CWE-1188 · Initialization of a Resource with an Insecure Default (page 3)
Page 3 of 4 — CVEs classified under CWE-1188, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-33130 | Medium | 4.6 | 2022-05-12 | Insecure default variable initialization of Intel(R) RealSense(TM) ID Solution F450 before version 2.6.0.74 may allow an unauthenticated user to potentially en… |
CVE-2022-24706 | Critical | 9.8 | 2022-04-26 | In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The Couch… |
CVE-2021-39767 | High | 7.8 | 2022-03-30 | In miniadb, there is a possible way to get read/write access to recovery system properties due to an insecure default value. This could lead to local escalatio… |
CVE-2022-25568 | High | 7.5 | 2022-03-24 | MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user p… |
CVE-2021-38759 | Critical | 9.8 | 2021-12-07 | Raspberry Pi OS through 5.10 has the raspberry default password for the pi account. If not changed, attackers can gain administrator privileges. |
CVE-2021-44480 | High | 8.1 | 2021-12-01 | Wokka Lokka Q50 devices through 2021-11-30 allow remote attackers (who know the SIM phone number and password) to listen to a device's surroundings via a callb… |
CVE-2021-41192 | High | 8.1 | 2021-11-24 | Redash is a package for data visualization and sharing. If an admin sets up Redash versions 10.0.0 and prior without explicitly specifying the `REDASH_COOKIE_S… |
CVE-2021-35535 | High | 8.1 | 2021-11-18 | Insecure Boot Image vulnerability in Hitachi Energy Relion Relion 670/650/SAM600-IO series allows an attacker who manages to get access to the front network po… |
CVE-2021-34795 | Critical | 10.0 | 2021-11-04 | Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ON… |
CVE-2021-42109 | Critical | 9.8 | 2021-10-08 | VITEC Exterity IPTV products through 2021-04-30 allow privilege escalation to root. |
CVE-2021-40825 | High | 8.6 | 2021-09-17 | nLight ECLYPSE (nECY) system Controllers running software prior to 1.17.21245.754 contain a default key vulnerability. The nECY does not force a change to the… |
CVE-2021-0114 | Medium | 6.7 | 2021-08-16 | Unchecked return value in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local acce… |
CVE-2021-35965 | Critical | 9.8 | 2021-07-19 | The Orca HCM digital learning platform uses a weak factory default administrator password, which is hard-coded in the source code of the webpage in plain text… |
CVE-2020-12732 | Medium | 6.5 | 2021-07-15 | DEPSTECH WiFi Digital Microscope 3 has a default SSID of Jetion_xxxxxxxx with a password of 12345678. |
CVE-2021-0144 | Medium | 6.7 | 2021-07-14 | Insecure default variable initialization for the Intel BSSA DFT feature may allow a privileged user to potentially enable an escalation of privilege via local… |
CVE-2021-35336 | Critical | 9.8 | 2021-07-01 | Tieline IP Audio Gateway 2.6.4.8 and below is affected by Incorrect Access Control. A vulnerability in the Tieline Web Administrative Interface could allow an… |
CVE-2021-0534 | High | 7.8 | 2021-06-22 | In permission declarations of DeviceAdminReceiver.java, there is a possible lack of broadcast protection due to an insecure default value. This could lead to l… |
CVE-2021-34203 | High | 8.1 | 2021-06-16 | D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. Router ac2600 (dir-2640-us), when setting PPPoE, will start quagga process in the way of… |
CVE-2021-21505 | High | 8.0 | 2021-05-06 | Dell EMC Integrated System for Microsoft Azure Stack Hub, versions 1906 – 2011, contain an undocumented default iDRAC account. A remote unauthenticated attacke… |
CVE-2021-0468 | Medium | 6.6 | 2021-04-13 | In LK, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege for an attacker who has p… |
CVE-2021-28123 | Critical | 9.8 | 2021-04-02 | Undocumented Default Cryptographic Key Vulnerability in Cohesity DataPlatform version 6.3 prior 6.3.1g, 6.4 up to 6.4.1c and 6.5.1 through 6.5.1b. The ssh key… |
CVE-2020-11915 | Medium | 6.8 | 2021-02-08 | An issue was discovered in Svakom Siime Eye 14.1.00000001.3.330.0.0.3.14. By sending a set_params.cgi?telnetd=1&save=1&reboot=1 request to the webserver, it is… |
CVE-2020-10552 | High | 8.1 | 2021-02-05 | An issue was discovered in Psyprax before 3.2.2. The Firebird database is accessible with the default user sysdba and password masterke after installation. Thi… |
CVE-2019-20470 | High | 7.5 | 2021-02-01 | An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It performs actions based on certain SMS commands. This can be used to set up… |
CVE-2020-0019 | Medium | 5.5 | 2020-12-14 | In the Broadcom Nexus firmware, there is an insecure default password. This could lead to local information disclosure in the kernel with no additional executi… |
CVE-2020-0099 | High | 7.8 | 2020-12-14 | In addWindow of WindowManagerService.java, there is a possible window overlay attack due to an insecure default value. This could lead to local escalation of p… |
CVE-2020-4001 | Critical | 9.8 | 2020-11-24 | The SD-WAN Orchestrator 3.3.2, 3.4.x, and 4.0.x has default passwords allowing for a Pass-the-Hash Attack. SD-WAN Orchestrator ships with default passwords for… |
CVE-2020-27555 | Critical | 9.8 | 2020-11-17 | Use of default credentials for the telnet server in BASETech GE-131 BT-1837836 firmware 20180921 allows remote attackers to execute arbitrary system commands a… |
CVE-2020-26510 | Critical | 9.8 | 2020-11-16 | Airleader Master <= 6.21 devices have default credentials that can be used to access the exposed Tomcat Manager for deployment of a new .war file, with resulta… |
CVE-2020-12336 | High | 7.8 | 2020-11-12 | Insecure default variable initialization in firmware for some Intel(R) NUCs may allow an authenticated user to potentially enable escalation of privilege via l… |
CVE-2020-12327 | Medium | 4.4 | 2020-11-12 | Insecure default variable initialization in some Intel(R) Thunderbolt(TM) DCH drivers for Windows* before version 72 may allow a privileged user to potentially… |
CVE-2020-8705 | Medium | 6.8 | 2020-11-12 | Insecure default initialization of resource in Intel(R) Boot Guard in Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14… |
CVE-2020-13927 | Critical | 9.8 | 2020-11-10 | The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who mi… |
CVE-2020-11489 | High | 7.5 | 2020-10-29 | NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contain a vulnerability in… |
CVE-2020-0416 | High | 8.8 | 2020-10-14 | In multiple settings screens, there are possible tapjacking attacks due to an insecure default value. This could lead to local escalation of privilege and perm… |
CVE-2020-26930 | Low | 3.3 | 2020-10-09 | NETGEAR EX7700 devices before 1.0.0.210 are affected by incorrect configuration of security settings. |
CVE-2020-24365 | High | 8.8 | 2020-09-24 | An issue was discovered on Gemtek WRTM-127ACN 01.01.02.141 and WRTM-127x9 01.01.02.127 devices. The Monitor Diagnostic network page allows an authenticated att… |
CVE-2020-0271 | High | 7.3 | 2020-09-18 | In the Settings app, there is an insecure default value. This could lead to local escalation of privilege and tapjacking with User execution privileges needed… |
CVE-2020-0394 | High | 7.8 | 2020-09-17 | In onCreate of BluetoothPairingDialog.java, there is a possible tapjacking vector due to an insecure default value. This could lead to local escalation of priv… |
CVE-2020-0386 | Medium | 5.5 | 2020-09-17 | In onCreate of RequestPermissionActivity.java, there is a possible tapjacking vector due to an insecure default value. This could lead to local escalation of p… |
CVE-2020-16873 | Medium | 4.7 | 2020-09-11 | <p>A spoofing vulnerability manifests in Microsoft Xamarin.Forms due to the default settings on Android WebView version prior to 83.0.4103.106. This vulnerabil… |
CVE-2020-7729 | High | 7.1 | 2020-09-03 | The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement saf… |
CVE-2020-7685 | Medium | 5.4 | 2020-07-28 | This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The pa… |
CVE-2020-10279 | Critical | 9.8 | 2020-06-24 | MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system, Thought for desktop uses, this operating system presents inse… |
CVE-2020-14011 | Critical | 9.8 | 2020-06-15 | Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin account, unless "Built-in admin" is manually… |
CVE-2020-11532 | Critical | 9.8 | 2020-05-08 | Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. This allows an attacker to byp… |
CVE-2020-8828 | High | 8.8 | 2020-04-08 | As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for… |
CVE-2019-13393 | High | 7.5 | 2020-03-13 | The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses the same default 8 character passphrase for the administrative console and the WPA2 pre-shared ke… |
CVE-2019-17274 | High | 7.8 | 2020-02-26 | NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller (BMC) firmware versions 13.x prior to 13.1P1 were shipped with a default account enabled that… |
CVE-2019-1950 | High | 8.4 | 2020-02-19 | A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, local attacker to gain unauthorized access to an affected device. The vulnerabi… |
CVE-2014-0234 | Critical | 9.8 | 2020-02-12 | The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attac… |
CVE-2019-16272 | Critical | 9.8 | 2020-01-06 | On DTEN D5 and D7 before 1.3.4 devices, factory settings allows for firmware reflash and Android Debug Bridge (adb) enablement. |
CVE-2019-19340 | High | 8.2 | 2019-12-19 | A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager by setting it with '-e rabbitmq_enable_m… |
CVE-2019-19251 | Medium | 5.3 | 2019-12-10 | The Last.fm desktop app (Last.fm Scrobbler) through 2.1.39 on macOS makes HTTP requests that include an API key without the use of SSL/TLS. Although there is a… |
CVE-2019-4621 | Critical | 9.8 | 2019-12-09 | IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is… |
CVE-2019-2197 | Medium | 5.5 | 2019-11-13 | In processPhonebookAccess of CachedBluetoothDevice.java, there is a possible permission bypass due to an insecure default value. This could lead to local infor… |
CVE-2008-3278 | High | 7.8 | 2019-11-07 | frysk packages through 2008-08-05 as shipped in Red Hat Enterprise Linux 5 are built with an insecure RPATH set in the ELF header of multiple binaries in /usr/… |
CVE-2010-2247 | High | 7.5 | 2019-11-06 | makepasswd 1.10 default settings generate insecure passwords |
CVE-2019-16102 | Critical | 9.8 | 2019-09-08 | Silver Peak EdgeConnect SD-WAN before 8.1.7.x has an SNMP service with a public value for rocommunity and trapcommunity. |
CVE-2019-14222 | Critical | 9.8 | 2019-09-05 | An issue was discovered in Alfresco Community Edition versions 6.0 and lower. An unauthenticated, remote attacker could authenticate to Alfresco's Solr Web Adm… |
CVE-2019-4169 | Critical | 9.1 | 2019-08-26 | IBM Open Power Firmware OP910 and OP920 could allow access to BMC via IPMI using default OpenBMC password even after BMC password was changed away from the def… |
CVE-2019-15304 | Critical | 9.1 | 2019-08-26 | Lierda Grill Temperature Monitor V1.00_50006 has a default password of admin for the admin account, which allows an attacker to cause a Denial of Service or In… |
CVE-2019-2131 | High | 7.8 | 2019-08-20 | An application with overlay permission can display overlays on top of settings UI. This could lead to local escalation of privilege with no additional executio… |
CVE-2019-2120 | High | 7.8 | 2019-08-20 | In OatFileAssistant::GenerateOatFile of oat_file_assistant.cc, there is a possible file corruption issue due to an insecure default value. This could lead to l… |
CVE-2019-7252 | Critical | 9.8 | 2019-07-02 | Linear eMerge E3-Series devices have Default Credentials. |
CVE-2019-5497 | Critical | 9.8 | 2019-07-01 | NetApp AFF A700s Baseboard Management Controller (BMC) firmware versions 1.22 and higher were shipped with a default account enabled that could allow unauthori… |
CVE-2019-7668 | Critical | 9.8 | 2019-07-01 | Prima Systems FlexAir devices have Default Credentials. |
CVE-2019-5367 | Critical | 9.8 | 2019-06-05 | A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. |
CVE-2019-2043 | High | 7.3 | 2019-05-08 | In SmsDefaultDialog.onStart of SmsDefaultDialog.java, there is a possible escalation of privilege due to an overlay attack. This could lead to local escalation… |
CVE-2019-1804 | Critical | 9.8 | 2019-05-03 | A vulnerability in the SSH key management for the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an unauthen… |
CVE-2019-11618 | Critical | 9.8 | 2019-04-30 | doorGets 7.0 has a default administrator credential vulnerability. A remote attacker can use this vulnerability to gain administrator privileges for the creati… |
CVE-2019-7476 | High | 8.1 | 2019-04-26 | A vulnerability in SonicWall Global Management System (GMS), allow a remote user to gain access to the appliance using existing SSH key. This vulnerability aff… |
CVE-2018-20052 | High | 7.8 | 2019-04-25 | An issue was discovered on Cerner Connectivity Engine (CCE) 4 devices. The user running the main CCE firmware has NOPASSWD sudo privileges to several utilities… |
CVE-2019-2041 | High | 7.3 | 2019-04-19 | In the configuration of NFC modules on certain devices, there is a possible failure to distinguish individual devices due to an insecure default value. This co… |
CVE-2018-19275 | Critical | 9.8 | 2019-04-02 | The BluStar component in Mitel InAttend before 2.5 SP3 and CMG before 8.4 SP3 Suite Servers has a default password, which could allow remote attackers to gain… |
CVE-2019-5490 | Critical | 9.8 | 2019-03-21 | Certain versions between 2.x to 5.x (refer to advisory) of the NetApp Service Processor firmware were shipped with a default account enabled that could allow u… |
CVE-2018-17497 | High | 8.4 | 2019-03-21 | eVisitorPass contains default administrative credentials. An attacker could exploit this vulnerability to gain full access to the application. |
CVE-2018-17485 | High | 8.4 | 2019-03-21 | Lobby Track Desktop contains default administrative credentials. An attacker could exploit this vulnerability to gain full access to the application. |
CVE-2019-3783 | High | 8.8 | 2019-03-07 | Cloud Foundry Stratos, versions prior to 2.3.0, deploys with a public default session store secret. A malicious user with default session store secret can brut… |
CVE-2019-1994 | High | 8.8 | 2019-02-28 | In refresh of DevelopmentTiles.java, there is the possibility of leaving development settings accessible due to an insecure default value. This could lead to u… |
CVE-2019-3909 | Critical | 9.8 | 2019-01-18 | Premisys Identicard version 3.1.190 database uses default credentials. Users are unable to change the credentials without vendor intervention. |
CVE-2018-20402 | High | 8.8 | 2018-12-23 | Safe Software FME Server through 2018.1 creates and enables three additional accounts in addition to the initial administrator account. The passwords to the th… |
CVE-2018-17906 | High | 8.8 | 2018-11-19 | Philips iSite and IntelliSpace PACS, iSite PACS, all versions, and IntelliSpace PACS, all versions. Default credentials and no authentication within third part… |
CVE-2018-10605 | High | 8.8 | 2018-10-01 | Martem TELEM GW6/GWM versions prior to 2.0.87-4018403-k4 may allow unprivileged users to modify/upload a new system configuration or take the full control over… |
CVE-2018-16752 | High | 8.8 | 2018-09-20 | LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools… |
CVE-2018-3825 | Medium | 5.9 | 2018-09-19 | In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch… |
CVE-2018-15685 | High | 8.1 | 2018-08-23 | GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options… |
CVE-2018-15350 | Critical | 9.8 | 2018-08-17 | Router Default Credentials in Kraftway 24F2XG Router firmware version 3.5.30.1118 allow remote attackers to get privileged access to the router. |
CVE-2018-1524 | High | 8.8 | 2018-08-03 | IBM Maximo Asset Management 7.6 through 7.6.3 installs with a default administrator account that a remote intruder could use to gain administrator access to th… |
CVE-2018-3667 | High | 7.8 | 2018-07-10 | Installation tool IPDT (Intel Processor Diagnostic Tool) 4.1.0.24 sets permissions of installed files incorrectly, allowing for execution of arbitrary code and… |
CVE-2018-0263 | High | 7.4 | 2018-06-07 | A vulnerability in Cisco Meeting Server (CMS) could allow an unauthenticated, adjacent attacker to access services running on internal device interfaces of an… |
CVE-2018-5841 | High | 7.8 | 2018-06-06 | dcc_curr_list is initialized with a default invalid value that is expected to be programmed by the user through a sysfs node which could lead to an invalid acc… |
CVE-2018-10968 | Critical | 9.8 | 2018-05-18 | On D-Link DIR-550A and DIR-604M devices through v2.10KR, a malicious user can use a default TELNET account to get unauthorized access to vulnerable devices, ak… |
CVE-2018-8014 | Critical | 9.8 | 2018-05-16 | The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and… |
CVE-2018-10989 | Medium | 6.6 | 2018-05-14 | Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices are distributed by some ISPs with a default password of "password" for the admin account that is u… |
CVE-2018-10251 | Critical | 9.8 | 2018-05-04 | A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.7 and GX450, ES450, RV50, RV50X, MP70, and MP70E rou… |
CVE-2018-3591 | Critical | 9.8 | 2018-04-11 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, SD 210/SD 212… |
CVE-2018-5770 | Critical | 9.8 | 2018-03-20 | An issue was discovered on Tenda AC15 devices. A remote, unauthenticated attacker can make a request to /goform/telnet, creating a telnetd service on the devic… |
CVE-2018-0130 | Critical | 9.8 | 2018-02-22 | A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, rem… |
CVE-2017-12736 | High | 8.8 | 2017-12-26 | After initial configuration, the Ruggedcom Discovery Protocol (RCDP) is still able to write to the device under certain conditions. This could allow an atta… |