Skip to content
Noroxi

CWE-1188 · 281 records

Initialization of a Resource with an Insecure Default

CVEs in this class

281 records

  • CVE-2023-27524
    98Now

    Apache Superset: Session validation vulnerability when using provided default SECRET_KEY

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    apache · supersetApr 24, 2023

  • CVE-2022-24706
    97Now

    Remote Code Execution Vulnerability in Packaging

    CriticalCVSS 9.8KEVWeaponizedEPSS 92%

    apache · couchdbApr 26, 2022

  • CVE-2023-6448
    70This week

    Unitronics VisiLogic uses a default administrative password

    CriticalCVSS 9.8KEVWeaponizedEPSS 2%

    unitronics · vision1210 firmwareDec 5, 2023

  • CVE-2020-11532
    62This week

    Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server.

    CriticalCVSS 9.8WeaponizedEPSS 77%

    zohocorp · manageengine adaudit plusMay 8, 2020

  • CVE-2026-66066
    60This week

    Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

    CriticalCVSS 9.5WeaponizedEPSS 32%

    rails · railsJul 30, 2026

  • CVE-2025-48927
    60This week

    The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploit

    MediumCVSS 5.3KEVWeaponizedEPSS 12%

    smarsh · telemessageMay 28, 2025

  • CVE-2020-14011
    48Plan

    Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin account, unless "Built-in

    CriticalCVSS 9.8Proof of conceptEPSS 29%

    lansweeper · lansweeperJun 15, 2020

  • CVE-2024-2758
    45Plan

    Tempesta FW rate limits are not enabled by default.

    MediumCVSS 6.3No exploitEPSS 67%

    tempesta · tempesta fwApr 3, 2024

  • CVE-2018-8014
    45Plan

    The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.8

    CriticalCVSS 9.8No exploitEPSS 20%

    apache · tomcatMay 16, 2018

  • CVE-2021-38759
    44Plan

    Raspberry Pi OS through 5.10 has the raspberry default password for the pi account.

    CriticalCVSS 9.8Proof of conceptEPSS 15%

    raspberrypi · raspberry pi os liteDec 7, 2021

  • CVE-2017-5178
    43Plan

    An issue was discovered in Schneider Electric Tableau Server/Desktop Versions 7.0 to 10.1.3 in Wonderware Intelligence Versions 2014R3 and p

    CriticalCVSS 9.8No exploitEPSS 13%

    schneider-electric · tableau desktopMar 8, 2017

  • CVE-2021-35336
    42Plan

    Tieline IP Audio Gateway 2.6.4.8 and below is affected by Incorrect Access Control.

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    tieline · ip audtio gateway firmwareJul 1, 2021

  • CVE-2019-5367
    41Plan

    A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

    CriticalCVSS 9.8No exploitEPSS 8%

    hp · intelligent management centerJun 5, 2019

  • CVE-2017-12739
    41Plan

    An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi0

    CriticalCVSS 9.8No exploitEPSS 5%

    siemens · sm-2556 firmwareNov 15, 2017

  • CVE-2017-7964
    41Plan

    Zyxel WRE6505 devices have a default TELNET password of 1234 for the root and admin accounts, which makes it easier for remote attackers to

    CriticalCVSS 10.0No exploitEPSS 2%

    zyxel · wre6505 firmwareApr 19, 2017

  • CVE-2019-7252
    40Plan

    Linear eMerge E3-Series devices have Default Credentials.

    CriticalCVSS 9.8No exploitEPSS 4%

    nortekcontrol · linear emerge essential firmwareJul 2, 2019

  • CVE-2018-15350
    40Plan

    Router Default Credentials in Kraftway 24F2XG Router firmware version 3.5.30.1118 allow remote attackers to get privileged access to the rou

    CriticalCVSS 9.8No exploitEPSS 4%

    kraftway · 24f2xg router firmwareAug 17, 2018

  • CVE-2018-19275
    40Plan

    The BluStar component in Mitel InAttend before 2.5 SP3 and CMG before 8.4 SP3 Suite Servers has a default password, which could allow remote

    CriticalCVSS 9.8No exploitEPSS 4%

    mitel · cmg suiteApr 2, 2019

  • CVE-2014-0234
    40Plan

    The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which

    CriticalCVSS 9.8No exploitEPSS 3%

    redhat · openshiftFeb 11, 2020

  • CVE-2019-5490
    40Plan

    Certain versions between 2.x to 5.x (refer to advisory) of the NetApp Service Processor firmware were shipped with a default account enabled

    CriticalCVSS 9.8No exploitEPSS 3%

    netapp · service processorMar 21, 2019

  • CVE-2019-14222
    40Plan

    An issue was discovered in Alfresco Community Edition versions 6.0 and lower.

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    alfresco · alfrescoSep 5, 2019

  • CVE-2020-4001
    40Plan

    The SD-WAN Orchestrator 3.3.2, 3.4.x, and 4.0.x has default passwords allowing for a Pass-the-Hash Attack.

    CriticalCVSS 9.8No exploitEPSS 2%

    vmware · sd-wan orchestratorNov 24, 2020

  • CVE-2019-5497
    40Plan

    NetApp AFF A700s Baseboard Management Controller (BMC) firmware versions 1.22 and higher were shipped with a default account enabled that co

    CriticalCVSS 9.8No exploitEPSS 2%

    netapp · aff a700s firmwareJul 1, 2019

  • CVE-2018-5770
    40Plan

    An issue was discovered on Tenda AC15 devices.

    CriticalCVSS 9.8No exploitEPSS 2%

    tendacn · ac15 firmwareMar 20, 2018

  • CVE-2020-27555
    40Plan

    Use of default credentials for the telnet server in BASETech GE-131 BT-1837836 firmware 20180921 allows remote attackers to execute arbitrar

    CriticalCVSS 9.8No exploitEPSS 2%

    basetech · ge-131 bt-1837836 firmwareNov 17, 2020

All vulnerability classes