Threats Tagged 'cwe-1188'

The VPS.org one-click Zulip template deploys with insecure default settings including a hardcoded application signing key, a default database password 'zulip', and HTTPS disabled by default. This configuration exposes deployments to critical risks such as unauthorized access and data compromise. The vulnerability is identified as CVE-2026-16504 with a high CVSS score of 9.8, indicating critical severity. No specific affected versions or official patches are currently documented. The vendor advisory does not provide explicit remediation guidance or confirm the availability of a fix.

The VPS.org one-click Supabase template deploys a PostgreSQL instance that listens on all network interfaces (0.0.0.0:5432) with a default password of "postgres". This configuration exposes the database to remote access without authentication changes and bypasses host firewall protections due to Docker's iptables rules. This vulnerability allows unauthenticated attackers to gain full read and write access to the database, posing a critical security risk.

Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1 - The default configuration of the extension allowed read access and password reset of CMS accounts.

Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on all network interfaces by default.

In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once the local zone tree exists without the defaults, every query for a default-protected name from a client mapped to that view escapes to the public DNS via the iterator instead of being answered locally, bypassing local policy expectations.

CVE-2026-47393 affects MervinPraison's PraisonAI multi-agent system. The vulnerability arises because the code-generator for a Flask API server disables authentication by default, exposing critical endpoints without access control. This allows unauthenticated users to interact with the API, potentially accessing sensitive data and controlling LLM orchestration. Versions prior to 4.6.40 ship with this insecure default. The issue is fixed in version 4.6.40 by enabling authentication via configuration.

An insecure default configuration vulnerability exists in the Membership Pro extension for Joomla versions prior to 4.6.2. This flaw allows unauthenticated users to upload media assets due to improper initialization of resource permissions. The issue is classified under CWE-1188 and carries a critical severity rating with a CVSS score of 9.1.

Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 did by default allow unauthenticated users to upload media assets.