WiFi, there is a possible disclosure of WiFi password to the end user due to an insecure default value. This could lead to local information disclosure with… |
CVE-2022-31806 | Critical | 9.8 | 2022-06-24 | In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no information or promp… |
CVE-2022-24287 | High | 7.8 | 2022-05-20 | A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC06), SIMATIC PCS 7 V9.1 (All versions <… |