# CWE-1188.

Every Advisory and CVE whose sources give the weakness CWE-1188, newest first.

## Records, newest first (an older page)

- [A vulnerability in the BluStar component of Mitel InAttend 2.6 SP4 through 2.7 and CMG 8.5 SP4 through 8.6 could allow access to sensitive information, changes to the system configuration, or executi…](https://agentprime.io/advisories/CVE-2024-28815.md)
  `CVE-2024-28815` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Mar 2024 · Tags: CWE-1188
- [Zhejiang Uniview Technologies Co.,Ltd and Atsumi Electric…: Initialization of a resource with an insecure default vulnerability in OET-213H-BTS1 sold…](https://agentprime.io/advisories/CVE-2024-25972.md)
  `CVE-2024-25972` · CVE record: Zhejiang Uniview Technologies Co.,Ltd and Atsumi Electric Co., Ltd. OET-213H-BTS1 · CVSS 8.3 High · Not analysed yet · Published 1 Mar 2024 · Tags: CWE-1188
- [ASA-2024-004: Default configuration param for Evidence may limit window of validity](https://agentprime.io/advisories/GHSA-555p-m4v6-cqxv.md)
  `GHSA-555p-m4v6-cqxv` · Go `github.com/cometbft/cometbft`: affected `<=0.38.5`, no fixed version yet · No CVSS score · Not analysed yet · Published 28 Feb 2024 · Tags: CWE-1188
- [EDS-4000/G4000 Series IP Forwarding Vulnerability](https://agentprime.io/advisories/CVE-2024-0387.md)
  `CVE-2024-0387` · CVE record: Moxa EDS-4008 Series and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 26 Feb 2024 · Tags: CWE-1188
- [Liferay Portal has a Stored XSS with Blog entries (Insecure defaults)](https://agentprime.io/advisories/GHSA-vvpf-53qx-cxhh.md)
  `GHSA-vvpf-53qx-cxhh`, `CVE-2024-25610` · Maven `com.liferay.portal:com.liferay.portal.web` and 2 more: affected `<5.0.96`, fixed in `5.0.96` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Feb 2024 · Tags: CWE-1188
- [Liferay Portal and Liferay DXP HTTP Header Can Expose Versions](https://agentprime.io/advisories/GHSA-2mvj-q2q3-wxjv.md)
  `GHSA-2mvj-q2q3-wxjv`, `CVE-2024-26267` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `<7.2.10.fp19 || >=7.3.0, <7.3.10.u5 || >=7.4.0, <7.4.13.u26`, fixed in `7.2.10.fp19`, `7.3.10.u5`, `7.4.13.u26` · CVSS 5.3 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: CWE-1188
- [An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2.](https://agentprime.io/advisories/CVE-2023-48733.md)
  `CVE-2023-48733` · CVE record: Canonical Ltd. Ubuntu EDK II · CVSS 6.7 Medium · Not analysed yet · Published 14 Feb 2024 · Tags: CWE-1188
- [Insecure Default Initialization of Resource in HID Global](https://agentprime.io/advisories/CVE-2024-22388.md)
  `CVE-2024-22388` · CVE record: HID Global iCLASS SE CP1000 Encoder and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 6 Feb 2024 · Tags: CWE-1188
- [Default swagger-ui configuration exposes all files in the module](https://agentprime.io/advisories/GHSA-62jr-84gf-wmg4.md)
  `GHSA-62jr-84gf-wmg4`, `CVE-2024-22207` · npm `@fastify/swagger-ui`: affected `>=2.0.0, <2.1.0`, fixed in `2.1.0` · CVSS 5.3 Medium · Not analysed yet · Published 16 Jan 2024 · Tags: CWE-1188
- [Unitronics VisiLogic uses a default administrative password](https://agentprime.io/advisories/CVE-2023-6448.md)
  `CVE-2023-6448` · CVE record: Unitronics VisiLogic · CVSS 9.8 Critical · Critical (KEV, CVSS 9+) · In CISA KEV · Not analysed yet · Published 5 Dec 2023 · Tags: CWE-1188
- [MTProto proxy remote code execution vulnerability](https://agentprime.io/advisories/GHSA-738q-mc72-2q22.md)
  `GHSA-738q-mc72-2q22`, `CVE-2023-45312` · Hex `mtproto_proxy`: affected `<=0.7.2`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 10 Oct 2023 · Tags: Code injection, CWE-1188
- [msdosfs data disclosure](https://agentprime.io/advisories/CVE-2023-5368.md)
  `CVE-2023-5368` · CVE record: FreeBSD FreeBSD · No CVSS score · Not analysed yet · Published 4 Oct 2023 · Tags: CWE-1188
- [Improper Access Control in OPTO 22 SNAP PAC S1](https://agentprime.io/advisories/CVE-2023-40708.md)
  `CVE-2023-40708` · CVE record: OPTO 22 SNAP PAC S1 · CVSS 5.8 Medium · Not analysed yet · Published 24 Aug 2023 · Tags: CWE-1188
- [ETIC Telecom Insecure Default Initialization of Resource](https://agentprime.io/advisories/CVE-2023-3453.md)
  `CVE-2023-3453` · CVE record: ETIC Telecom Remote Access Server (RAS) · CVSS 7.1 High · Not analysed yet · Published 23 Aug 2023 · Tags: CWE-1188
- [Temporal Server vulnerable to Incorrect Authorization and Insecure Default Initialization of Resource](https://agentprime.io/advisories/GHSA-gm2g-2xr9-pxxj.md)
  `GHSA-gm2g-2xr9-pxxj`, `BIT-temporal-2023-3485`, `CVE-2023-3485`, `GO-2023-1879` · Go `go.temporal.io/server`: affected `<1.20.0`, fixed in `1.20.0` · CVSS 3.0 Low · Not analysed yet · Published 30 Jun 2023 · Tags: Broken access control, CWE-1188
- [Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.](https://agentprime.io/advisories/CVE-2022-48493.md)
  `CVE-2022-48493` · CVE record: Huawei EMUI · No CVSS score · Not analysed yet · Published 19 Jun 2023 · Tags: CWE-1188
- [Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.](https://agentprime.io/advisories/CVE-2022-48492.md)
  `CVE-2022-48492` · CVE record: Huawei EMUI · No CVSS score · Not analysed yet · Published 19 Jun 2023 · Tags: CWE-1188
- [Insecure Default Initialization In Liferay Portal](https://agentprime.io/advisories/GHSA-g9mr-9xfc-4gf7.md)
  `GHSA-g9mr-9xfc-4gf7`, `BIT-liferay-2023-33949`, `CVE-2023-33949` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.0.0, <7.3.1`, fixed in `7.3.1` · CVSS 5.3 Medium · Not analysed yet · Published 24 May 2023 · Tags: CWE-1188
- [User data exposure in Apache InLong](https://agentprime.io/advisories/GHSA-h79m-5cm2-278c.md)
  `GHSA-h79m-5cm2-278c`, `CVE-2023-31101` · Maven `org.apache.inlong:manager-dao` and 3 more: affected `>=1.5.0, <1.7.0`, fixed in `1.7.0` · CVSS 6.5 Medium · Not analysed yet · Published 22 May 2023 · Tags: CWE-1188
- [Apache superset missing check for default SECRET_KEY](https://agentprime.io/advisories/GHSA-5cx2-vq3h-x52c.md)
  `GHSA-5cx2-vq3h-x52c`, `BIT-superset-2023-27524`, `CVE-2023-27524`, `PYSEC-2026-1161` · PyPI `apache-superset`: affected `<2.1.0`, fixed in `2.1.0` · CVSS 8.9 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.98 · Not analysed yet · Published 24 Apr 2023 · Tags: CWE-1188
- [Junos OS Evolved: Read access to some confidential user information is possible](https://agentprime.io/advisories/CVE-2023-28978.md)
  `CVE-2023-28978` · CVE record: Juniper Networks Junos OS Evolved · CVSS 5.3 Medium · Not analysed yet · Published 17 Apr 2023 · Tags: CWE-1188
- [In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed.](https://agentprime.io/advisories/CVE-2022-48432.md)
  `CVE-2022-48432` · CVE record: JetBrains IntelliJ IDEA · CVSS 5.2 Medium · Not analysed yet · Published 29 Mar 2023 · Tags: CWE-1188
- [Apache OpenOffice: Empty entry in Java class path](https://agentprime.io/advisories/CVE-2022-38745.md)
  `CVE-2022-38745` · CVE record: Apache Software Foundation Apache OpenOffice · CVSS 7.8 High · Not analysed yet · Published 24 Mar 2023 · Tags: Code injection, CWE-427, CWE-1188
- [CODESYS: Exposure of Resource to Wrong Sphere in CODESYS V3](https://agentprime.io/advisories/CVE-2022-4224.md)
  `CVE-2022-4224` · CVE record: CODESYS Control RTE (SL) and 4 more · CVSS 8.8 High · Not analysed yet · Published 23 Mar 2023 · Tags: CWE-1188
- [In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents.](https://agentprime.io/advisories/CVE-2022-48342.md)
  `CVE-2022-48342` · CVE record: JetBrains TeamCity · CVSS 5.2 Medium · Not analysed yet · Published 23 Feb 2023 · Tags: CWE-1188
- [Speculative execution attacks in KVM VMX](https://agentprime.io/advisories/CVE-2022-2196.md)
  `CVE-2022-2196` · CVE record: Linux Linux Kernel · CVSS 5.8 Medium · Not analysed yet · Published 9 Jan 2023 · Tags: CWE-1188
- [Android: In applyKeyguardFlags of NotificationShadeWindowControllerImpl.java…](https://agentprime.io/advisories/CVE-2022-20466.md)
  `CVE-2022-20466` · CVE record: Android · CVSS 5.5 Medium · Not analysed yet · Published 13 Dec 2022 · Tags: CWE-1188
- [A flaw was found in Openshift.](https://agentprime.io/advisories/CVE-2022-3262.md)
  `CVE-2022-3262` · CVE record: openshift · CVSS 8.1 High · Not analysed yet · Published 8 Dec 2022 · Tags: CWE-453, CWE-1188
- [HEIDENHAIN Controller TNC 640 NC Software: The HEIDENHAIN Controller TNC 640 NC software Version 340590 07 SP5…](https://agentprime.io/advisories/CVE-2022-41648.md)
  `CVE-2022-41648` · CVE record: HEIDENHAIN HEIDENHAIN Controller TNC 640 NC Software · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2022 · Tags: CWE-1188
- [Apache Isis webconsole module may directly query the database in prototype mode](https://agentprime.io/advisories/GHSA-998r-j9rx-qm8m.md)
  `GHSA-998r-j9rx-qm8m`, `CVE-2022-42467` · Maven `org.apache.isis.core:isis-core`: affected `<2.0.0-M8`, fixed in `2.0.0-M8` · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2022 · Tags: CWE-1188
- [WildFly vulnerable to Insecure Default Initialization of Resource](https://agentprime.io/advisories/GHSA-fmq7-gh8v-mjvc.md)
  `GHSA-fmq7-gh8v-mjvc`, `BIT-wildfly-2022-1278`, `CVE-2022-1278` · Maven `org.wildfly.bom:wildfly`: affected `<27.0.0.Beta1`, fixed in `27.0.0.Beta1` · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2022 · Tags: CWE-1188
- [Dell PowerScale OneFS: Dell PowerScale OneFS, versions 9.0.0, up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6…](https://agentprime.io/advisories/CVE-2022-32480.md)
  `CVE-2022-32480` · CVE record: Dell PowerScale OneFS · CVSS 4.3 Medium · Not analysed yet · Published 22 Aug 2022 · Tags: CWE-1188
- [A flaw was found in servicemesh-operator.](https://agentprime.io/advisories/CVE-2021-3586.md)
  `CVE-2021-3586` · CVE record: servicemesh-operator · No CVSS score · Not analysed yet · Published 22 Aug 2022 · Tags: CWE-1188
- [Insecure default settings in CODESYS Runtime Toolkit 32 bit full and CODESYS PLCWinNT](https://agentprime.io/advisories/CVE-2022-31806.md)
  `CVE-2022-31806` · CVE record: CODESYS CODESYS PLCWinNT and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2022 · Tags: CWE-1188
- [OpenStack Nova uses insecure keystone middleware tmpdir by default](https://agentprime.io/advisories/GHSA-pxxv-rv32-2qgv.md)
  `GHSA-pxxv-rv32-2qgv`, `CVE-2013-2030`, `PYSEC-2026-911` · PyPI `python-keystoneclient`: affected `<0.2.4`, fixed in `0.2.4` · CVSS 4.3 Medium · Not analysed yet · Published 17 May 2022 · Tags: CWE-1188
- [Insecure Default Initialization of Resource in Pivotal Spring Web Flow](https://agentprime.io/advisories/GHSA-q4v9-qjmw-j7vf.md)
  `GHSA-q4v9-qjmw-j7vf`, `CVE-2017-8039` · Maven `org.springframework.webflow:spring-webflow`: affected `<2.4.6`, fixed in `2.4.6` · CVSS 5.9 Medium · Not analysed yet · Published 13 May 2022 · Tags: CWE-1188
- [Insecure Default Initialization of Resource in Pivotal Spring Web Flow](https://agentprime.io/advisories/GHSA-fg9w-cffm-pmh2.md)
  `GHSA-fg9w-cffm-pmh2`, `CVE-2017-4971` · Maven `org.springframework.webflow:spring-webflow`: affected `>=2.4.0, <2.4.5`, fixed in `2.4.5` · CVSS 5.9 Medium · EPSS 0.15 · Not analysed yet · Published 13 May 2022 · Tags: CWE-1188
- [Intel(R) RealSense(TM) ID Solution F450: Insecure default variable initialization of Intel(R) RealSense(TM) ID Solution F450…](https://agentprime.io/advisories/CVE-2021-33130.md)
  `CVE-2021-33130` · CVE record: Intel(R) RealSense(TM) ID Solution F450 · CVSS 4.6 Medium · Not analysed yet · Published 12 May 2022 · Tags: CWE-1188
- [Siemens SIMATIC PCS 7 V8.2: A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions)…](https://agentprime.io/advisories/CVE-2022-24287.md)
  `CVE-2022-24287` · CVE record: Siemens SIMATIC PCS 7 V8.2 and 4 more · CVSS 7.8 High · Not analysed yet · Published 10 May 2022 · Tags: CWE-1188
- [Remote Code Execution Vulnerability in Packaging](https://agentprime.io/advisories/CVE-2022-24706.md)
  `CVE-2022-24706` · CVE record: Apache Software Foundation Apache CouchDB · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.93 · Not analysed yet · Published 26 Apr 2022 · Tags: CWE-1188
- [Insecure default configuration](https://agentprime.io/advisories/CVE-2021-41192.md)
  `CVE-2021-41192` · CVE record: getredash redash · CVSS 8.1 High · Not analysed yet · Published 23 Nov 2021 · Tags: CWE-1188
- [Insufficient Security Control Vulnerability](https://agentprime.io/advisories/CVE-2021-35535.md)
  `CVE-2021-35535` · CVE record: Hitachi Energy Relion 670 Series and 2 more · CVSS 8.1 High · Not analysed yet · Published 18 Nov 2021 · Tags: CWE-1188
- [Argo CD Insecure default administrative password](https://agentprime.io/advisories/GHSA-h8jc-jmrf-9h8f.md)
  `GHSA-h8jc-jmrf-9h8f`, `BIT-argo-cd-2020-8828`, `CVE-2020-8828` · Go `github.com/argoproj/argo-cd`: affected `<=1.8.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 26 Jul 2021 · Tags: Authentication bypass, CWE-1188
- [Arbitrary Code Execution in grunt](https://agentprime.io/advisories/GHSA-m5pj-vjjf-4m3h.md)
  `GHSA-m5pj-vjjf-4m3h`, `CVE-2020-7729` · npm `grunt`: affected `<1.3.0`, fixed in `1.3.0` · CVSS 7.1 High · Not analysed yet · Published 6 May 2021 · Tags: CWE-1188
- [Authentication bypass in Apache Airflow](https://agentprime.io/advisories/GHSA-hhx9-p69v-cx2j.md)
  `GHSA-hhx9-p69v-cx2j`, `BIT-airflow-2020-13927`, `CVE-2020-13927`, `PYSEC-2020-18` · PyPI `apache-airflow`: affected `<1.10.11`, fixed in `1.10.11` · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 1.00 · Not analysed yet · Published 30 Apr 2021 · Tags: Authentication bypass, CWE-1056, CWE-1188
- [An issue was discovered in Svakom Siime Eye 14.1.00000001.3.330.0.0.3.14.](https://agentprime.io/advisories/CVE-2020-11915.md)
  `CVE-2020-11915` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 8 Feb 2021 · Tags: CWE-1188
- [Insecure defaults in UmbracoForms](https://agentprime.io/advisories/GHSA-8m73-w2r2-6xxj.md)
  `GHSA-8m73-w2r2-6xxj`, `CVE-2020-7685` · NuGet `UmbracoForms`: affected `<=8.4.1`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 29 Jul 2020 · Tags: CWE-1188
- [Red Hat Tower: A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3…](https://agentprime.io/advisories/CVE-2019-19340.md)
  `CVE-2019-19340` · CVE record: Red Hat Tower · CVSS 8.2 High · Not analysed yet · Published 19 Dec 2019 · Tags: CWE-1188
- [The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins](https://agentprime.io/advisories/GHSA-r4x2-3cq5-hqvp.md)
  `GHSA-r4x2-3cq5-hqvp`, `CVE-2018-8014` · Maven `org.apache.tomcat.embed:tomcat-embed-core`: affected `>=9.0.0.M1, <9.0.9 || >=8.5.0, <8.5.32 || >=8.0.0RC1, <8.0.53 || >=7.0.41, <7.0.88`, fixed in `9.0.9`, `8.5.32`, `8.0.53`, `7.0.88` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.21 · Not analysed yet · Published 17 Oct 2018 · Tags: CWE-1188
- [Electron webPreferences vulnerability can be used to perform remote code execution](https://agentprime.io/advisories/GHSA-hv9c-qwqg-qj3v.md)
  `GHSA-hv9c-qwqg-qj3v`, `CVE-2018-15685` · npm `electron`: affected `>=1.7.0, <1.7.16 || >=1.8.0, <1.8.8 || >=2.0.0, <2.0.8 || >=3.0.0-beta.1, <3.0.0-beta.7`, fixed in `1.7.16`, `1.8.8`, `2.0.8`, `3.0.0-beta.7` · CVSS 8.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.10 · Not analysed yet · Published 23 Aug 2018 · Tags: CWE-1188
- [After initial configuration, the Ruggedcom Discovery Protocol (RCDP) is still able to write to the device under certain conditions.](https://agentprime.io/advisories/CVE-2017-12736.md)
  `CVE-2017-12736` · CVE record: Siemens RUGGEDCOM i800 and 4 more · CVSS 8.8 High · Not analysed yet · Published 26 Dec 2017 · Tags: CWE-1188

Newest: <https://agentprime.io/advisories/tag/cwe-1188.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-1188&cursor=WyIyMDI0LTA0LTE2VDAwOjMwOjMzLjAwMDAwMFoiLCJHSFNBLWh2ajUtbXZ3OS05M2ozIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-1188/?cursor=WyIyMDI0LTA0LTE2VDAwOjMwOjMzLjAwMDAwMFoiLCJHSFNBLWh2ajUtbXZ3OS05M2ozIl0>. Everything for agents: <https://agentprime.io/llms.txt>.