Common Weakness Enumeration
CWE-453
AllowedInsecure Default Variable Initialization
Abstraction: Variant · Status: Draft
The product, by default, initializes an internal variable with an insecure or less secure value than is possible.
43 vulnerabilities reference this CWE, most recent first.
GHSA-4JMM-C6JW-G796
Vulnerability from github – Published: 2024-07-31 21:32 – Updated: 2024-09-06 21:37
VLAI
Summary
Filestash configured to skip TLS certificate verification when using the FTPS protocol
Details
filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init function of index.go.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mickael-kerjean/filestash"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-41255"
],
"database_specific": {
"cwe_ids": [
"CWE-295",
"CWE-453"
],
"github_reviewed": true,
"github_reviewed_at": "2024-08-02T16:27:35Z",
"nvd_published_at": "2024-07-31T21:15:18Z",
"severity": "HIGH"
},
"details": "filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init function of index.go.",
"id": "GHSA-4jmm-c6jw-g796",
"modified": "2024-09-06T21:37:51Z",
"published": "2024-07-31T21:32:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41255"
},
{
"type": "WEB",
"url": "https://github.com/mickael-kerjean/filestash/issues/710"
},
{
"type": "WEB",
"url": "https://gist.github.com/nyxfqq/c367f2ca9448810924dcf0f1af30b441"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-4jmm-c6jw-g796"
},
{
"type": "PACKAGE",
"url": "https://github.com/mickael-kerjean/filestash"
},
{
"type": "WEB",
"url": "https://github.com/mickael-kerjean/filestash/blob/master/server/plugin/plg_backend_ftp/index.go#L108"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2024-3033"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Filestash configured to skip TLS certificate verification when using the FTPS protocol"
}
GHSA-5PQW-JJJW-GF67
Vulnerability from github – Published: 2024-12-12 03:33 – Updated: 2024-12-12 03:33
VLAI
Details
Windows Remote Desktop Services Remote Code Execution Vulnerability
Severity
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2024-49120"
],
"database_specific": {
"cwe_ids": [
"CWE-362",
"CWE-453"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-12T02:04:38Z",
"severity": "HIGH"
},
"details": "Windows Remote Desktop Services Remote Code Execution Vulnerability",
"id": "GHSA-5pqw-jjjw-gf67",
"modified": "2024-12-12T03:33:05Z",
"published": "2024-12-12T03:33:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49120"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49120"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5R5J-MWFC-HGXH
Vulnerability from github – Published: 2024-03-12 18:31 – Updated: 2024-03-12 18:31
VLAI
Details
Skype for Consumer Remote Code Execution Vulnerability
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2024-21411"
],
"database_specific": {
"cwe_ids": [
"CWE-453"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-12T17:15:50Z",
"severity": "HIGH"
},
"details": "Skype for Consumer Remote Code Execution Vulnerability",
"id": "GHSA-5r5j-mwfc-hgxh",
"modified": "2024-03-12T18:31:12Z",
"published": "2024-03-12T18:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21411"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21411"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-67Q8-HW3V-9FJ4
Vulnerability from github – Published: 2024-08-16 00:32 – Updated: 2024-08-16 18:30
VLAI
Details
In onForegroundServiceButtonClicked of FooterActionsViewModel.kt, there is a possible way to disable the active VPN app from the lockscreen due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
7.7 (High)
{
"affected": [],
"aliases": [
"CVE-2024-34734"
],
"database_specific": {
"cwe_ids": [
"CWE-1188",
"CWE-453"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-15T22:15:06Z",
"severity": "HIGH"
},
"details": "In onForegroundServiceButtonClicked of FooterActionsViewModel.kt, there is a possible way to disable the active VPN app from the lockscreen due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-67q8-hw3v-9fj4",
"modified": "2024-08-16T18:30:57Z",
"published": "2024-08-16T00:32:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34734"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/frameworks/base/+/207584fb6f820eba14251251d7e9331bfd57adb8"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-08-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-74JH-9HHR-RXH5
Vulnerability from github – Published: 2026-10-13 21:33 – Updated: 2026-10-13 21:33
VLAI
Details
Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2026-103577"
],
"database_specific": {
"cwe_ids": [
"CWE-453"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-13T19:17:53Z",
"severity": "HIGH"
},
"details": "Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network.",
"id": "GHSA-74jh-9hhr-rxh5",
"modified": "2026-10-13T21:33:03Z",
"published": "2026-10-13T21:33:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103577"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103577"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-879P-8GW4-MCPW
Vulnerability from github – Published: 2024-03-15 19:01 – Updated: 2024-03-15 19:01
VLAI
Summary
fgr Vulnerable to Insecure Default Variable Initialization
Details
Impact
Any users whom would not desire a traceback to be included in their logs whenever an error is raised in their code will be affected.
If users have inadvertently created a scenario in their code that could cause a traceback to include sensitive information and a malicious entity gained access to their log stream, this could create an issue.
Patches
None yet... users will need to upgrade to 0.4.*
Workarounds
No particularly reasonable ones at present.
References
- https://cwe.mitre.org/data/definitions/453.html
- https://www.invicti.com/web-vulnerability-scanner/vulnerabilities/stack-trace-disclosure-python/
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "fgr"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-453"
],
"github_reviewed": true,
"github_reviewed_at": "2024-03-15T19:01:10Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "### Impact\nAny users whom would not desire a traceback to be included in their logs whenever an error is raised in their code will be affected.\n\nIf users have inadvertently created a scenario in their code that could cause a traceback to include sensitive information _and_ a malicious entity gained access to their log stream, this could create an issue.\n\n### Patches\nNone yet... users will need to upgrade to `0.4.*`\n\n### Workarounds\nNo particularly reasonable ones at present.\n\n### References\n* https://cwe.mitre.org/data/definitions/453.html\n* https://www.invicti.com/web-vulnerability-scanner/vulnerabilities/stack-trace-disclosure-python/",
"id": "GHSA-879p-8gw4-mcpw",
"modified": "2024-03-15T19:01:10Z",
"published": "2024-03-15T19:01:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/dan1hc/fgr/security/advisories/GHSA-879p-8gw4-mcpw"
},
{
"type": "PACKAGE",
"url": "https://github.com/dan1hc/fgr"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": " fgr Vulnerable to Insecure Default Variable Initialization"
}
GHSA-9GP8-HJXR-6F34
Vulnerability from github – Published: 2026-04-03 02:57 – Updated: 2026-04-24 21:04
VLAI
Summary
OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls
Details
Summary
Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls
Current Maintainer Triage
- Status: open
- Normalized severity: medium
- Assessment: Real in shipped v2026.3.28: host exec env policy still missed proxy, TLS, Docker, and Git TLS variables until 4d912e0451 on 2026-03-31; maintainers already accepted it and the fix is unreleased.
Affected Packages / Versions
- Package:
openclaw(npm) - Latest published npm version:
2026.3.31 - Vulnerable version range:
<=2026.3.28 - Patched versions:
>= 2026.3.31 - First stable tag containing the fix:
v2026.3.31
Fix Commit(s)
4d912e04519b4bd53b248437c53748cdebce9a41— 2026-03-31T21:25:36+09:00
OpenClaw thanks @AntAISecurityLab for reporting.
Severity
4.4 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2026.3.28"
},
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.3.31"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-41330"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-453"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-03T02:57:00Z",
"nvd_published_at": "2026-04-21T00:16:31Z",
"severity": "MODERATE"
},
"details": "## Summary\nHost exec environment overrides miss proxy, TLS, Docker, and Git TLS controls\n\n## Current Maintainer Triage\n- Status: open\n- Normalized severity: medium\n- Assessment: Real in shipped v2026.3.28: host exec env policy still missed proxy, TLS, Docker, and Git TLS variables until 4d912e0451 on 2026-03-31; maintainers already accepted it and the fix is unreleased.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published npm version: `2026.3.31`\n- Vulnerable version range: `\u003c=2026.3.28`\n- Patched versions: `\u003e= 2026.3.31`\n- First stable tag containing the fix: `v2026.3.31`\n\n## Fix Commit(s)\n- `4d912e04519b4bd53b248437c53748cdebce9a41` \u2014 2026-03-31T21:25:36+09:00\n\nOpenClaw thanks @AntAISecurityLab for reporting.",
"id": "GHSA-9gp8-hjxr-6f34",
"modified": "2026-04-24T21:04:54Z",
"published": "2026-04-03T02:57:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-9gp8-hjxr-6f34"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41330"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/4d912e04519b4bd53b248437c53748cdebce9a41"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.31"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-environment-variable-override-via-host-exec-policy"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls"
}
GHSA-C87V-83C9-MWGP
Vulnerability from github – Published: 2026-06-17 18:35 – Updated: 2026-06-17 18:35
VLAI
Details
In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
7.8 (High)
10.0 (Critical)
{
"affected": [],
"aliases": [
"CVE-2026-0082"
],
"database_specific": {
"cwe_ids": [
"CWE-453"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-17T13:19:26Z",
"severity": "CRITICAL"
},
"details": "In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-c87v-83c9-mwgp",
"modified": "2026-06-17T18:35:45Z",
"published": "2026-06-17T18:35:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0082"
},
{
"type": "WEB",
"url": "https://source.android.com/docs/security/bulletin/android-17"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-CW58-3HPW-976J
Vulnerability from github – Published: 2023-10-12 18:30 – Updated: 2024-04-04 08:35
VLAI
Details
An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially crafted network packet can lead to unauthorized access. An attacker can send a network request to trigger this vulnerability.
Severity
7.3 (High)
{
"affected": [],
"aliases": [
"CVE-2023-27516"
],
"database_specific": {
"cwe_ids": [
"CWE-1188",
"CWE-453"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-12T16:15:11Z",
"severity": "HIGH"
},
"details": "An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially crafted network packet can lead to unauthorized access. An attacker can send a network request to trigger this vulnerability.",
"id": "GHSA-cw58-3hpw-976j",
"modified": "2024-04-04T08:35:52Z",
"published": "2023-10-12T18:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27516"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1754"
},
{
"type": "WEB",
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-F48F-2357-X2FH
Vulnerability from github – Published: 2026-10-13 18:30 – Updated: 2026-10-13 18:30
VLAI
Details
A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-109828"
],
"database_specific": {
"cwe_ids": [
"CWE-453"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-13T17:17:31Z",
"severity": "LOW"
},
"details": "A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.",
"id": "GHSA-f48f-2357-x2fh",
"modified": "2026-10-13T18:30:53Z",
"published": "2026-10-13T18:30:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109828"
},
{
"type": "WEB",
"url": "https://github.com/libsndfile/libsndfile/issues/1169"
},
{
"type": "WEB",
"url": "https://github.com/libsndfile/libsndfile"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-109828"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/1002209"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/417466"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/417466/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
System Configuration
Disable or change default settings when they can be used to abuse the system. Since those default settings are shipped with the product they are likely to be known by a potential attacker who is familiar with the product. For instance, default credentials should be changed or the associated accounts should be disabled.
No CAPEC attack patterns related to this CWE.