Falhas do tipo CWE-1188

264 resultados

Padrão inseguro não alterado pelo administrador

A aplicação é entregue com uma configuração padrão insegura (como senha padrão, porta aberta, ou função habilitada por padrão) que deveria ser mudada na primeira execução ou durante a administração, mas não é. O desenvolvedor assume que o admin vai mudar, mas isso frequentemente não acontece, deixando a falha na produção.

Exemplo

Um servidor de banco de dados instalado com usuário 'admin' e senha 'admin123' como padrão, documentado que deve ser alterado na primeira inicialização. Se o administrador pula essa etapa ou a ignora, qualquer um consegue acessar o banco com credenciais triviais.

Como mitigar

Force a mudança de configurações críticas na primeira execução (bloqueie a aplicação até que defaults inseguros sejam alterados), forneça valores padrão aleatórios e únicos por instalação, ou use setup assistido que não permite prosseguir sem trocar credenciais e permissões perigosas.

CVE-2022-41648CRITICALThe HEIDENHAIN Controller TNC 640 NC software Version 340590 07 SP5, is vulnerable to improper authentication in its DNC communication for CEPSS 0.9%CVE-2026-110631CRITICALKomodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default ConfigurationEPSS 0.9%CVE-2022-1278—A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.EPSS 0.9%CVE-2026-41432HIGHNew API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota FraudEPSS 0.9%CVE-2026-25894CRITICALFUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default ConfigurationEPSS 0.8%CVE-2023-33949MEDIUMIn Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email EPSS 0.8%CVE-2024-47295HIGHInsecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary passworEPSS 0.8%CVE-2026-109437CRITICALCognition < 0.13.0 Unauthenticated RCE via Local Shell BackendEPSS 0.8%CVE-2025-59321CRITICALCPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM PCR policy that fails to consider the system boot state. This EPSS 0.8%CVE-2026-77915CRITICALrConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.phpEPSS 0.8%CVE-2026-57147CRITICALpraisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgeryEPSS 0.8%CVE-2022-3262HIGHA flaw was found in Openshift. A pod with a DNSPolicy of "ClusterFirst" may incorrectly resolve the hostname based on a service provided. ThEPSS 0.8%CVE-2026-57139CRITICALPraisonAI MCPServer exposes unauthenticated HTTP tools/callEPSS 0.8%CVE-2025-1863CRITICALInsecure default settings for recorder productsEPSS 0.8%CVE-2024-31070CRITICALInitialization of a resource with an insecure default vulnerability in FutureNet NXR series, VXR series and WXR series provided by Century SEPSS 0.8%CVE-2024-45217HIGHApache Solr: ConfigSets created during a backup restore command are trusted implicitlyEPSS 0.7%CVE-2026-122006CRITICALThe activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operaEPSS 0.7%CVE-2025-41438CRITICALConsilium Safety CS5000 Fire Panel Initialization of a Resource with an Insecure DefaultEPSS 0.7%CVE-2026-44109CRITICALOpenClaw < 2026.4.15 - Authentication Bypass in Feishu Webhook and Card-Action ValidationEPSS 0.7%CVE-2026-33037HIGHWWBN AVideo has predictable default admin credentials in official Docker deployment pathEPSS 0.7%