Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1188: Initialization of a Resource with an Insecure Default

Base Incomplete

The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Source: MITRE CWE-1188

All Critical High Medium Low Exploited only Public exploit

288 results · Feed

  • High 8.8
    CVE-2020-8828

    Argo CD Insecure default administrative password

    As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat…

    github.com/argoproj/argo-cd Go
  • High 8.2
    CVE-2019-19340

    A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager …

    Red Hat Tower
  • High 8.1
    CVE-2018-15685 Public exploit EPSS 10%

    Electron webPreferences vulnerability can be used to perform remote code execution

    GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code executio…

    electron npm
  • Critical 9.8
    CVE-2018-8014 EPSS 21%

    The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins

    The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • High 8.8
    CVE-2017-12736

    After initial configuration, the Ruggedcom Discovery Protocol (RCDP) is still able to write to the device under certain…

    Siemens RUGGEDCOM RS416Pv2 V5.X RUGGEDCOM RS416v2 V5.X RUGGEDCOM RMC8388 V5.X ICS / OT
  • Medium 5.9
    CVE-2017-8039

    Insecure Default Initialization of Resource in Pivotal Spring Web Flow

    An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expression…

    org.springframework.webflow:spring-webflow Maven
  • Medium 5.9
    CVE-2017-4971 Public exploit EPSS 15%

    Insecure Default Initialization of Resource in Pivotal Spring Web Flow

    An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expression…

    org.springframework.webflow:spring-webflow Maven
  • Medium 4.3
    CVE-2013-2030

    OpenStack Nova uses insecure keystone middleware tmpdir by default

    keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demons…

    python-keystoneclient PyPI