Insecure Default Variable Initialization
CWE-453
The product, by default, initializes an internal variable with an insecure or less secure value than is possible.
We track 9 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.4.
How this weakness is prevented
- System Configuration: Disable or change default settings when they can be used to abuse the system. Since those default settings are shipped with the product they are likely to be known by a potential attacker who is familiar with the product. For instance, default credentials should be changed or the associated accounts should be disabled.
Latest Insecure Default Variable Initialization vulnerabilities
- 8.4 High severity
Android: Insecure Default Variable Initialization
In multiple functions of mpu.c, there is a possible way to execute code from non-secure memory in the security coprocessor due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User i
- 8.6 High severity
vm2: Insecure Default Variable Initialization
vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses require(__filename) to re-execute itsel
- 7.8 High severity
Android: Insecure Default Variable Initialization
In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interactio
- 7.8 High severity
Android: Insecure Default Variable Initialization
In onNullBinding of RemoteFillService.java, there is a possible background activity launch due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exp
- 9.8 Critical severity
donetick: Initialization of a Resource with an Insecure Default
Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens (JWT) for authentication, but the signing secret has a weak default value. While the responsibility is left to the system administrator to
- 9.8 Critical severity
dpanel: Use of Hard-coded Cryptographic Key
Dpanel is a Docker visualization panel system which provides complete Docker management functions. The Dpanel service contains a hardcoded JWT secret in its default configuration, allowing attackers to generate valid JWT tokens and compromise the host machine.
- 7.5 High severity
filestash: Insecure Default Variable Initialization
filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init function of index.go.
- 7.8 High severity
SoftEther VPN: Initialization of a Resource with an Insecure Default
An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially crafted network packet can lead to unauthorized access. An attacker can send a network request to trigger this vulnera
- 8.1 High severity
openshift: Initialization of a Resource with an Insecure Default
A flaw was found in Openshift. A pod with a DNSPolicy of "ClusterFirst" may incorrectly resolve the hostname based on a service provided. This flaw allows an attacker to supply an incorrect name with the DNS search policy, affecting confidentiality and availab