cve.bz

CWE-1188: Initialization of a Resource with an Insecure Default, page 7

Filter

The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

What the weakness is: CWE-1188 at MITRE

Ask an AI about CWE-1188

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-1188: Initialization of a Resource with an Insecure Default and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1188.html and https://cve.bz/cve/cwe/1188?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2020-11489EPSS 1.3%

    NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contain a vulnerability in the AMI BMC firmware in which default SNMP community strings are used, which ma…

  2. 8.8CVE-2020-0416EPSS 1.3%

    In multiple settings screens, there are possible tapjacking attacks due to an insecure default value. This could lead to local escalation of privilege and permissions with no additional execution privileges needed. User interaction is need…

  3. 3.8CVE-2020-26930EPSS 0.5%

    NETGEAR EX7700 devices before 1.0.0.210 are affected by incorrect configuration of security settings.

  4. 8.8CVE-2020-24365ExploitEPSS 11%

    An issue was discovered on Gemtek WRTM-127ACN 01.01.02.141 and WRTM-127x9 01.01.02.127 devices. The Monitor Diagnostic network page allows an authenticated attacker to execute a command directly on the target machine. Commands are executed…

  5. 7.3CVE-2020-0271EPSS 0.2%

    In the Settings app, there is an insecure default value. This could lead to local escalation of privilege and tapjacking with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-1…

  6. 7.8CVE-2020-0394EPSS 0.3%

    In onCreate of BluetoothPairingDialog.java, there is a possible tapjacking vector due to an insecure default value. This could lead to local escalation of privilege and untrusted devices accessing contact lists with no additional execution…

  7. 5.5CVE-2020-0386EPSS 0.4%

    In onCreate of RequestPermissionActivity.java, there is a possible tapjacking vector due to an insecure default value. This could lead to local escalation of privilege allowing an attacker to set Bluetooth discoverability with User executi…

  8. 4.7CVE-2020-16873EPSS 4.0%

    <p>A spoofing vulnerability manifests in Microsoft Xamarin.Forms due to the default settings on Android WebView version prior to 83.0.4103.106. This vulnerability could allow an attacker to execute arbitrary Javascript code on a target sys…

  9. 7.1CVE-2020-7729EPSS 2.3%

    The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.

  10. 7.5CVE-2020-7685EPSS 0.9%

    This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package ca…

  11. 9.8CVE-2020-10279EPSS 1.0%

    MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system, Thought for desktop uses, this operating system presents insecure defaults for robots. These insecurities include a way for users to escalate…

  12. 9.8CVE-2020-14011ExploitEPSS 29%

    Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin account, unless "Built-in admin" is manually unchecked. This allows command execution via the Add New Package and Scheduled D…

  13. 9.8CVE-2020-11532ExploitEPSS 77%

    Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. This allows an attacker to bypass authentication for this server and execute all operations in the context of …

  14. 8.8CVE-2020-8828EPSS 1.8%

    As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the m…

  15. 7.5CVE-2019-13393EPSS 1.2%

    The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses the same default 8 character passphrase for the administrative console and the WPA2 pre-shared key. Either an attack against HTTP Basic Authentication or an attack against WPA2 …

  16. 7.8CVE-2019-17274EPSS 0.6%

    NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller (BMC) firmware versions 13.x prior to 13.1P1 were shipped with a default account enabled that could allow unauthorized arbitrary command execution via local access.

  17. 8.4CVE-2019-1950EPSS 0.3%

    A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, local attacker to gain unauthorized access to an affected device. The vulnerability is due to the existence of default credentials within the default configura…

  18. 9.8CVE-2014-0234EPSS 3.8%

    The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.s…

  19. 9.8CVE-2019-16272EPSS 1.2%

    On DTEN D5 and D7 before 1.3.4 devices, factory settings allows for firmware reflash and Android Debug Bridge (adb) enablement.

  20. 8.2CVE-2019-19340EPSS 1.5%

    A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager by setting it with '-e rabbitmq_enable_manager=true' exposes the RabbitMQ management interface publicly, as expected. If…

  21. 5.3CVE-2019-19251EPSS 0.7%

    The Last.fm desktop app (Last.fm Scrobbler) through 2.1.39 on macOS makes HTTP requests that include an API key without the use of SSL/TLS. Although there is an Enable SSL option, it is disabled by default, and cleartext requests are made …

  22. 9.8CVE-2019-4621EPSS 1.6%

    IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is enabled. A remote attacker could use this account to gain unauthorised access t…

  23. 5.5CVE-2019-2197EPSS 0.2%

    In processPhonebookAccess of CachedBluetoothDevice.java, there is a possible permission bypass due to an insecure default value. This could lead to local information disclosure of the user's contact list with no additional execution privil…

  24. 7.8CVE-2008-3278EPSS 0.4%

    frysk packages through 2008-08-05 as shipped in Red Hat Enterprise Linux 5 are built with an insecure RPATH set in the ELF header of multiple binaries in /usr/bin/f* (e.g. fcore, fcatch, fstack, fstep, ...) shipped in the package. A local …

  25. 7.5CVE-2010-2247EPSS 1.3%

    makepasswd 1.10 default settings generate insecure passwords

  26. 9.8CVE-2019-16102EPSS 1.5%

    Silver Peak EdgeConnect SD-WAN before 8.1.7.x has an SNMP service with a public value for rocommunity and trapcommunity.

  27. 9.8CVE-2019-14222EPSS 2.9%

    An issue was discovered in Alfresco Community Edition versions 6.0 and lower. An unauthenticated, remote attacker could authenticate to Alfresco's Solr Web Admin Interface. The vulnerability is due to the presence of a default private key …

  28. 9.1CVE-2019-4169EPSS 1.7%

    IBM Open Power Firmware OP910 and OP920 could allow access to BMC via IPMI using default OpenBMC password even after BMC password was changed away from the default password. IBM X-Force ID: 158702.

  29. 9.1CVE-2019-15304EPSS 3.4%

    Lierda Grill Temperature Monitor V1.00_50006 has a default password of admin for the admin account, which allows an attacker to cause a Denial of Service or Information Disclosure via the undocumented access-point configuration page locate…

  30. 7.8CVE-2019-2131EPSS 0.5%

    An application with overlay permission can display overlays on top of settings UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Andro…

  31. 7.8CVE-2019-2120EPSS 0.2%

    In OatFileAssistant::GenerateOatFile of oat_file_assistant.cc, there is a possible file corruption issue due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. Use…

  32. 9.8CVE-2019-7252EPSS 4.9%

    Linear eMerge E3-Series devices have Default Credentials.

  33. 9.8CVE-2019-5497EPSS 2.9%

    NetApp AFF A700s Baseboard Management Controller (BMC) firmware versions 1.22 and higher were shipped with a default account enabled that could allow unauthorized arbitrary command execution.

  34. 9.8CVE-2019-7668EPSS 1.6%

    Prima Systems FlexAir devices have Default Credentials.

  35. 9.8CVE-2019-5367EPSS 8.0%

    A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

  36. 7.3CVE-2019-2043EPSS 0.2%

    In SmsDefaultDialog.onStart of SmsDefaultDialog.java, there is a possible escalation of privilege due to an overlay attack. This could lead to local escalation of privilege, granting privileges to a local app without the user's informed co…

  37. 9.8CVE-2019-1804EPSS 3.5%

    A vulnerability in the SSH key management for the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an unauthenticated, remote attacker to connect to the affected system with the privileges o…

  38. 9.8CVE-2019-11618EPSS 2.3%

    doorGets 7.0 has a default administrator credential vulnerability. A remote attacker can use this vulnerability to gain administrator privileges for the creation and modification of articles via an H0XZlT44FcN1j9LTdFc5XRXhlF30UaGe1g3cZY6i1…

  39. 8.1CVE-2019-7476EPSS 1.4%

    A vulnerability in SonicWall Global Management System (GMS), allow a remote user to gain access to the appliance using existing SSH key. This vulnerability affects GMS versions 9.1, 9.0, 8.7, 8.6, 8.4, 8.3 and earlier.

  40. 7.8CVE-2018-20052EPSS 0.4%

    An issue was discovered on Cerner Connectivity Engine (CCE) 4 devices. The user running the main CCE firmware has NOPASSWD sudo privileges to several utilities that could be used to escalate privileges to root. One example is the "sudo ln …

  41. 7.3CVE-2019-2041EPSS 0.2%

    In the configuration of NFC modules on certain devices, there is a possible failure to distinguish individual devices due to an insecure default value. This could lead to local escalation of privilege with no additional execution privilege…

  42. 9.8CVE-2018-19275EPSS 4.6%

    The BluStar component in Mitel InAttend before 2.5 SP3 and CMG before 8.4 SP3 Suite Servers has a default password, which could allow remote attackers to gain unauthorized access and execute arbitrary scripts with potential impacts to the …

  43. 9.8CVE-2019-5490EPSS 3.5%

    Certain versions between 2.x to 5.x (refer to advisory) of the NetApp Service Processor firmware were shipped with a default account enabled that could allow unauthorized arbitrary command execution. Any platform listed in the advisory Imp…

  44. 7.8CVE-2018-17497EPSS 0.4%

    eVisitorPass contains default administrative credentials. An attacker could exploit this vulnerability to gain full access to the application.

  45. 7.8CVE-2018-17485EPSS 0.4%

    Lobby Track Desktop contains default administrative credentials. An attacker could exploit this vulnerability to gain full access to the application.

  46. 8.8CVE-2019-3783EPSS 0.9%

    Cloud Foundry Stratos, versions prior to 2.3.0, deploys with a public default session store secret. A malicious user with default session store secret can brute force another user's current Stratos session, and act on behalf of that user.

  47. 8.8CVE-2019-1994EPSS 1.0%

    In refresh of DevelopmentTiles.java, there is the possibility of leaving development settings accessible due to an insecure default value. This could lead to unwanted access to development settings, with no additional execution privileges …

  48. 9.8CVE-2019-3909EPSS 2.3%

    Premisys Identicard version 3.1.190 database uses default credentials. Users are unable to change the credentials without vendor intervention.

  49. 8.8CVE-2018-20402EPSS 1.0%

    Safe Software FME Server through 2018.1 creates and enables three additional accounts in addition to the initial administrator account. The passwords to the three accounts are the same as the usernames, which are guest, user, and author. L…

  50. 8.8CVE-2018-17906EPSS 0.8%

    Philips iSite and IntelliSpace PACS, iSite PACS, all versions, and IntelliSpace PACS, all versions. Default credentials and no authentication within third party software may allow an attacker to compromise a component of the system.