CWE-1188 · Initialization of a Resource with an Insecure Default (page 4)
Page 4 of 4 — CVEs classified under CWE-1188, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-20052 | High | 7.8 | 2019-04-25 | An issue was discovered on Cerner Connectivity Engine (CCE) 4 devices. The user running the main CCE firmware has NOPASSWD sudo privileges to several utilities… |
CVE-2019-2041 | High | 7.3 | 2019-04-19 | In the configuration of NFC modules on certain devices, there is a possible failure to distinguish individual devices due to an insecure default value. This co… |
CVE-2018-19275 | Critical | 9.8 | 2019-04-02 | The BluStar component in Mitel InAttend before 2.5 SP3 and CMG before 8.4 SP3 Suite Servers has a default password, which could allow remote attackers to gain… |
CVE-2019-5490 | Critical | 9.8 | 2019-03-21 | Certain versions between 2.x to 5.x (refer to advisory) of the NetApp Service Processor firmware were shipped with a default account enabled that could allow u… |
CVE-2018-17497 | High | 8.4 | 2019-03-21 | eVisitorPass contains default administrative credentials. An attacker could exploit this vulnerability to gain full access to the application. |
CVE-2018-17485 | High | 8.4 | 2019-03-21 | Lobby Track Desktop contains default administrative credentials. An attacker could exploit this vulnerability to gain full access to the application. |
CVE-2019-3783 | High | 8.8 | 2019-03-07 | Cloud Foundry Stratos, versions prior to 2.3.0, deploys with a public default session store secret. A malicious user with default session store secret can brut… |
CVE-2019-1994 | High | 8.8 | 2019-02-28 | In refresh of DevelopmentTiles.java, there is the possibility of leaving development settings accessible due to an insecure default value. This could lead to u… |
CVE-2019-3909 | Critical | 9.8 | 2019-01-18 | Premisys Identicard version 3.1.190 database uses default credentials. Users are unable to change the credentials without vendor intervention. |
CVE-2018-20402 | High | 8.8 | 2018-12-23 | Safe Software FME Server through 2018.1 creates and enables three additional accounts in addition to the initial administrator account. The passwords to the th… |
CVE-2018-17906 | High | 8.8 | 2018-11-19 | Philips iSite and IntelliSpace PACS, iSite PACS, all versions, and IntelliSpace PACS, all versions. Default credentials and no authentication within third part… |
CVE-2018-10605 | High | 8.8 | 2018-10-01 | Martem TELEM GW6/GWM versions prior to 2.0.87-4018403-k4 may allow unprivileged users to modify/upload a new system configuration or take the full control over… |
CVE-2018-16752 | High | 8.8 | 2018-09-20 | LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools… |
CVE-2018-3825 | Medium | 5.9 | 2018-09-19 | In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch… |
CVE-2018-15685 | High | 8.1 | 2018-08-23 | GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options… |
CVE-2018-15350 | Critical | 9.8 | 2018-08-17 | Router Default Credentials in Kraftway 24F2XG Router firmware version 3.5.30.1118 allow remote attackers to get privileged access to the router. |
CVE-2018-1524 | High | 8.8 | 2018-08-03 | IBM Maximo Asset Management 7.6 through 7.6.3 installs with a default administrator account that a remote intruder could use to gain administrator access to th… |
CVE-2018-3667 | High | 7.8 | 2018-07-10 | Installation tool IPDT (Intel Processor Diagnostic Tool) 4.1.0.24 sets permissions of installed files incorrectly, allowing for execution of arbitrary code and… |
CVE-2018-0263 | High | 7.4 | 2018-06-07 | A vulnerability in Cisco Meeting Server (CMS) could allow an unauthenticated, adjacent attacker to access services running on internal device interfaces of an… |
CVE-2018-5841 | High | 7.8 | 2018-06-06 | dcc_curr_list is initialized with a default invalid value that is expected to be programmed by the user through a sysfs node which could lead to an invalid acc… |
CVE-2018-10968 | Critical | 9.8 | 2018-05-18 | On D-Link DIR-550A and DIR-604M devices through v2.10KR, a malicious user can use a default TELNET account to get unauthorized access to vulnerable devices, ak… |
CVE-2018-8014 | Critical | 9.8 | 2018-05-16 | The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and… |
CVE-2018-10989 | Medium | 6.6 | 2018-05-14 | Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices are distributed by some ISPs with a default password of "password" for the admin account that is u… |
CVE-2018-10251 | Critical | 9.8 | 2018-05-04 | A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.7 and GX450, ES450, RV50, RV50X, MP70, and MP70E rou… |
CVE-2018-3591 | Critical | 9.8 | 2018-04-11 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, SD 210/SD 212… |
CVE-2018-5770 | Critical | 9.8 | 2018-03-20 | An issue was discovered on Tenda AC15 devices. A remote, unauthenticated attacker can make a request to /goform/telnet, creating a telnetd service on the devic… |
CVE-2018-0130 | Critical | 9.8 | 2018-02-22 | A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, rem… |
CVE-2017-12736 | High | 8.8 | 2017-12-26 | After initial configuration, the Ruggedcom Discovery Protocol (RCDP) is still able to write to the device under certain conditions. This could allow an atta… |
CVE-2017-8039 | Medium | 5.9 | 2017-11-27 | An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding prope… |
CVE-2017-12739 | Critical | 9.8 | 2017-11-15 | An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi00. The integrated w… |
CVE-2017-8021 | Critical | 9.8 | 2017-10-03 | EMC Elastic Cloud Storage (ECS) before 3.1 is affected by an undocumented account vulnerability that could potentially be leveraged by malicious users to compr… |
CVE-2017-6750 | High | 7.5 | 2017-07-25 | A vulnerability in AsyncOS for the Cisco Web Security Appliance (WSA) could allow an unauthenticated, local attacker to log in to the device with the privilege… |
CVE-2017-6692 | High | 8.8 | 2017-06-13 | A vulnerability in Cisco Ultra Services Framework Element Manager could allow an authenticated, remote attacker to log in to the device with the privileges of… |
CVE-2017-6689 | High | 8.8 | 2017-06-13 | A vulnerability in the ConfD CLI of Cisco Elastic Services Controllers could allow an authenticated, remote attacker to log in to an affected system as the adm… |
CVE-2017-6688 | High | 8.8 | 2017-06-13 | A vulnerability in Cisco Elastic Services Controllers could allow an authenticated, remote attacker to log in to an affected system as the Linux root user, aka… |
CVE-2017-6687 | High | 8.8 | 2017-06-13 | A vulnerability in Cisco Ultra Services Framework Element Manager could allow an authenticated, remote attacker with access to the management network to log in… |
CVE-2017-6686 | High | 8.8 | 2017-06-13 | A vulnerability in Cisco Ultra Services Framework Element Manager could allow an authenticated, remote attacker with access to the management network to log in… |
CVE-2017-6685 | High | 8.8 | 2017-06-13 | A vulnerability in Cisco Ultra Services Framework Staging Server could allow an authenticated, remote attacker with access to the management network to log in… |
CVE-2017-6684 | High | 8.8 | 2017-06-13 | A vulnerability in Cisco Elastic Services Controllers could allow an authenticated, remote attacker to log in to an affected system as the Linux admin user, ak… |
CVE-2017-4971 | Medium | 5.9 | 2017-06-13 | An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding prope… |
CVE-2017-9137 | High | 7.3 | 2017-05-21 | Ceragon FibeAir IP-10 wireless radios through 7.2.0 have a default password of mateidu for the mateidu account (a hidden user account established by the vendor… |
CVE-2017-8218 | Critical | 9.8 | 2017-04-25 | vsftpd on TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n has a backdoor admin account with the 1234 password, a backdoo… |
CVE-2017-7964 | Critical | 10.0 | 2017-04-19 | Zyxel WRE6505 devices have a default TELNET password of 1234 for the root and admin accounts, which makes it easier for remote attackers to conduct DNS hijacki… |
CVE-2017-3834 | Critical | 9.8 | 2017-04-06 | A vulnerability in Cisco Aironet 1830 Series and Cisco Aironet 1850 Series Access Points running Cisco Mobility Express Software could allow an unauthenticated… |
CVE-2017-5178 | Critical | 9.8 | 2017-03-08 | An issue was discovered in Schneider Electric Tableau Server/Desktop Versions 7.0 to 10.1.3 in Wonderware Intelligence Versions 2014R3 and prior. These version… |
CVE-2017-5155 | High | 7.3 | 2017-02-13 | An issue was discovered in Schneider Electric Wonderware Historian 2014 R2 SP1 P01 and earlier. Wonderware Historian creates logins with default passwords, whi… |
CVE-2017-5491 | Medium | 5.3 | 2017-01-15 | wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com… |