Weaknesses of type CWE-1188

190 results

Padrão inseguro que deveria ser alterado pelo administrador

O software sai da fábrica com configurações padrão inseguras (senhas fracas, portas abertas, protocolos desabilitados) que o administrador precisaria mudar manualmente. O problema é quando o desenvolvedor assume que essa mudança vai acontecer e não força o usuário a fazer isso na primeira execução, deixando sistemas desprotegidos em produção.

Example

Um servidor web vem com credenciais padrão (admin/admin) e a documentação diz 'altere na primeira inicialização'. Mas o admin esquece ou não lê, e o sistema fica acessível com essas credenciais conhecidas publicamente, permitindo invasão imediata.

How to mitigate

Force a mudança de configurações críticas na primeira inicialização (modo setup obrigatório), gere padrões fortes automaticamente (senhas aleatórias) ou desabilite recursos perigosos por padrão, exigindo ativação explícita do admin com reconhecimento dos riscos.

CVE-2020-13927CRITICALThe previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security riEPSS 99.8%KEVCVE-2023-27524HIGHApache Superset: Session validation vulnerability when using provided default SECRET_KEYEPSS 97.4%KEVCVE-2022-24706CRITICALRemote Code Execution Vulnerability in PackagingEPSS 92.4%KEVCVE-2026-44338HIGHPraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow executionEPSS 28.6%CVE-2025-48927MEDIUMThe TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploitEPSS 8.7%KEVCVE-2021-41192HIGHInsecure default configurationEPSS 8.0%CVE-2024-32114HIGHApache ActiveMQ: Jolokia and REST API were not secured with default configurationEPSS 7.1%CVE-2026-47668CRITICALDbGate: Unauthenticated Remote Code Execution via JSON Script RunnerEPSS 4.3%CVE-2026-41679CRITICALPaperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization BypassEPSS 3.0%CVE-2026-44825HIGHApache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure usersEPSS 2.2%CVE-2023-6448CRITICALUnitronics VisiLogic uses a default administrative passwordEPSS 2.1%KEVCVE-2024-22207MEDIUMDefault swagger-ui configuration exposes all files in the moduleEPSS 2.0%CVE-2026-54066HIGHSiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)EPSS 1.9%CVE-2026-66066CRITICALAction Pack: Possible arbitrary file read and remote code execution in Active Storage variant processingEPSS 1.8%CVE-2019-19340HIGHA flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager by setting it with '-EPSS 1.5%CVE-2023-45312HIGHIn the mtproto_proxy (aka MTProto proxy) component through 0.7.2 for Erlang, a low-privileged remote attacker can access an improperly securEPSS 1.5%CVE-2024-2912CRITICALInsecure Deserialization Leading to RCE in bentoml/bentomlEPSS 1.5%CVE-2026-6043HIGHInsecure Default Configuration in P4 ServerEPSS 1.3%CVE-2022-42467MEDIUMh2 webconsole (available only in prototype mode) should nevertheless be disabled by default.EPSS 1.2%CVE-2026-28775CRITICALUnauthenticated RCE via SNMP Default Writable Community StringEPSS 1.2%