CWE-330: Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- globaldatingsoftware premiumdatingscriptAn Incorrect Access Control vulnerability exists in Premiumdatingscript 4.2.7.7 via the password...9.8 Critical
- open-xchange ox app suiteOX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within...6.1 Medium
- concretecms concrete cmsImproper file handling in concrete5/core7.2 High
- amd 1st gen amd epyc™, 2nd gen amd epyc™, 3rd gen amd epyc™ +57 more +59 morePersistent platform private key may not be protected with a random IV leading to a potential “two...7.5 High
- servicetonicUnauthorized system access in the login form in ServiceTonic Helpdesk software version < 9.0...9.8 Critical
- vmware installbuilderOn Windows, the uninstaller binary copies itself to a fixed temporary location, which is then...8.8 High
- debian linux, linux kernel, fedoraproject fedora +18 more +20 moreA flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the...7.4 High
- zohocorp manageengine remote access plusZoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number...7.5 High
- riot-os riotIn RIOT-OS 2021.01, nonce reuse in 802.15.4 encryption in the ieee820154_security component...5.5 Medium
- siemens logo! cmr2020, logo! cmr2040, simatic rtu3010c +9 more +11 moreA vulnerability has been identified in LOGO! CMR2020 (All versions < V2.2), LOGO! CMR2040 (All...5.4 Medium
- booster for woocommerce, pluggabl llc booster for woocommcerce +1 moreBooster for WooCommerce <= 5.4.3 Authentication Bypass9.8 Critical
- hcc-embedded nichestack, siemens sentron 3wa com190 firmware, sentron 3wl com35 firmware +2 moreAn issue was discovered in HCC Nichestack 3.0. The code that generates Initial Sequence Numbers ...9.1 Critical
- hcc-embedded nichestackAn issue was discovered in HCC embedded InterNiche 4.0.1. This vulnerability allows the attacker...7.5 High
- google androidIn memory management driver, there is a possible system crash due to improper input validation....5.5 Medium
- invisioncommunity invision power boardInvision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows reflected XSS...6.1 Medium
- yogeshojha renginereNgine through 0.5 relies on a predictable directory name.9.8 Critical
- yiiframework yii, yiisoft yiisoft/yii2 +1 moreUse of Predictable Algorithm in Random Number Generator in yiisoft/yii28.1 High
- yiiframework yii, yiisoft yiisoft/yii2 +1 moreUse of Predictable Algorithm in Random Number Generator in yiisoft/yii28.1 High
- google android, samsung mobile devices +1 moreAn IV reuse vulnerability in keymaster prior to SMR AUG-2021 Release 1 allows decryption of...5.5 Medium
- fortinet fortisandboxAn instance of small space of random values in the RPC API of FortiSandbox before 4.0.0 may allow...5.3 Medium
- ypsomed mylife, mylife cloud +1 moreYpsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7...5.9 Medium
- solarwinds orion platformThe node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to...5.4 Medium
- fedoraproject fedora, openidc mod auth openidc +1 moreHardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidc5.9 Medium
- ratpackDefault client side session signing key is highly predictable4.4 Medium
- wowonderIn WoWonder 3.0.4, remote attackers can take over any account due to the weak cryptographic...9.8 Critical
- f5 nginx controllerThe NAAS 3.x before 3.10.0 API keys were generated using an insecure pseudo-random string and...5.5 Medium
- sylabs sif, singularity image format +1 morePredictable SIF UUID Identifiers7.5 High
- google androidIn startIpClient of ClientModeImpl.java, there is a possible identifier which could be used to...7.5 High
- automox, automox agent +1 moreAutomox Agent Guessable S3 Bucket Endpoint3.7 Low
- siemens nucleus net, nucleus readystart v3, nucleus source code +2 moreA vulnerability has been identified in Nucleus NET (All versions), Nucleus RTOS (versions...5.3 Medium
- siemens apogee pxc compact (bacnet), apogee pxc compact (p2 ethernet), apogee pxc modular (bacnet) +9 more +11 moreA vulnerability has been identified in Nucleus 4 (All versions < V4.1.0), Nucleus NET (All...5.3 Medium
- centreonPredictable CSRF tokens in centreon/centreon6.5 Medium
- zte zxhn h108n firmware, zxhn h168n firmware +1 moreSome ZTE products have CSRF vulnerability. Because some pages lack CSRF random value verification...6.5 Medium
- samsung emailUsing predictable index for attachments in Samsung Email prior to version 6.1.41.0 allows remote...6.5 Medium
- consensys discoveryConsensys Discovery Nonce Reuse5.3 Medium
- libtpms project libtpms, fedoraproject fedora, redhat enterprise linux +2 moreA flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms...5.5 Medium
- netflix hollowInsecure temporary file in Netflix OSS Hollow4.4 Medium
- huawei usg9500 firmware, usg9520 firmware, usg9560 firmware +1 more +3 moreThere is insecure algorithm vulnerability in Huawei products. A module uses less random input in...7.5 High
- google androidIn onPackageModified of VoiceInteractionManagerService.java, there is a possible change of...5.5 Medium
- anuko time tracker, timetracker +1 morePredictable tokens used for password resets6.8 Medium
- ymfe yapiWeak JSON Web Token in yapi-vendor5.1 Medium
- apache myfaces, apache software foundation myfaces core, netapp oncommand insight +2 moreCross-Site Request Forgery (CSRF) vulnerability in Apache MyFaces7.5 High
- owncloud serverownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim,...6.8 Medium
- rand core project coreIncorrect check on buffer length in rand_core9.8 Critical
- mofinetwork mofi4500-4gxelte firmwareAn issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. The one-time password...7.5 High
- sooil anydana-a firmware, anydana-i firmware, diabecare rs firmware +2 moreIn SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol...8.8 High
- butok fnetAn issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface...5.3 Medium
- askey ap5100w firmwareAskey AP5100W devices through AP5100W_Dual_SIG_1.01.097 are affected by WPS PIN offline brute...5.9 Medium
- nanorand project nanorandImproper random number generation in nanorand9.8 Critical
- schneider-electric acti9 powertag link firmware, acti9 powertag link hd firmware, acti9 smartlink el b firmware +4 more +6 moreA CWE-330 - Use of Insufficiently Random Values vulnerability exists in Smartlink, PowerTag, and...9.8 Critical
- Show moreLoading…