Weakness (CWE)
CWE-453: Insecure Default Variable Initialization
The product, by default, initializes an internal variable with an insecure or less secure value than is possible.
How to prevent it (1 mitigation)
-
System Configuration
Disable or change default settings when they can be used to abuse the system. Since those default settings are shipped with the product they are likely to be known by a potential attacker who is familiar with the product. For instance, default credentials should be changed or the associated accounts should be disabled.
Source: MITRE CWE-453
25 results · Feed
-
High 7.5
Microsoft QUIC Security Feature Bypass Vulnerability
Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network.
-
Medium 4.3
libsndfile WAV Parsing wavlike.c wavlike_subchunk_parse uninitialized variable
A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote exploitation of the …
-
High 8.6
vm2 before 3.11.7 Sandbox Escape via CLI require
vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses require(__filename) to re-execute itse…
-
Medium 4.3
WonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variable
A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WTSTradeDef.hpp of the component TraderATP Cash Trade Conversion. Executing a manipulation of the argument m_offsetType can lead to use of un…
-
Critical 10.0
In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due t…
-
Medium 4.4
OpenClaw < 2026.3.31 - Environment Variable Override via Host Exec Policy
OpenClaw before 2026.3.31 contains an environment variable override vulnerability in host exec policy that fails to properly enforce proxy, TLS, Docker, and Git TLS controls. Attackers can bypass security controls by overriding environment variables to circum…
-
Medium 4.6
Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret
Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Reviewbot component caused inbound webhook requests to be validated against a hard-coded, shared secret. The value used for the secret token w…
-
High 7.8
In onNullBinding of RemoteFillService.java, there is a possible background activity launch due to an insecure default v…
-
Critical 9.1
Donetick Has Weak Default JWT Secret
Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens (JWT) for authentication, but the signing secret has a weak default value. While the responsibility is left to the system administrator to…
-
Critical 9.8
Dpanel's hard-coded JWT secret leads to remote code execution
Dpanel is a Docker visualization panel system which provides complete Docker management functions. The Dpanel service contains a hardcoded JWT secret in its default configuration, allowing attackers to generate valid JWT tokens and compromise the host machine…
-
High 8.1
Windows Remote Desktop Services Remote Code Execution Vulnerability
Windows Remote Desktop Services Remote Code Execution Vulnerability
-
High 7.5
Filestash configured to skip TLS certificate verification when using the FTPS protocol
filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init function of index.go.
-
Medium 6.4
NFS server misconfiguration allows file access outside the exported directory
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. There is a security issue with the NFS configuration in /etc/exports generated by the installer that allows an attacker to modify files outside the export in the default insta…
-
Low 3.7
fgr Vulnerable to Insecure Default Variable Initialization
### Impact Any users whom would not desire a traceback to be included in their logs whenever an error is raised in their code will be affected. If users have inadvertently created a scenario in their code that could cause a traceback to include sensitive info…
-
High 8.8
Skype for Consumer Remote Code Execution Vulnerability
Skype for Consumer Remote Code Execution Vulnerability
-
High 7.3
An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and …
-
Critical 9.0
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default in…
-
Critical 9.0
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default in…
-
Critical 9.0
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default in…
-
Critical 9.0
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default in…
-
Medium 6.6
In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" all…
-
High 8.1
A flaw was found in Openshift. A pod with a DNSPolicy of "ClusterFirst" may incorrectly resolve the hostname based on a…
-
Critical 9.8
GE UR family insecure default variable initialization
GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a “Factory” user.
-
Medium 5.3
Insecure Defaults
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
-
Medium —CVE-2008-6540 Public exploit
DotNetNuke Default Machine Key Exposure
DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) DecryptionKey values cannot be modified in the web.config file, which allows remote attackers to bypass intended access restric…