Weakness (CWE)
CWE-453: Insecure Default Variable Initialization
The product, by default, initializes an internal variable with an insecure or less secure value than is possible.
How to prevent it (1 mitigation)
-
System Configuration
Disable or change default settings when they can be used to abuse the system. Since those default settings are shipped with the product they are likely to be known by a potential attacker who is familiar with the product. For instance, default credentials should be changed or the associated accounts should be disabled.
Source: MITRE CWE-453
8 results · Clear filters · Feed
-
High 7.5
Microsoft QUIC Security Feature Bypass Vulnerability
Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network.
-
High 8.6
vm2 before 3.11.7 Sandbox Escape via CLI require
vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses require(__filename) to re-execute itse…
-
High 7.8
In onNullBinding of RemoteFillService.java, there is a possible background activity launch due to an insecure default v…
-
High 8.1
Windows Remote Desktop Services Remote Code Execution Vulnerability
Windows Remote Desktop Services Remote Code Execution Vulnerability
-
High 7.5
Filestash configured to skip TLS certificate verification when using the FTPS protocol
filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init function of index.go.
-
High 8.8
Skype for Consumer Remote Code Execution Vulnerability
Skype for Consumer Remote Code Execution Vulnerability
-
High 7.3
An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and …
-
High 8.1
A flaw was found in Openshift. A pod with a DNSPolicy of "ClusterFirst" may incorrectly resolve the hostname based on a…