CWE-330: Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- trustedsec trevorc2TrevorC2 v1.1/v1.2 fails to prevent fingerprinting primarily via a discrepancy between response...7.5 High
- huawei vp9630 firmware, vp9650 firmware, vp9660 firmware +2 moreThere is a use of insufficiently random values vulnerability in Huawei ViewPoint products. An...7.5 High
- ethz xquest, fedoraproject fedora, redhat enterprise linux +1 more +3 moreA password generation weakness exists in xquest through 2016-06-13.2.5 Low
- debian linux, vanderbilt adaptive communication environment +1 moregenerate_doygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp...9.8 Critical
- ibm cognos controllerIBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 could allow an authenticated user to...4.3 Medium
- broadcom brocade sannav, brocade sannav +1 moreA vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute...8.8 High
- apache impalaIn Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala...7.5 High
- cryptocat project cryptocatCryptocat before 2.0.22 strophe.js Math.random() Random Number Generator Weakness9.1 Critical
- siemens simatic it uadmA vulnerability has been identified in SIMATIC IT UADM (All versions < V1.3). An authenticated...6.5 Medium
- centreon webThe token generator in index.php in Centreon Web before 2.8.27 is predictable.5.3 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, qualcomm mdm9205 firmware, mdm9206 firmware +45 more +47 moreUsage of hard-coded magic number for calculating heap guard bytes can allow users to corrupt heap...9.8 Critical
- apereo central authentication serviceUse of Insufficiently Random Values in Apereo CAS8.1 High
- opensslFork Protection5.3 Medium
- totaljs total.js cmsAn issue was discovered in Total.js CMS 12.0.0. A low privilege user can perform a simple...6.5 Medium
- humanica humatrix 7The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated...9.8 Critical
- adobe systems incorporated magento 2, magento +1 moreMagento 2 Community Edition Cryptographic Flaw7.5 High
- jisiwei i3 firmwareA vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner, while...4.8 Medium
- hidglobal digital persona u.are.u 4500 driver firmwareAn issue was discovered in the HID Global DigitalPersona (formerly Crossmatch) U.are.U 4500...5.9 Medium
- gnu glibc, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 moreGNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap...5.3 Medium
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +11 more +13 moreOn BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, under certain...5.5 Medium
- primasystems flexairPrima Systems FlexAir devices allow unauthenticated download of the database configuration backup...9.8 Critical
- primeo project primeoThe doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token,...6.5 Medium
- schneider-electric modicon m580 firmware, modicon m340 firmware, modicon premium firmware +1 more +3 moreCWE-330: Use of Insufficiently Random Values vulnerability, which could cause the hijacking of...6.5 Medium
- golang crypto, debian linux +1 moregolang.org/x/crypto/salsa20/salsa uses insufficiently random values5.9 Medium
- denx u-bootgen_rand_uuid in lib/uuid.c in Das U-Boot v2014.04 through v2019.04 lacks an srand call, which...5.9 Medium
- anomali agaveAnomali Agave (formerly Drupot) through 1.0.0 fails to avoid fingerprinting by including...7.5 High
- ilnkp2p project ilnkp2pThe algorithm used to generate device IDs (UIDs) for devices that utilize Shenzhen Yunni...8.2 High
- spring security, vmware spring security, debian linux +2 moreInsecure Randomness When Using a SecureRandom Instance Constructed by Spring Security3.8 Low
- abus secvest wireless alarm system fuaa50000 firmware, secvest wireless remote control fube50014 firmware, secvest wireless remote control fube50015 firmware +2 moreDue to unencrypted signal communication and predictability of rolling codes, an attacker can ...7.5 High
- abus secvest wireless alarm system fuaa50000 firmware, secvest wireless remote control fube50014 firmware, secvest wireless remote control fube50015 firmware +2 moreDue to the use of an insecure algorithm for rolling codes in the ABUS Secvest wireless alarm...9.8 Critical
- putty, debian linux, fedoraproject fedora +2 more +4 morePotential recycling of random numbers used in cryptography exists within PuTTY before 0.71.9.8 Critical
- matrix synapse, fedoraproject fedora +1 moreMatrix Synapse Predictable Secret Key7.5 High
- rubyonrails rails, debian linux, fedoraproject fedora +1 more +3 moreUse of Insufficiently Random Values in Railties Allows Remote Code Execution9.8 Critical
- opensslChaCha20-Poly1305 with long nonces7.4 High
- microsoft java sdk for azure iot, java software development kit +1 moreAn Elevation of Privilege vulnerability exists in the way Azure IoT Java SDK generates symmetric...9.8 Critical
- androidIn random_get_bytes of random.c, there is a possible degradation of randomness due to an insecure...7.5 High
- kaspersky lab codesys v3 products, codesys control for beaglebone sl, control for empc-a\/imx6 sl +13 more +15 moreUse of Insufficiently Random Values exists in CODESYS V3 products versions prior V3.5.14.0.7.5 High
- seafile seadroidThe seadroid (aka Seafile Android Client) application through 2.2.13 for Android always uses the...7.5 High
- juniper junos, juniper networks junos os +1 moreJunos OS: vMX series: Predictable IP ID sequence numbers vulnerability9.3 Critical
- guardzilla 180 indoor firmware, 180 outdoor firmware, 360 indoor firmware +3 more +5 moreThe Cloud API on Guardzilla smart cameras allows user enumeration, with resultant arbitrary...9.8 Critical
- hashheroesThe determineWinner function of a smart contract implementation for HashHeroes Tiles, an Ethereum...7.5 High
- pivotal rabbitmq for pcf, pivotal software rabbitmq +1 moreRabbitMQ cluster compromise due to deterministically generated cookie8.5 High
- silabs z-wave s0 firmware, z-wave s2 firmware +1 moreAn issue was discovered on Sigma Design Z-Wave S0 through S2 devices. An attacker first prepares...6.5 Medium
- kaptcha project kaptchaUse of Insufficiently Random Values in penggle:kaptcha9.8 Critical
- orange airbox firmwaregoform/getProfileList in Orange AirBox Y858_FL_01.16_04 allows attackers to extract APN data ...9.8 Critical
- nuuo cmsNUUO CMS all versions 3.1 and prior, The application uses a session identification mechanism that...9.8 Critical
- damicmsAn issue was discovered in damiCMS V6.0.1. It relies on the PHP time() function for cookies,...9.8 Critical
- posim evoPOSIM EVO 15.13 for Windows includes an "Emergency Override" administrative account that may be...7.8 High
- synology diskstation manager (dsm), diskstation manager +1 moreUse of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology...7.4 High
- pivotal operations managerPivotal Operations Manager, versions 2.1 prior to 2.1.6 and 2.0 prior to 2.0.15 and 1.12 prior to...5.9 Medium
- Show moreLoading…