CWE-1188 Initialization of a Resource with an Insecure Default
baseThe product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (398)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-41679US | —OT critical | Exploit | ||
Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote… | ||||
| CVE-2025-48927US | —OT critical | KEV | ||
The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025. | ||||
| CVE-2023-6448US | critical9.8OT critical | KEV | ||
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take… | ||||
| CVE-2023-27524US | critical9.8OT critical | KEV | ||
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation in… | ||||
| CVE-2022-24706US | critical9.8OT critical | KEV | ||
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has… | ||||
| CVE-2020-13927US | critical9.8OT critical | KEV | ||
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Ai… | ||||
| CVE-2020-11532US | critical9.8OT high | Exploit | ||
Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. This allows an attacker to bypass authentication fo… | ||||
| CVE-2020-14011US | critical9.8OT high | Exploit | ||
Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin account, unless "Built-in admin" is manually unchecked. This allow… | ||||
| CVE-2024-24747US | high8.8OT high | Exploit | ||
MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actio… | ||||
| CVE-2021-38759US | critical9.8OT high | Exploit | ||
Raspberry Pi OS through 5.10 has the raspberry default password for the pi account. If not changed, attackers can gain administrator privileges. | ||||
| CVE-2026-44825US | critical9.8OT high | Exploit | ||
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full ad… | ||||
| CVE-2019-14222US | critical9.8OT high | Exploit | ||
An issue was discovered in Alfresco Community Edition versions 6.0 and lower. An unauthenticated, remote attacker could authenticate to Alfresco's Solr Web Admin Interface. The vul… | ||||
| CVE-2018-16752US | high8.8OT high | — | ||
LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. Authentication… | ||||
| CVE-2020-24365US | high8.8OT high | Exploit | ||
An issue was discovered on Gemtek WRTM-127ACN 01.01.02.141 and WRTM-127x9 01.01.02.127 devices. The Monitor Diagnostic network page allows an authenticated attacker to execute a co… | ||||
| CVE-2024-32114US | high8.8OT high | Exploit | ||
In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located).
It means that anyone can… | ||||
| CVE-2018-15685US | high8.1OT high | Exploit | ||
GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a Web… | ||||
| CVE-2018-8014US | critical9.8OT high | — | ||
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCrede… | ||||
| CVE-2020-0416US | high8.8OT high | Exploit | ||
In multiple settings screens, there are possible tapjacking attacks due to an insecure default value. This could lead to local escalation of privilege and permissions with no addit… | ||||
| CVE-2017-5178US | critical9.8OT elevated | — | ||
An issue was discovered in Schneider Electric Tableau Server/Desktop Versions 7.0 to 10.1.3 in Wonderware Intelligence Versions 2014R3 and prior. These versions contain a system ac… | ||||
| CVE-2021-35336US | critical9.8OT elevated | — | ||
Tieline IP Audio Gateway 2.6.4.8 and below is affected by Incorrect Access Control. A vulnerability in the Tieline Web Administrative Interface could allow an unauthenticated user… | ||||
04
attack patterns (1)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan