CWE-453 Insecure Default Variable Initialization
variantThe product, by default, initializes an internal variable with an insecure or less secure value than is possible.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (30)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-47945US | critical9.8OT elevated | — | ||
Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens (JWT) for authentication, but the signing secret has a weak… | ||||
| CVE-2021-27426US | critical9.8 | — | ||
GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a “Factor… | ||||
| CVE-2022-3262US | high8.1OT elevated | — | ||
A flaw was found in Openshift. A pod with a DNSPolicy of "ClusterFirst" may incorrectly resolve the hostname based on a service provided. This flaw allows an attacker to supply an… | ||||
| CVE-2026-0082US | high7.8 | — | ||
In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure default value. This could lead to local escalat… | ||||
| CVE-2025-39717US | high7.8 | — | ||
In the Linux kernel, the following vulnerability has been resolved:
open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE
As described in commit 7a54947e727b ('… | ||||
| CVE-2023-27516US | high7.8OT elevated | — | ||
An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially crafted network packet can lead to una… | ||||
| CVE-2008-6540US | medium5.1 | Exploit | ||
DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) DecryptionKey values cannot be modified in the w… | ||||
| CVE-2026-103577US | high7.5 | — | ||
Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2024-39916US | medium6.4OT elevated | — | ||
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. There is a security issue with the NFS configuration in /etc/exports generated by the installer… | ||||
| CVE-2023-53462US | medium5.5 | — | ||
In the Linux kernel, the following vulnerability has been resolved:
hsr: Fix uninit-value access in fill_frame_info()
Syzbot reports the following uninit-value access problem.
=… | ||||
| CVE-2023-53461US | medium5.5 | — | ||
In the Linux kernel, the following vulnerability has been resolved:
io_uring: wait interruptibly for request completions on exit
WHen the ring exits, cleanup is done and the fina… | ||||
| CVE-2024-0340US | medium5.5 | — | ||
A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not properly initialize memory in messages passed between virtual guests and the… | ||||
| CVE-2022-47197US | medium5.4 | — | ||
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject… | ||||
| CVE-2022-47196US | medium5.4OT elevated | — | ||
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject… | ||||
| CVE-2022-47195US | medium5.4 | — | ||
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject… | ||||
| CVE-2022-47194US | medium5.4OT elevated | — | ||
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject… | ||||
| CVE-2022-46831US | medium4.9OT elevated | — | ||
In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project administrators to access AWS resources… | ||||
| CVE-2021-33130US | medium4.6OT elevated | — | ||
Insecure default variable initialization of Intel(R) RealSense(TM) ID Solution F450 before version 2.6.0.74 may allow an unauthenticated user to potentially enable information disc… | ||||
| CVE-2020-12327US | medium4.4OT elevated | — | ||
Insecure default variable initialization in some Intel(R) Thunderbolt(TM) DCH drivers for Windows* before version 72 may allow a privileged user to potentially enable information d… | ||||
| CVE-2026-109828US | medium4.3 | — | ||
A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a man… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan