CWE-1188.

HCL BigFix SaaS Remediate is affected by a security vulnerability

• HCL Software BigFix SaaS Remediate
• CWE-1188

Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default

• CWE-350
• CWE-1188

<1.23.0 · fixed in 1.23.0

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

• CWE-350
• CWE-1188

<1.24.0 · fixed in 1.24.0

Ray's New Token Authentication is Disabled By Default

• Authentication bypass
• CWE-1188

<=2.52.0 · no fixed version yet

Vault’s Terraform Provider incorrectly set default deny_null_bind parameter for LDAP auth method to false by default

• CWE-1188

<5.5.0 · fixed in 5.5.0

Abilis CPX Fallback Shell Connection Relay

• Abilis CPX
• CWE-1188

DNN CKEditor Provider allows unauthenticated upload out-of-the-box

• Unrestricted file upload
• CWE-1188

<10.1.1 · fixed in 10.1.1

Jenkins Eggplant Runner Plugin protection mechanism disabled

• CWE-1188

<=0.0.1.301.v963cffe8ddb · no fixed version yet

An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to execute injected JavaScript in the admin…

• Information disclosure
• Weak cryptography or TLS

VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)

• VMware Aria Operations
• VMware Cloud Foundation
• CWE-1188

H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials.

• Hard-coded credentials
• CWE-1188

Liferay has Insecure Default Initialization of Resource issue

• CWE-1188

<5.0.111 · fixed in 5.0.111

WAGO: Vulnerability in hardware switch circuit

• WAGO CC100 0751-9301
• WAGO CC100 0751-9301 HW rev. &lt;082100
• CWE-1188

IBM Fusion insecure default configuration

• IBM Fusion
• IBM Fusion HCI
• CWE-1188

Himmelblau vulnerable to GID collision via group name-derived mapping (privilege escalation)

• himmelblau
• CWE-1188

In generateRandomPassword of LocalBluetoothLeBroadcast.java, there is a possible way to intercept the Auracast audio stream due to an insecure default value.

• Google Android
• CWE-1188

Rockwell Automation ControlLogix® Ethernet Remote Code Execution Vulnerability

• Rockwell Automation 1756-EN2T/D
• Rockwell Automation 1756-EN2F/C
• CWE-1188

NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access

• CWE-1188

<11.0.7 · fixed in 11.0.7

OCPP Backend Configuration via Insecure Defaults

• Phoenix Contact CHARX SEC-3150
• Phoenix Contact CHARX SEC-3100
• CWE-1188

WAGO: Vulnerability in WAGO Device Sphere

• Wago Device Sphere
• CWE-1188

Zipkin Server vulnerable to Insecure Resource Initialization through its /heapdump endpoint

• CWE-1188

<=3.5.1 · no fixed version yet

Versa Director: The Versa Director software exposes a number of services by default and allow attackers…

• Versa Director
• CWE-1188

Consilium Safety CS5000 Fire Panel Initialization of a Resource with an Insecure Default

• Consilium Safety CS5000 Fire Panel
• CWE-1188

TeleMessage service: The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an…

• TeleMessage service
• CWE-1188

Donetick Has Weak Default JWT Secret

• donetick
• CWE-453
• CWE-1188

Siemens IEC 1Ph 7.4kW Child socket: A vulnerability has been identified in IEC 1Ph 7.4kW Child socket (8EM1310-2EH04-0GA0)…

• Siemens IEC 1Ph 7.4kW Child socket
• Siemens IEC 1Ph 7.4kW Child socket/ shutter
• CWE-1188

[pgpool] Unauthenticated access to postgres through pgpool

• VMware Bitnami
• CWE-1188

CNCF K3s Kubernetes kubelet configuration exposes credentials

• CWE-1188

>=1.32.0-rc1, <1.32.4-rc1 · fixed in 1.32.4-rc1

Insecure default settings for recorder products

• Yokogawa Electric Corporation GX10 / GX20 / GP10 / GP20 Paperless Recorders
• Yokogawa Electric Corporation GM Data Acquisition System
• CWE-1188

In JetBrains RubyMine before 2025.1 remote Interpreter overwrote ports to listen on all interfaces

• JetBrains RubyMine
• CWE-1188

Shopware default newsletter opt-in settings allow for mass sign-up abuse

• CWE-799
• CWE-1188

<6.5.8.17 || >=6.6.0.0-rc1, <6.6.10.3 || >=6.7.0.0-rc1, <6.7.0.0-rc2 · fixed in 6.5.8.17, 6.6.10.3, 6.7.0.0-rc2

CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could potentially lead to unauthorized access which could result in the loss of confidentially, integrity and…

• Schneider Electric Trio Q Licensed Data Radio
• CWE-1188

CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could lead to loss of confidentiality when a malicious user, having physical access, sets the radio in factor…

• Schneider Electric Trio Q Licensed Data Radio
• CWE-1188

Zoom Workplace Apps for Windows - Insecure Default Variable Initialization

• Zoom Communications, Inc Zoom Workplace Apps for Windows
• CWE-1188

Dell Common Event Enabler: Dell Common Event Enabler, version(s) CEE 9.0.0.0…

• Dell Common Event Enabler
• CWE-1188

Default or Guessable SNMP community names in B&R APROL

• B&R Industrial Automation GmbH APROL
• Information disclosure
• CWE-1188

mbedtls: Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side…

• mbedtls
• CWE-1188

CODESYS (Edge) Gateway for Windows insecure default

• CODESYS Edge Gateway
• CODESYS Gateway for Windows
• CWE-1188

CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an attacker to execute unauthorized commands when a system’s default password credentials have no…

• Schneider Electric WebHMI – Deployed with EcoStruxure Power Automation System
• CWE-1188

Mage AI insecure default initialization of resource

• Mage AI
• CWE-1188

QHora

• QNAP Systems Inc. QuRouter
• Command injection
• CWE-1188

Insecure default configurations in HI-SCAN 6040i Hitrax HX-03-19-I allow authenticated attackers with low-level privileges to escalate to root-level privileges.

• CWE-1188

shadow-maint shadow-utils: shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior…

• shadow-maint shadow-utils
• CWE-1188

Filament has exported files stored in default (`public`) filesystem if not reconfigured

• CWE-1188

>=3.2.0, <3.2.123 · fixed in 3.2.123

An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14.

• CWE-1188

Asio C++ Library before 1.13.0 lacks a fallback error code in the case of SSL_ERROR_SYSCALL with no associated error information from the SSL library being used.

• CWE-1188

Denial of Service in Forescout SecureConnector

• Forescout SecureConnector
• CWE-1188

HCL Sametime is impacted by insecure services

• HCL Software Sametime
• CWE-1188

Insecure Default Initialization of Resource vulnerability in Apache Solr

• CWE-1188

>=6.6.0, <8.11.4 || >=9.0.0, <9.7.0 · fixed in 8.11.4, 9.7.0

SEIKO EPSON CORPORATION Web Config: Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote…

• SEIKO EPSON CORPORATION Web Config
• CWE-1188

Pure Storage FlashArray: A condition exists in FlashArray Purity whereby a local account intended for initial…

• Pure Storage FlashArray
• CWE-1188

Mozilla Firefox: Firefox normally asks for confirmation before asking the operating system to find an…

• Mozilla Firefox
• Mozilla Firefox ESR
• CWE-1188

Insecure default setting for Server Pro installed via Overleaf toolkit

• overleaf
• Broken access control
• CWE-1188

In onForegroundServiceButtonClicked of FooterActionsViewModel.kt, there is a possible way to disable the active VPN app from the lockscreen due to an insecure default value.

• Google Android
• CWE-1188

IP Forwarding enabled in B&R Automation Runtime

• B&R Industrial Automation Automation Runtime
• CWE-653
• CWE-1188

Ricoh Company, Ltd. JavaTM Platform: Initialization of a resource with an insecure default vulnerability exists in JavaTM…

• Ricoh Company, Ltd. JavaTM Platform
• CWE-1188

Initialization of a resource with an insecure default vulnerability in FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. allows a remote unauthenticated attacker t…

• Century Systems Co., Ltd. FutureNet NXR-1300 series
• Century Systems Co., Ltd. FutureNet NXR-650
• CWE-1188

Degraded secret zeroization capabilities

• CWE-1188

>=0.5.0, <0.6.0 · fixed in 0.6.0

Apache ActiveMQ's default configuration doesn't secure the API web context

• CWE-1188

>=6.0.0, <6.1.2 · fixed in 6.1.2

Insecure deserialization in BentoML

• CWE-1188

<1.2.5 · fixed in 1.2.5