CWE-331: Insufficient Entropy
The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
A kind of CWE-330 Use of Insufficiently Random Values.
From the CWE List. © The MITRE Corporation.
Newest
- schneider electric ecostruxure™ it data center expertCWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when...8.9 High
- d-link dcs-6517, dcs-7517, dlink dcs-6517 firmware +1 more +3 moreD-Link DCS-6517/DCS-7517 Root Password Generation httpd generate_pass_from_mac entropy6.3 Medium
- meshtastic firmwareMeshtastic Repeated Public and Private Keypairs9.5 Critical
- lukevella ralllyRallly Insufficient Password Login Token Entropy Leads to Account Takeover9.8 Critical
- mojoliciousMojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default8.1 High
- lds crypt::cbcCrypt::CBC versions between 1.21 and 3.05 for Perl may use insecure rand() function for cryptographic functions4.0 Medium
- elliott net::xeroNet::Xero 0.044 and earlier for Perl uses insecure rand() function for cryptographic functions6.5 Medium
- localshop webservice::xero, webservice\ +1 moreWebService::Xero 0.11 for Perl uses insecure rand() function for cryptographic functions5.5 Medium
- norbu net::dropbox::api, norbu09 net\ +1 moreNet::Dropbox::API 1.9 and earlier for Perl uses insecure rand() function for cryptographic functions5.5 Medium
- lev web::api, web\ +1 moreWeb::API 2.8 and earlier for Perl uses insecure rand() function for cryptographic functions5.5 Medium
- zefram data::entropyData::Entropy for Perl uses insecure rand() function for cryptographic functions7.7 High
- wreis dbix::class::encodedcolumnDBIx::Class::EncodedColumn until 0.00032 for Perl uses insecure rand() function for salting password hashes in Crypt/Eksblowfish/Bcrypt.pm4.0 Medium
- wreis dbix::class::encodedcolumnDBIx::Class::EncodedColumn until 0.00032 for Perl uses insecure rand() function for salting password hashes in Digest.pm4.0 Medium
- opennetworking onosLimited secret space in LLDP packets used in onos v2.7.0 allows attackers to obtain the private...7.5 High
- silabs.com simplicity sdkDPA Countermeasures need reseeding4.2 Medium
- perl crypt::random, timlegge crypt\ +1 morePerl's Crypt::Random module after 1.05 and before 1.56 may use rand() function for cryptographic functions8.8 High
- No product listedBangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV...7.5 High
- google androidIn RsaKeyPairGenerator::getNumberOfIterations of RSAKeyPairGenerator.java, an incorrect...7.5 High
- cisco adaptive security appliance (asa) software, firepower threat defense software, adaptive security appliance software +1 more +3 moreCisco Adaptive Security Appliance and Firepower Threat Defense Software VPN Authentication DoS Vulnerability6.8 Medium
- rittal cmc iii processing units firmware, iot interface firmware, rittal gmbh & co. kg iot interface & cmc iii processing unit +1 more +3 morePredictable Session ID9.8 Critical
- eufy homebase 2 firmwareEufy HomeBase 2 model T8010X v3.2.8.3h was discovered to use the deprecated wireless protocol...8.2 High
- devise-two-factorInsufficient Default OTP Shared Secret Length6.0 Medium
- zyxel gs1900-10hp firmware, gs1900-16 firmware, gs1900-24 firmware +7 more +9 moreAn insufficient entropy vulnerability caused by the improper use of a randomness function with...5.3 Medium
- red hat openshift container platform 4.12, openshift container platform 4.13, openshift container platform 4.14 +4 more +6 moreOpenshift-console: oauth2 insufficient state parameter entropy8.0 High
zendframework/zend-captchaPackagistZend-Captcha Information Disclosure and Insufficient Entropy vulnerability7.5 Highzendframework/zendframeworkPackagistZendFramework Information Disclosure and Insufficient Entropy vulnerability5.3 Medium- viz-rs nano-id, viz nano id +1 morenano-id is unable to generate the correct character set9.4 Critical
paragonie/random_compatPackagistrandom_compat Uses insecure CSPRNGNo scorelaravel/socialitePackagistInsecure State Generation in laravel/socialiteNo scorefriendsofsymfony/user-bundlePackagistFOSUserBundle Entropy is lost in the TokenGeneratorNo score- intel ipmi, dell idrac8, intel * +2 moreInsufficient Randomness When Validating an IPMI Authenticated Session9.1 Critical
- chilkatsoft chilkatChilkat before v9.5.0.98, allows attackers to obtain sensitive information via predictable PRNG...6.2 Medium
- samsung exynos 1080, exynos 1280, exynos 1330 +23 more +25 moreAn issue was discovered in Samsung Mobile Processor, Automotive Processor, Wearable Processor,...5.3 Medium
- hitrontech coda-4582u firmware, coda-4589 firmware +1 moreHitron CODA-4582 and CODA-4589 devices have default PSKs that are generated from 5-digit hex...9.8 Critical
- silabs gecko software development kit, silabs.com gsdk +1 moreUninitialized TRNG used for ECDSA after EM2/EM3 sleep for VSE devices6.8 Medium
- steve-community steveSteVe v3.6.0 was discovered to use predictable transaction ID's when receiving a StartTransaction...7.5 High
- wwbn avideoWWBN AVideo Insufficient Entropy vulnerbaility9.8 Critical
- github enterprise serverInsufficient Entropy in GitHub Enterprise Server Management Console Invitation Token8.3 High
- pubnub c-core, kotlin, pubnub +1 more +3 morepubnub Insufficient Entropy vulnerability5.9 Medium
- schweitzer engineering laboratories sel-451, selinc sel-451 firmware +1 moreInsufficient entropy vulnerability could lead to authentication bypass7.5 High
- jose4j project jose4jjose4j uses weak cryptographic algorithm7.5 High
- qnap qts, quts hero +1 moreQTS, QuTS hero3.1 Low
- broadcom raid controller web interface, lsi storage authority (lsa), intel raid web console 3 (rwc3) +2 moreBroadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection9.8 Critical
- rws worldserverSession tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated,...5.3 Medium
- ovarro tbox lt2, tbox ms-cpu32, tbox rm2 +7 more +9 more?The affected TBox RTUs generate software security tokens using insufficient entropy. The random...5.9 Medium
- cmscommander cms commander, thoefter cms commander – manage multiple sites +1 moreCMS Commander <= 2.287 - Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature8.1 High
- crypto-js project crypto-jscrypto-js uses insecure random numbers5.3 Medium
- cisco adaptive security appliance, adaptive security appliance (asa) software, secure firewall threat defense +2 moreCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability5.3 Medium
- suse rancherRancher: Non-random authentication token7.1 High
- unspecified phpservermon, phpservermonitor php server monitor +1 morephpservermon User.php setUserLoggedIn predictable algorithm in random number generator2.6 Low
- Show moreLoading…