CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.
A kind of CWE-330 Use of Insufficiently Random Values.
From the CWE List. © The MITRE Corporation.
Newest
- randombit botan Botan: AutoSeeded_RNG can become reinitialized from predictable data after clearing state 7.3 High
- netgear ex3700, ex6120 +1 more Insufficient session randomness vulnerability exists in certain NETGEAR EX Series Models 2.1 Low
- davido bytes::random::secure::tiny Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes 7.5 High
- davido bytes::random::secure Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes 7.5 High
- dcit cryptx CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking 7.5 High
- arm mbed tls, trustedfirmware tf-psa-crypto +1 more Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number... 7.7 High
- wolfssl, wolfssl inc. (wolfcrypt) +1 more Fault injection attack with ML-DSA and ML-KEM on ARM 4.3 Medium
- gallagher high sec end of line module Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High... 5.7 Medium
- nih brics NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates... 7.5 High
- google gvisor Improved Seeding and Hashing In gVisor 6.3 Medium
- apache cocoon Apache Cocoon: continuations may not be private 7.5 High
-
colpackDebian ColPack 1.0.10 through 9a7293a has a predictable temporary file (located under /tmp with a name... 6.6 Medium - canonical authd Authd allows attacker-controlled usernames to yield controllable UIDs 7.5 High
- canonical juju JUJU_CONTEXT_ID is a predictable authentication secret 8.7 High
- qt, qt network authorization, fedoraproject fedora +2 more QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through... 9.8 Critical
- secomea gatemanager Insufficient seeding of random number generator 8.1 High
- gnu savane An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the... 8.8 High
- objectplanet opinio Cryptographically weak PRNG in Opinio 7.22 9.8 Critical
- ubuntu budgie budgie extras budgie-extras vulnerabilities 6.0 Medium
- mitsubishi electric corporation melsec iq-f series fx5uc-32mr/ds-ts, melsec iq-f series fx5uc-32mt/d, melsec iq-f series fx5uc-32mt/ds-ts +117 more +119 more Authentication Bypass Vulnerability in Web Server Function on MELSEC Series 5.9 Medium
- dlink covr 1200 firmware, covr 1202 firmware, covr 1203 firmware +2 more D-Link COVR 1200,1202,1203 v1.08 was discovered to have a predictable seed in a Pseudo-Random... 4.3 Medium
- rabbitmq rabbitmq-server, vmware rabbitmq, broadcom rabbitmq server +2 more Predictable credential obfuscation seed value used in rabbitmq-server 5.5 Medium
- fastly js-compute, js-compute-runtime +1 more Random number seed fixed during compilation 7.5 High
- argoproj argo-cd, argo cd +1 more Insecure entropy in argo-cd 8.3 High
- random password generator project password generator Insecure PRNG use in random_password_generator 7.5 High
- dell powerscale onefs, emc powerscale onefs +1 more Dell PowerScale OneFS, versions 8.2.x-9.3.x, contain a predictable seed in pseudo-random number... 8.1 High
- piwigo Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo... 8.1 High
- telenot compasx Telenot complex: Insecure AES Key Generation 5.5 Medium
- thales safenet authentication service, thalesgroup safenet authentication service remote desktop gateway +1 more Safenet Authentication Service Remote Desktop Gateway prior to 2.0.3 may allow privilege escilation to authenticated users 7.8 High
- juliangruber keypair Insecure random number generation 8.7 High
- protectimus slim nfc 70 firmware Protectimus SLIM NFC 70 10.01 devices allow a Time Traveler attack in which attackers can predict... 4.6 Medium
- pulsesecure virtual traffic manager An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could... 7.5 High
- epignosishq efront A predictable seed vulnerability exists in the password reset functionality of Epignosis... 9.8 Critical
- steghide project steghide steghide 0.5.1 relies on a certain 32-bit seed value, which makes it easier for attackers to... 7.5 High
- intel bmc firmware, nvidia dgx servers +1 more NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the... 7.5 High
- 1password scim, command line interface +1 more An issue was discovered in beta versions of the 1Password command-line tool prior to 0.5.5 and in... 9.8 Critical
- elastic cloud on kubernetes Cryptographic Issues in ECK 7.5 High
- dlink dir-865l firmware D-Link DIR-865L Ax 1.20B01 Beta devices have a predictable seed in a Pseudo-Random Number Generator. 7.5 High
- openbsd, debian linux, dietlibc +2 more lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0. 9.8 Critical
- couchbase server Couchbase Server 5.1.1 generates insufficiently random numbers. The product hosts many network... 9.8 Critical
- airsonic project airsonic In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang... 9.8 Critical
- python, canonical ubuntu linux, debian linux +5 more +7 more Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization.... 5.3 Medium
- mozilla network security services (nss), network security services +1 more When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random... 5.9 Medium
- ntop ntopng An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of... 8.1 High
- ibm db2, db2 for linux, unix and windows +1 more IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG... 7.4 High
- tp-link archer c9 \(2.0\) firmware passwd_recovery.lua on the TP-Link Archer C9(UN)_V2_160517 allows an attacker to reset the admin... 9.8 Critical
- codextrous b2j contact The Codextrous B2J Contact (aka b2j_contact) extension before 2.1.13 for Joomla! allows... 7.5 High
- dlink dwr-932b firmware An issue was discovered on the D-Link DWR-932B router. WPS PIN generation is based on srand(time... 7.5 High