CWE-331: Insufficient Entropy
The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
A kind of CWE-330 Use of Insufficiently Random Values.
From the CWE List. © The MITRE Corporation.
Newest
- infinitt healthcare ulite Brute-forceable image-share link password in INFINITT ULite 7.5 High
- nomachine NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability 7.8 High
- diem-project diem diem-project diem dmString.php random weak prng 6.3 Medium
- synology diskstation manager (dsm) An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before... 9.8 Critical
- langbot-app langbot LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key 9.2 Critical
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 more Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior... 4.7 Medium
- siemens reyrolle 7sr5 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A session identifier... 9.1 Critical
- combodo itop Combodo iTop: Weak secret generation for inline image 7.5 High
- ibm powervm hypervisor, power system e1050 \(9043-mrx\) firmware, power system e1080 \(9080-hex\) firmware +24 more +26 more Power System Insufficient Entropy 5.1 Medium
- ibm powervm hypervisor, power system e1050 \(9043-mrx\) firmware, power system e1080 \(9080-hex\) firmware +22 more +24 more Power System Insufficient Entropy 5.3 Medium
- pkp pkp-lib pkp pkp-lib API Key Generation APIProfileForm.php setData entropy 6.3 Medium
- tenda ch10, ch7, ch7g +7 more +9 more Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropy 6.3 Medium
- brix crypto-js crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain 9.0 Critical
- tp link systems inc. omada access points, tp-link omada ds1008x firmware, omada ds1016g firmware +113 more +115 more Weak Session Key Generation in TP-Link Omada Adoption Protocol 6.9 Medium
- No product listed osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use... 9.8 Critical
- ibm powervm hypervisor, power system e1050 \(9043-mrx\) firmware, power system e1080 \(9080-hex\) firmware +15 more +17 more This Power System update is being released to address Insufficient Entropy 4.2 Medium
- sonatype nexus repository manager Nexus Repository Manager - Insufficient Entropy in Format-Specific API Key Generation 8.7 High
- raspberry pi 5 and compute module 5 Insufficient Entropy in Raspberry Pi 5 and Compute Module 5 5.1 Medium
- silabs.com simplicity sdk DPA Countermeasures weakening on Series 3 devices 7.1 High
- tchatzi authen::totp Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand 7.5 High
- timlegge crypt::dsa Crypt::DSA versions before 1.20 for Perl generate seeds using rand 7.3 High
- teodesian trog::totp Trog::TOTP versions before 1.006 for Perl generate secrets using rand 7.5 High
- silabs.com simplicity sdk Insufficient DPA countermeasure reseeding 4.1 Medium
- schneider electric easergy c5, easergy micom c264, easergy micom p30 +11 more +13 more Insufficient Entropy vulnerability on Multiple Products 8.7 High
- python, python software foundation cpython +1 more The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection 6.3 Medium
- openmage magento-lts Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs 9.3 Critical
- microchip istax Weak webstax_auth Cookie Authentication Allows Privilege Escalation 8.7 High
- libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 more libexpat before 2.7.6 uses insufficient entropy, and thus hash flooding can occur via a crafted... 2.9 Low
-
auth0/symfonyPackagist Auth0 Symfony SDK has Insufficient Entropy in Cookie Encryption 8.2 High -
auth0/wordpressPackagist Auth0 WordPress Plugin has Insufficient Entropy in Cookie Encryption 8.2 High -
auth0/loginPackagist Auth0 laravel-auth0 SDK has Insufficient Entropy in Cookie Encryption 8.2 High - auth0 auth0-php Auth0 PHP SDK Insufficient Entropy in Cookie Encryption 8.2 High
-
libcrux-ed25519crates.io libcrux has All-Zero Key Generation Upon Catastrophic RNG Failure 8.2 High - progress telerik ui for asp.net ajax Insufficient Entropy Vulnerability in Telerik UI for ASP.NET AJAX 5.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 more Glibc: vdso getrandom acceleration may return predictable randomness 4.8 Medium
- micca auto electronics co., ltd. car alarm system ke700 Micca KE700 Brute-force vulnerability due to low entropy 6.4 Medium
- silabs.com simplicity sdk DPA countermeasures not reseeded under certain conditions 1.0 Low
- rapid7 insightvm/nexpose Rapid7 Nexpose Insecure Java Keystore Password Generation 6.8 Medium
- tp-link systems inc. vx800v v1.0, tp-link vx800v firmware +1 more Insecure Encryption in Communication with the Web Interface on TP-Link VX800v 7.7 High
- rustcrypto elliptic-curves, sm2 elliptic curve +1 more RustCrypto SM2-PKE has 32-bit Biased Nonce Vulnerability 8.7 High
- arteco-global arteco web client dvr/nvr Arteco Web Client DVR/NVR Session ID Brute Force Authentication Bypass 8.7 High
- qno technology vpn firewall QNO Technology｜VPN Firewall - Insufficient Entropy 8.7 High
- wbce cms WBCE CMS has Weak Random Number Generator in Password Generation Function 9.1 Critical
- litmuschaos litmus Lack of entropy allows registered low-privileged users of Litmus to crack valid JWT tokens and gain admin privileges 7.1 High
- gofiber utils Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values 9.3 Critical
- kde connect verification-code protocol The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore... 4.7 Medium
- mercku m6a On Mercku M6a devices through 2.1.0, the authentication system uses predictable session tokens... 3.1 Low
- qwer crypt::randomencryption, crypt\ +1 more Crypt::RandomEncryption for Perl uses insecure rand() function during encryption 9.1 Critical
- typo3, typo3 cms +1 more Insufficient Entropy in Password Generation 6.3 Medium
- simbo1905 thinbus-srp-npm Thinbus generates insufficient entropy: 252 bits vs minimum 256 bits 6.9 Medium
- Show olderLoading…