CWE-330: Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- aviatrix controllerAn issue was discovered in Aviatrix Controller before R5.3.1151. An encrypted file containing...7.5 High
- basetech ge-131 bt-1837836 firmwareA predictable device ID in BASETech GE-131 BT-1837836 firmware 20180921 allows unauthenticated...5.3 Medium
- linux kernel, redhat enterprise linux +1 moreA flaw in the way reply ICMP packets are limited in the Linux kernel functionality was found that...7.4 High
- red hat ansible, redhat ansible engine, debian linux +2 moreInsufficiently random values in Ansible5.5 Medium
- konzept-ix publixonekonzept-ix publiXone before 2020.015 allows attackers to download files by iterating over the...7.5 High
- pam tacplus project tacpluslibtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes(). This could lead to use of a non-random/predictable session_id.9.8 Critical
- facebook whatsapp for android, whatsapp +1 moreMedia ContentProvider URIs used for opening attachments in other apps were generated sequentially...3.3 Low
- cpanelcPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561).7.5 High
- gitlabA vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2...3.8 Low
- google androidIn various functions in fscrypt_ice.c and related files in some implementations of f2fs...4.4 Medium
- microsoft netlogon, canonical ubuntu linux, debian linux +24 more +26 moreNetlogon Elevation of Privilege Vulnerability5.5 Medium
- kee keepassrpcThe SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 generates insufficiently random...9.1 Critical
- debian linux, linux kernel, canonical ubuntu linux +12 more +14 moreThe Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain...3.7 Low
- easyrobotics er-flex firmware, er-lite firmware, er-one firmware +8 more +10 moreRVD#2556: MiR REST API allows for data exfiltration by unauthorized attackers (e.g. indoor maps)7.1 High
- ibm security guardiumIBM Security Guardium 10.6 and 11.1 may use insufficiently random numbers or values in a security...5.3 Medium
- convosConvos before 4.20 does not properly generate a random secret in Core/Settings.pm and Util.pm....5.3 Medium
- python, fedoraproject fedora, opensuse leap +4 more +6 moreIncorrect Calculation and Use of Insufficiently Random Values in Python5.9 Medium
- treck tcp\/ipThe Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS...9.0 Critical
- sos-berlin jobschedulerA vulnerability based on insecure user/password encryption in the JOE (job editor) component of...7.5 High
- ntp, fujitsu m10-1 firmware, m10-4 firmware +22 more +24 morentpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of...5.9 Medium
- dell emc isilon onefs, isilon onefs +1 moreDell EMC Isilon versions 8.2.2 and earlier contain a remotesupport vulnerability. The pre...5.3 Medium
- netgear rbs50y firmware, srr60 firmware, srs60 firmware +2 moreAn issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2...9.6 Critical
- health covidsafeNon-reinitialisation of random data in the advertising payload in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker to re-identify Android devices running COVIDSafe by scanning for their advertis…7.5 High
- pivotal software spring security, spring security +1 moreDictionary attack with Spring Security queryable text encryptor6.5 Medium
- dahuasecurity ipc-hdbw1320e-w firmware, ipc-hx2xxx firmware, ipc-hx5842h firmware +17 more +19 moreSome Dahua products with Build time before December 2019 have Session ID predictable...9.8 Critical
- oklok project oklokThe OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has an...5.3 Medium
- bluezoneReact Native Bluetooth Scan in Bluezone 1.0.0 uses six-character alphanumeric IDs, which might...6.5 Medium
- zoom meetingsairhost.exe in Zoom Client for Meetings 4.6.11 uses 3423423432325249 as the Initialization Vector...7.5 High
- dnnsoftware dotnetnukeThere is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in...4.3 Medium
- ceph, redhat ceph storage, openshift +2 more +4 moreA vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2...6.4 Medium
- gnu gnutls, canonical ubuntu linux, debian linux +5 more +7 moreGnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is...7.4 High
- zim-wiki zimZim through 0.72.1 creates temporary directories with predictable names. A malicious user could...5.5 Medium
- cpanelIn cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525).3.3 Low
- opcfoundation netstandard.opc.ua, ua-.netstandard +1 moreInsufficient Nonce Validation in Eclipse Milo Client7.4 High
- moxa mb3170 firmware, mb3180 firmware, mb3270 firmware +3 more +5 moreAn issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480...6.5 Medium
- gitlabAn issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users...4.3 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, qualcomm msm8905 firmware, msm8909 firmware +18 more +20 moreThe secret key used to make the Initial Sequence Number in the TCP SYN packet could be brute...9.8 Critical
- keycloak, redhat keycloak operator +1 morePredictable password in Keycloak9.1 Critical
- justblab blab\! ax, blab\! ax pro, blab\! ws +1 more +3 moreAn insecure random number generation vulnerability in BlaB! AX, BlaB! AX Pro, BlaB! WS (client),...8.8 High
- voatzThe Voatz application 2020-01-01 for Android allows only 100 million different PINs, which makes...5.9 Medium
- canonical cloud-init, debian linux, opensuse leap +2 morecloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier...5.5 Medium
- jenkinsInbound TCP Agent Protocol/3 authentication bypass in Jenkins8.6 High
- pyrad, fedoraproject fedora +1 morepyrad is vulnerable to the use of Insufficiently Random Values5.9 Medium
- neatorobotics botvac connected firmwareAn issue was discovered in Neato Botvac Connected 2.2.0. The GenerateRobotPassword function of...4.7 Medium
- wpseeds wp database backupThe WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in...7.5 High
- debian linux, linux kernel, netapp 8300 firmware +11 more +13 moreThe flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device...5.3 Medium
- joomla! core, joomla joomla\! +1 moreJoomla! core before 2.5.3 allows unauthorized password change.7.5 High
- microsoft windows, windows 10 version 1903 for 32-bit systems, windows 10 version 1903 for arm64-based systems +13 more +15 moreAn elevation of privilege vulnerability exists when Microsoft Windows implements predictable...7.8 High
- miekg-dns project miekg-dnsmiekg/dns insecurely generates random numbers5.9 Medium
- weidmueller ie-sw-pl08m-6tx-2sc firmware, ie-sw-pl08m-6tx-2scs firmware, ie-sw-pl08m-6tx-2st firmware +37 more +39 moreAn issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build...9.8 Critical
- Show moreLoading…