CWE-330: Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- socket socket.io, hackerone socket.io node module +1 moreInsecure randomness in socket.io7.5 High
- randomatic project randomatic, hackerone react-native-meteor-oauth node module +1 moreCryptographically Weak PRNG in randomatic5.3 Medium
- debian linux, kernel drivers, linux kernel +1 more +3 morekernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's...5.9 Medium
- cloudfoundry capi-releaseCloud Foundry Cloud Controller, versions prior to 1.52.0, contains information disclosure and...8.1 High
- zohocorp manageengine desktop centralRemote Information Disclosure and Escalation of Privileges in ManageEngine Desktop Central MSP 10...9.8 Critical
- asus asuswrtHighly predictable session tokens in the HTTPd server in all current versions (<= 3.0.0.4.380...8.3 High
- swhouse istar ultra firmwareA door-unlocking issue was discovered on Software House iStar Ultra devices through 6.5.2.20569...7.4 High
- hoermann hs5-868-bs firmware, hse1-868-bs firmware, hse2-868-bs firmware +2 moreOn Hoermann BiSecur devices before 2018, a vulnerability can be exploited by recording a single...6.5 Medium
- wordpresswp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be...8.8 High
- nippon telegraph and telephone east corporation pwr-q200, ntt-east pwr-q200 firmware +1 morePWR-Q200 does not use random values for source ports of DNS query packets, which allows remote...7.5 High
- cisco jabberA vulnerability in Cisco Jabber for Windows could allow an unauthenticated, local attacker to...4.0 Medium
- pysaml2 project pysaml2Pysaml2 improperly initializes encryption vector5.3 Medium
- wi-fi alliance protected access (wpa and wpa2), canonical ubuntu linux, debian linux +10 more +12 moreWi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Station-To-Station-Link (STSL)...6.8 Medium
- wi-fi alliance protected access (wpa and wpa2), canonical ubuntu linux, debian linux +10 more +12 moreWi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity...5.3 Medium
- canonical ubuntu linux, debian linux, freebsd +9 more +11 moreWi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group...5.3 Medium
- wi-fi alliance protected access (wpa and wpa2), canonical ubuntu linux, debian linux +10 more +12 moreWi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup ...6.8 Medium
- wi-fi alliance protected access (wpa and wpa2), canonical ubuntu linux, debian linux +10 more +12 moreWi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the...8.1 High
- wi-fi alliance protected access (wpa and wpa2), canonical ubuntu linux, debian linux +10 more +12 moreWi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the...5.3 Medium
- wi-fi alliance protected access (wpa and wpa2), canonical ubuntu linux, debian linux +10 more +12 moreWi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK)...5.3 Medium
- wi-fi alliance protected access (wpa and wpa2), canonical ubuntu linux, debian linux +10 more +12 moreWi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the...5.3 Medium
- wi-fi alliance protected access (wpa and wpa2), canonical ubuntu linux, debian linux +10 more +12 moreWi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK)...5.3 Medium
- wi-fi alliance protected access (wpa and wpa2), canonical ubuntu linux, debian linux +10 more +12 moreWi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK)...6.8 Medium
- ge multilin sr 369 motor protection relay firmware, multilin sr 469 motor protection relay firmware, multilin sr 489 generator protection relay firmware +7 more +9 moreA Weak Cryptography for Passwords issue was discovered in General Electric (GE) Multilin SR 750...9.8 Critical
- rockwellautomation 1763-l16awa series a, 1763-l16awa series b, 1763-l16bbb series a +17 more +19 moreA "Reusing a Nonce, Key Pair in Encryption" issue was discovered in Rockwell Automation Allen...9.8 Critical
- rockwellautomation 1763-l16awa series a, 1763-l16awa series b, 1763-l16bbb series a +17 more +19 moreA Predictable Value Range from Previous Values issue was discovered in Rockwell Automation Allen...8.6 High
- schneider-electric modicon m241 firmware, modicon m251 firmware +1 moreA Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs...9.1 Critical
- ellislab expressionengineExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with...7.5 High
- aescrypt project aescryptAescrypt does not sufficiently use random values7.5 High
- xmlsoft libxsltIn libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random...5.3 Medium
- froxlorFroxlor guessable password reset token9.8 Critical
- dlink dwr-932b firmwareAn issue was discovered on the D-Link DWR-932B router. WPS PIN generation is based on srand(time...7.5 High
- animas onetouch ping firmwareJohnson & Johnson Animas OneTouch Ping devices do not properly generate random numbers, which...7.5 High
- orientdbOrientDB Server Community Edition uses insufficiently random values to generate session IDs5.9 Medium
- windriver vxworksWind River VxWorks before 5.5.1, 6.5.x through 6.7.x before 6.7.1.1, 6.8.x before 6.8.3, 6.9.x...5.8 Medium
- fatfreecrm fat free crmFat Free CRM has fixed token value5.0 Medium
- siemens ruggedcom rugged operating systemThe integrated HTTPS server in Siemens RuggedCom ROS before 3.12.2 allows remote attackers to...8.3 High
- urbanairship python-oauth2SimpleGeo python-oauth2 vulnerable to the use of Insufficiently Random Values to generate nonces5.8 Medium
- redhat ansibleAnsible uses a socket with predictable filename in /tmp1.9 Low
- digital alert systems dasdec eas, monroe electronics r189 one-net eas +1 moredasdec_mkuser on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe...7.5 High
- g.rodola pyftpdlibpyftpdlib Use of Insufficiently Random Values of port selection on PASV command5.0 Medium
- typo3TYPO3 is vulnerable to Insecure randomness in uniqid function5.3 Medium
- torrenttrader project torrenttraderaccount-recover.php in TorrentTrader Classic 1.09 chooses random passwords from an insufficiently...7.5 High
- typo3, debian linux +1 moreThe System extension Install tool in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0...7.5 High
- freebsdThe arc4random function in the kernel in FreeBSD 6.3 through 7.1 does not have a proper entropy...7.0 High
- mybbMyBB (aka MyBulletinBoard) 1.4.2 uses insufficient randomness to compose filenames of uploaded...7.5 High
- typosphere typoTypo 5.1.3 and earlier uses a hard-coded salt for calculating password hashes, which makes it...7.5 High
- apple iphone osThe Networking subsystem in Apple iPod touch 2.0 through 2.0.2, and iPhone 2.0 through 2.0.2,...9.8 Critical
- trendmicro officescan, worry-free business security, client server messaging suite +2 moreThe web management console in Trend Micro OfficeScan 7.0 through 8.0, Worry-Free Business...9.8 Critical
- e107, labgab, my123tkshop e-commerce-suite +5 more +7 moreThe CAPTCHA implementation as used in (1) Francisco Burzi PHP-Nuke 7.0 and 8.1, (2) my123tkShop e...7.5 High
- microsoft windows 2000, windows server 2003, windows vista +1 more +3 moreThe DNS client in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, and Vista uses...7.5 High
- Show moreLoading…