Initialization of a Resource with an Insecure Default
CWE-1188
The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
We track 169 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 8.7. 5 have been exploited in real attacks.
Latest Initialization of a Resource with an Insecure Default vulnerabilities
- 8.8 High severity
Control RTE (SL): Initialization of a Resource with an Insecure Default
In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS resources or DoS the device.
- 8.8 High severity
Linux Kernel: Initialization of a Resource with an Insecure Default
A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support
- 8.1 High severity
openshift: Initialization of a Resource with an Insecure Default
A flaw was found in Openshift. A pod with a DNSPolicy of "ClusterFirst" may incorrectly resolve the hostname based on a service provided. This flaw allows an attacker to supply an incorrect name with the DNS search policy, affecting confidentiality and availab
- 9.8 Critical severity
HEIDENHAIN Controller TNC 640 NC Software: Improper Authentication
The HEIDENHAIN Controller TNC 640 NC software Version 340590 07 SP5, is vulnerable to improper authentication in its DNC communication for CNC machines. Authentication is not enabled by default for DNC communication. This vulnerability may allow an attacker to
- 7.5 High severity
Tinyproxy: Initialization of a Resource with an Insecure Default
Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function.
- 7.8 High severity
SIMATIC PCS 7 V8.2: Initialization of a Resource with an Insecure Default
A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC06), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1 UC01), SIMATIC WinCC Runtime Professional V16 and earlier (All versions), SIMATIC WinCC Run
- 9.8 Critical severity
Apache CouchDB Insecure Default Initialization of Resource Exploited
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including rec
- 7.5 High severity
Motioneye: Initialization of a Resource with an Insecure Default
MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured.
- 9.8 Critical severity
Apache Airflow's Experimental API Authentication Bypass Exploited
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and i