CWE-1188 · Initialization of a Resource with an Insecure Default (page 3)
Page 3 of 4 — CVEs classified under CWE-1188, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-3485 | Low | 3.0 | 2023-06-30 | Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other… |
CVE-2022-48493 | High | 7.5 | 2023-06-19 | Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability. |
CVE-2022-48492 | High | 7.5 | 2023-06-19 | Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability. |
CVE-2023-33949 | Medium | 5.3 | 2023-05-24 | In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email address, which allo… |
CVE-2023-31101 | Medium | 6.5 | 2023-05-22 | Insecure Default Initialization of Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.6… |
CVE-2023-1618 | High | 7.5 | 2023-05-19 | Active Debug Code vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 Serial number 2310 **** and prior allows a remote unauthentic… |
CVE-2023-27524 | High | 8.9 | 2023-04-24 | Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY accordi… |
CVE-2023-28978 | Medium | 5.3 | 2023-04-17 | An Insecure Default Initialization of Resource vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network based attacker to read cer… |
CVE-2022-48432 | Medium | 5.2 | 2023-03-29 | In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed. |
CVE-2022-38745 | High | 7.8 | 2023-03-24 | Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the curr… |
CVE-2022-4224 | High | 8.8 | 2023-03-23 | In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS re… |
CVE-2022-48342 | Medium | 5.2 | 2023-02-23 | In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents. |
CVE-2022-47196 | Medium | 5.4 | 2023-01-19 | An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administr… |
CVE-2022-47194 | Medium | 5.4 | 2023-01-19 | An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administr… |
CVE-2022-2196 | Medium | 5.8 | 2023-01-09 | A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 th… |
CVE-2022-20466 | Medium | 5.5 | 2022-12-13 | In applyKeyguardFlags of NotificationShadeWindowControllerImpl.java, there is a possible way to observe the user's password on a secondary display due to an in… |
CVE-2022-46831 | Medium | 6.6 | 2022-12-08 | In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project administrators to… |
CVE-2022-3262 | High | 8.1 | 2022-12-08 | A flaw was found in Openshift. A pod with a DNSPolicy of "ClusterFirst" may incorrectly resolve the hostname based on a service provided. This flaw allows an a… |
CVE-2022-36349 | Medium | 5.2 | 2022-11-11 | Insecure default variable initialization in BIOS firmware for some Intel(R) NUC Boards and Intel(R) NUC Kits before version MYi30060 may allow an authenticated… |
CVE-2022-41648 | Critical | 9.8 | 2022-10-28 | The HEIDENHAIN Controller TNC 640 NC software Version 340590 07 SP5, is vulnerable to improper authentication in its DNC communication for CNC machines. Authen… |
CVE-2022-42467 | Medium | 5.3 | 2022-10-19 | When running in prototype mode, the h2 webconsole module (accessible from the Prototype menu) is automatically made available with the ability to directly quer… |
CVE-2022-40468 | High | 7.5 | 2022-09-19 | Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier u… |
CVE-2022-1278 | High | 7.5 | 2022-09-13 | A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain. |
CVE-2022-32480 | Medium | 4.3 | 2022-08-22 | Dell PowerScale OneFS, versions 9.0.0, up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain an insecure default initialization of a resource v… |
CVE-2021-3586 | Critical | 9.8 | 2022-08-22 | A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify which ports may be accessed, allowing acces… |
CVE-2022-20342 | Low | 3.3 | 2022-08-12 | In WiFi, there is a possible disclosure of WiFi password to the end user due to an insecure default value. This could lead to local information disclosure with… |
CVE-2022-31806 | Critical | 9.8 | 2022-06-24 | In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no information or promp… |
CVE-2022-24287 | High | 7.8 | 2022-05-20 | A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC06), SIMATIC PCS 7 V9.1 (All versions <… |
CVE-2021-33130 | Medium | 4.6 | 2022-05-12 | Insecure default variable initialization of Intel(R) RealSense(TM) ID Solution F450 before version 2.6.0.74 may allow an unauthenticated user to potentially en… |
CVE-2022-24706 | Critical | 9.8 | 2022-04-26 | In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The Couch… |
CVE-2021-39767 | High | 7.8 | 2022-03-30 | In miniadb, there is a possible way to get read/write access to recovery system properties due to an insecure default value. This could lead to local escalatio… |
CVE-2022-25568 | High | 7.5 | 2022-03-24 | MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user p… |
CVE-2021-38759 | Critical | 9.8 | 2021-12-07 | Raspberry Pi OS through 5.10 has the raspberry default password for the pi account. If not changed, attackers can gain administrator privileges. |
CVE-2021-44480 | High | 8.1 | 2021-12-01 | Wokka Lokka Q50 devices through 2021-11-30 allow remote attackers (who know the SIM phone number and password) to listen to a device's surroundings via a callb… |
CVE-2021-41192 | High | 8.1 | 2021-11-24 | Redash is a package for data visualization and sharing. If an admin sets up Redash versions 10.0.0 and prior without explicitly specifying the `REDASH_COOKIE_S… |
CVE-2021-35535 | High | 8.1 | 2021-11-18 | Insecure Boot Image vulnerability in Hitachi Energy Relion Relion 670/650/SAM600-IO series allows an attacker who manages to get access to the front network po… |
CVE-2021-34795 | Critical | 10.0 | 2021-11-04 | Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ON… |
CVE-2021-42109 | Critical | 9.8 | 2021-10-08 | VITEC Exterity IPTV products through 2021-04-30 allow privilege escalation to root. |
CVE-2021-40825 | High | 8.6 | 2021-09-17 | nLight ECLYPSE (nECY) system Controllers running software prior to 1.17.21245.754 contain a default key vulnerability. The nECY does not force a change to the… |
CVE-2021-0114 | Medium | 6.7 | 2021-08-16 | Unchecked return value in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local acce… |
CVE-2021-35965 | Critical | 9.8 | 2021-07-19 | The Orca HCM digital learning platform uses a weak factory default administrator password, which is hard-coded in the source code of the webpage in plain text… |
CVE-2020-12732 | Medium | 6.5 | 2021-07-15 | DEPSTECH WiFi Digital Microscope 3 has a default SSID of Jetion_xxxxxxxx with a password of 12345678. |
CVE-2021-0144 | Medium | 6.7 | 2021-07-14 | Insecure default variable initialization for the Intel BSSA DFT feature may allow a privileged user to potentially enable an escalation of privilege via local… |
CVE-2021-35336 | Critical | 9.8 | 2021-07-01 | Tieline IP Audio Gateway 2.6.4.8 and below is affected by Incorrect Access Control. A vulnerability in the Tieline Web Administrative Interface could allow an… |
CVE-2021-0534 | High | 7.8 | 2021-06-22 | In permission declarations of DeviceAdminReceiver.java, there is a possible lack of broadcast protection due to an insecure default value. This could lead to l… |
CVE-2021-34203 | High | 8.1 | 2021-06-16 | D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. Router ac2600 (dir-2640-us), when setting PPPoE, will start quagga process in the way of… |
CVE-2021-21505 | High | 8.0 | 2021-05-06 | Dell EMC Integrated System for Microsoft Azure Stack Hub, versions 1906 – 2011, contain an undocumented default iDRAC account. A remote unauthenticated attacke… |
CVE-2021-0468 | Medium | 6.6 | 2021-04-13 | In LK, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege for an attacker who has p… |
CVE-2021-28123 | Critical | 9.8 | 2021-04-02 | Undocumented Default Cryptographic Key Vulnerability in Cohesity DataPlatform version 6.3 prior 6.3.1g, 6.4 up to 6.4.1c and 6.5.1 through 6.5.1b. The ssh key… |
CVE-2020-11915 | Medium | 6.8 | 2021-02-08 | An issue was discovered in Svakom Siime Eye 14.1.00000001.3.330.0.0.3.14. By sending a set_params.cgi?telnetd=1&save=1&reboot=1 request to the webserver, it is… |
CVE-2020-10552 | High | 8.1 | 2021-02-05 | An issue was discovered in Psyprax before 3.2.2. The Firebird database is accessible with the default user sysdba and password masterke after installation. Thi… |
CVE-2019-20470 | High | 7.5 | 2021-02-01 | An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It performs actions based on certain SMS commands. This can be used to set up… |
CVE-2020-0019 | Medium | 5.5 | 2020-12-14 | In the Broadcom Nexus firmware, there is an insecure default password. This could lead to local information disclosure in the kernel with no additional executi… |
CVE-2020-0099 | High | 7.8 | 2020-12-14 | In addWindow of WindowManagerService.java, there is a possible window overlay attack due to an insecure default value. This could lead to local escalation of p… |
CVE-2020-4001 | Critical | 9.8 | 2020-11-24 | The SD-WAN Orchestrator 3.3.2, 3.4.x, and 4.0.x has default passwords allowing for a Pass-the-Hash Attack. SD-WAN Orchestrator ships with default passwords for… |
CVE-2020-27555 | Critical | 9.8 | 2020-11-17 | Use of default credentials for the telnet server in BASETech GE-131 BT-1837836 firmware 20180921 allows remote attackers to execute arbitrary system commands a… |
CVE-2020-26510 | Critical | 9.8 | 2020-11-16 | Airleader Master <= 6.21 devices have default credentials that can be used to access the exposed Tomcat Manager for deployment of a new .war file, with resulta… |
CVE-2020-12336 | High | 7.8 | 2020-11-12 | Insecure default variable initialization in firmware for some Intel(R) NUCs may allow an authenticated user to potentially enable escalation of privilege via l… |
CVE-2020-12327 | Medium | 4.4 | 2020-11-12 | Insecure default variable initialization in some Intel(R) Thunderbolt(TM) DCH drivers for Windows* before version 72 may allow a privileged user to potentially… |
CVE-2020-8705 | Medium | 6.8 | 2020-11-12 | Insecure default initialization of resource in Intel(R) Boot Guard in Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14… |
CVE-2020-13927 | Critical | 9.8 | 2020-11-10 | The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who mi… |
CVE-2020-11489 | High | 7.5 | 2020-10-29 | NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contain a vulnerability in… |
CVE-2020-0416 | High | 8.8 | 2020-10-14 | In multiple settings screens, there are possible tapjacking attacks due to an insecure default value. This could lead to local escalation of privilege and perm… |
CVE-2020-26930 | Low | 3.3 | 2020-10-09 | NETGEAR EX7700 devices before 1.0.0.210 are affected by incorrect configuration of security settings. |
CVE-2020-24365 | High | 8.8 | 2020-09-24 | An issue was discovered on Gemtek WRTM-127ACN 01.01.02.141 and WRTM-127x9 01.01.02.127 devices. The Monitor Diagnostic network page allows an authenticated att… |
CVE-2020-0271 | High | 7.3 | 2020-09-18 | In the Settings app, there is an insecure default value. This could lead to local escalation of privilege and tapjacking with User execution privileges needed… |
CVE-2020-0394 | High | 7.8 | 2020-09-17 | In onCreate of BluetoothPairingDialog.java, there is a possible tapjacking vector due to an insecure default value. This could lead to local escalation of priv… |
CVE-2020-0386 | Medium | 5.5 | 2020-09-17 | In onCreate of RequestPermissionActivity.java, there is a possible tapjacking vector due to an insecure default value. This could lead to local escalation of p… |
CVE-2020-16873 | Medium | 4.7 | 2020-09-11 | <p>A spoofing vulnerability manifests in Microsoft Xamarin.Forms due to the default settings on Android WebView version prior to 83.0.4103.106. This vulnerabil… |
CVE-2020-7729 | High | 7.1 | 2020-09-03 | The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement saf… |
CVE-2020-7685 | Medium | 5.4 | 2020-07-28 | This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The pa… |
CVE-2020-10279 | Critical | 9.8 | 2020-06-24 | MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system, Thought for desktop uses, this operating system presents inse… |
CVE-2020-14011 | Critical | 9.8 | 2020-06-15 | Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin account, unless "Built-in admin" is manually… |
CVE-2020-11532 | Critical | 9.8 | 2020-05-08 | Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. This allows an attacker to byp… |
CVE-2020-8828 | High | 8.8 | 2020-04-08 | As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for… |
CVE-2019-13393 | High | 7.5 | 2020-03-13 | The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses the same default 8 character passphrase for the administrative console and the WPA2 pre-shared ke… |
CVE-2019-17274 | High | 7.8 | 2020-02-26 | NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller (BMC) firmware versions 13.x prior to 13.1P1 were shipped with a default account enabled that… |
CVE-2019-1950 | High | 8.4 | 2020-02-19 | A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, local attacker to gain unauthorized access to an affected device. The vulnerabi… |
CVE-2014-0234 | Critical | 9.8 | 2020-02-12 | The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attac… |
CVE-2019-16272 | Critical | 9.8 | 2020-01-06 | On DTEN D5 and D7 before 1.3.4 devices, factory settings allows for firmware reflash and Android Debug Bridge (adb) enablement. |
CVE-2019-19340 | High | 8.2 | 2019-12-19 | A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager by setting it with '-e rabbitmq_enable_m… |
CVE-2019-19251 | Medium | 5.3 | 2019-12-10 | The Last.fm desktop app (Last.fm Scrobbler) through 2.1.39 on macOS makes HTTP requests that include an API key without the use of SSL/TLS. Although there is a… |
CVE-2019-4621 | Critical | 9.8 | 2019-12-09 | IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is… |
CVE-2019-2197 | Medium | 5.5 | 2019-11-13 | In processPhonebookAccess of CachedBluetoothDevice.java, there is a possible permission bypass due to an insecure default value. This could lead to local infor… |
CVE-2008-3278 | High | 7.8 | 2019-11-07 | frysk packages through 2008-08-05 as shipped in Red Hat Enterprise Linux 5 are built with an insecure RPATH set in the ELF header of multiple binaries in /usr/… |
CVE-2010-2247 | High | 7.5 | 2019-11-06 | makepasswd 1.10 default settings generate insecure passwords |
CVE-2019-16102 | Critical | 9.8 | 2019-09-08 | Silver Peak EdgeConnect SD-WAN before 8.1.7.x has an SNMP service with a public value for rocommunity and trapcommunity. |
CVE-2019-14222 | Critical | 9.8 | 2019-09-05 | An issue was discovered in Alfresco Community Edition versions 6.0 and lower. An unauthenticated, remote attacker could authenticate to Alfresco's Solr Web Adm… |
CVE-2019-4169 | Critical | 9.1 | 2019-08-26 | IBM Open Power Firmware OP910 and OP920 could allow access to BMC via IPMI using default OpenBMC password even after BMC password was changed away from the def… |
CVE-2019-15304 | Critical | 9.1 | 2019-08-26 | Lierda Grill Temperature Monitor V1.00_50006 has a default password of admin for the admin account, which allows an attacker to cause a Denial of Service or In… |
CVE-2019-2131 | High | 7.8 | 2019-08-20 | An application with overlay permission can display overlays on top of settings UI. This could lead to local escalation of privilege with no additional executio… |
CVE-2019-2120 | High | 7.8 | 2019-08-20 | In OatFileAssistant::GenerateOatFile of oat_file_assistant.cc, there is a possible file corruption issue due to an insecure default value. This could lead to l… |
CVE-2019-7252 | Critical | 9.8 | 2019-07-02 | Linear eMerge E3-Series devices have Default Credentials. |
CVE-2019-5497 | Critical | 9.8 | 2019-07-01 | NetApp AFF A700s Baseboard Management Controller (BMC) firmware versions 1.22 and higher were shipped with a default account enabled that could allow unauthori… |
CVE-2019-7668 | Critical | 9.8 | 2019-07-01 | Prima Systems FlexAir devices have Default Credentials. |
CVE-2019-5367 | Critical | 9.8 | 2019-06-05 | A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. |
CVE-2019-2043 | High | 7.3 | 2019-05-08 | In SmsDefaultDialog.onStart of SmsDefaultDialog.java, there is a possible escalation of privilege due to an overlay attack. This could lead to local escalation… |
CVE-2019-1804 | Critical | 9.8 | 2019-05-03 | A vulnerability in the SSH key management for the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an unauthen… |
CVE-2019-11618 | Critical | 9.8 | 2019-04-30 | doorGets 7.0 has a default administrator credential vulnerability. A remote attacker can use this vulnerability to gain administrator privileges for the creati… |
CVE-2019-7476 | High | 8.1 | 2019-04-26 | A vulnerability in SonicWall Global Management System (GMS), allow a remote user to gain access to the appliance using existing SSH key. This vulnerability aff… |