CWE-453
Insecure Default Variable Initialization
VariantDraft
Description
The product, by default, initializes an internal variable with an insecure or less secure value than is possible.
Hierarchy (View 1000)
Parents
Children
none
CVEs mapped to this weakness (22)
page 2 of 2| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2008-6540 | 0.03 | — | 0.02 | Mar 30, 2009 | DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) DecryptionKey values cannot be modified in the web.config file, which allows remote attackers to bypass intended access restrictions by using the… | |||
| CVE-2025-47945 | Cri | 0.00 | 9.1 | 0.01 | May 17, 2025 | Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens (JWT) for authentication, but the signing secret has a weak default value. While the responsibility is left to the system administrator to change it, this… |
- CVE-2008-6540Mar 30, 2009risk 0.03cvss —epss 0.02
DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) DecryptionKey values cannot be modified in the web.config file, which allows remote attackers to bypass intended access restrictions by using the…
- risk 0.00cvss 9.1epss 0.01
Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens (JWT) for authentication, but the signing secret has a weak default value. While the responsibility is left to the system administrator to change it, this…