CWE-330: Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- filegator FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive 5.4 Medium
- zephyrproject zephyr sys_rand_get() silently returns an unwritten buffer when the entropy device is not ready 4.8 Medium
- oray pugongying x5 pro Oray Pugongying X5 Pro Session ID session.lua session_get random values 2.3 Low
-
adminneo-org/adminneoPackagist AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery 6.8 Medium - zephyrproject zephyr DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing 6.5 Medium
- intranda goobi-viewer-core Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset 6.8 Medium
- intranda goobi-viewer-core Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset 6.5 Medium
- flatpak xdg-desktop-portal XDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer key 8.3 High
- nodejs node A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, ... 4.8 Medium
- linksys re6250 Linksys RE6250 Web Management strcmp random values 6.3 Medium
- google chrome Use after free in Notifications in Google Chrome on on Android prior to 156.0.8078.47 allowed a... 8.8 High
- ibm concert IBM Concert Software Use of Insufficiently Random Values 7.5 High
- daext lightweight cookie notice – cookie banner for cookie consent Lightweight Cookie Notice <= 1.19 - Sensitive Information Exposure via W3TC_DYNAMIC_SECURITY Constant 5.3 Medium
- omnispace agora project Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid() 9.1 Critical
- zephyrproject zephyr Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stack 4.8 Medium
- tp-link systems inc. tapo c325wb v2 Predictable Media Stream Pre-Shared Key Vulnerability in TP-Link Tapo C325WB 8.7 High
- dell container storage modules Dell Container Storage Modules, versions prior to 1.18.0 contain(s) an Use of Insufficiently... 7.7 High
- laurent22 joplin Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier 8.5 High
- eclipse foundation threadx netx duo NetX Secure DTLS server issues predictable HelloVerifyRequest cookies, so a spoofed client can pass the return-routability check 6.3 Medium
- isotope isotope-core Isotope eCommerce through 2.9.10 Weak Order Identifier Generation 8.2 High
- openeye apex network video recorder (nvr) OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrator password-reset... 6.2 Medium
- gitroomhq postiz-app Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys 9.1 Critical
- lantronix emg7500, emg8500, slb882 +4 more +6 more Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass 8.9 High
- wwbn avideo AVideo Weak PRNG Activation Code Authentication Bypass 9.1 Critical
- wwbn avideo AVideo Cryptographically Weak PRNG via uniqid Stream Key 8.3 High
- google cloud gemini enterprise agent platform sdk for python GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK 7.7 High
- apple ipados, macos, visionos +2 more +4 more A privacy issue was addressed with improved handling of identifiers. This issue is fixed in iOS... 7.5 High
- openidc cjose OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption 9.1 Critical
- No product listed The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month... 7.5 High
- wwbn avideo WWBN AVideo Weak PRNG Password Generation via External Login 7.4 High
- ibm i IBM i is Affected By Multiple Vulnerabilities in Debug Server 5.4 Medium
- wso2 api control plane, api manager +1 more Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads 5.9 Medium
- profilepress membership team profilepress ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE 9.2 Critical
- ash-project ash admin AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass 2.1 Low
- totolink n600r TOTOLINK N600R Authentication cstecgi.cgi loginAuth random values 6.3 Medium
- google cloud vertex ai search for commerce Bucket Squatting in Vertex AI Search for Commerce 9.3 Critical
- baptistearno typebot.io TypeBot: Account takeover via brute-forceable 6-digit magic-link code 9.1 Critical
- vrana adminer Adminer before 5.4.3 CSRF Token Secret Recovery via XOR Masking 6.1 Medium
- combodo itop Combodo iTop: Weak secret generation for inline image 7.5 High
-
ep_etherpad-litenpm Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling No score - pkp pkp-lib pkp pkp-lib API Key Generation APIProfileForm.php setData entropy 6.3 Medium
- man-group dtale mangroup dtale Flask Session Cookie app.py build_secret_key random values 6.3 Medium
- tenda ch10, ch7, ch7g +7 more +9 more Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropy 6.3 Medium
- ibm maximo application suite IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak H… 5.3 Medium
- smuellerdd libkcapi, red hat enterprise linux 10, enterprise linux 10.0 extended update support +8 more +10 more Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries 6.5 Medium
- apache wicket Apache Wicket: leaked and missing CSP headers 6.5 Medium
- bigbluebutton BigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate them 8.1 High
-
web-auth/webauthn-libPackagist Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection 2.9 Low - zcaceres markdownify-mcp zcaceres markdownify-mcp webpage-to-markdown Markdownify.ts saveToTempFile random values 2.0 Low
- timlegge crypt::dsa Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery 7.5 High
- Show olderLoading…