248 matches found
CVE-2025-25271
An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface...
CVE-2025-25271
CVE-2025-25271 describes an authentication-related misconfiguration in Phoenix Contact CHARX SEC OCPP implementations where an unauthenticated, network-adjacent attacker can configure a new OCPP backend due to insecure default settings in the configuration interface. Multiple sources (including N...
CVE-2025-25271 OCPP Backend Configuration via Insecure Defaults
An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface...
CVE-2025-25271 OCPP Backend Configuration via Insecure Defaults
An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface...
PT-2025-28348 · Phoenix Contact · Charx Sec-3000 +7
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: An unauthenticated adjacent attacker can configure a new OCPP backend due to insecure defaults for the configuration interface. Recommendations: At the moment, there is no information about ...
CVE-2023-33806
Insecure default configurations in Hikvision Interactive Tablet DS-D5B86RB/B V2.3.0 build220119, allows attackers to execute arbitrary commands...
CVE-2023-21397
In Setup Wizard, there is a possible way to save a WiFi network due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2023-21220
there is a possible use of unencrypted transport over cellular networks due to an insecure default value. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroi...
CVE-2023-1899
Atlas Copco Power Focus 6000 web server is not a secure connection by default, which could allow an attacker to gain sensitive information by monitoring network traffic between user and controller...
CVE-2021-33130
Insecure default variable initialization of IntelR RealSenseTM ID Solution F450 before version 2.6.0.74 may allow an unauthenticated user to potentially enable information disclosure via physical access...
Unveiling the Landscape of LLM Deployment in the Wild: an Empirical Study
Background: Large language models LLMs are increasingly deployed via open-source and commercial frameworks, enabling individuals and organizations to self-host advanced AI capabilities. However, insecure defaults and misconfigurations often expose LLM services to the public Internet, posing...
Authorization Bypass Through User-Controlled Key
Overview browser-use is a Make websites accessible for AI agents Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key due to the default settings disablesecurity=True and --remote-debugging-address=0.0.0.0. A remote attacker can execute arbitrary...
CVE-2025-2442
CVE-2025-2442 concerns Schneider Electric Trio Q Licensed Data Radio. The vulnerability stems from Initialization of a Resource with an Insecure Default , enabling a malicious user with physical access to set the radio to factory default mode and trigger unauthorized access, potentially compromis...
Insecure Defaults
Overview fprime-gds is a F Prime Flight Software Ground Data System layer Affected versions of this package are vulnerable to Insecure Defaults by repeated invocation of sendcommand, which can overflow the queue and consume excessive memory. Remediation There is no fixed version for fprime-gds...
[SECURITY] [DLA 4080-1] libaws security update
Debian LTS Advisory DLA-4080-1 [email protected] https://www.debian.org/lts/security/ Andreas Henriksson March 09, 2025 https://wiki.debian.org/LTS Package : libaws Version : 20.2-2+deb11u1 CVE ID : CVE-2024-55581 Debian Bug : AdaCore released a security advisory for "Insecure defaults ...
Moxa EDS-4000/G4000 Series Initialization of a Resource with an Insecure Default (CVE-2024-0387)
The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to the product and have it forwarded to the target. An attacker can bypass access controls or hide the source of malicious requests. This plugi...
Smiths Detection HI-SCAN 6040i Hitrax HX-03-19-I 安全漏洞
The Smiths Detection HI-SCAN 6040i Hitrax HX-03-19-I is an entry-level X-ray equipment electronic component from Smiths Detection, UK. A security vulnerability exists in the Smiths Detection HI-SCAN 6040i Hitrax HX-03-19-I that stems from an insecure default configuration that allows an...
The vulnerability of Remote Desktop Services (RDS) for Windows operating systems allows a hacker to execute arbitrary code.
The vulnerability of Remote Desktop Services RDS for Windows operating systems lies in the default insecure initialization of certain variables. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...