CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
A kind of CWE-330 Use of Insufficiently Random Values.
From the CWE List. © The MITRE Corporation.
Newest
- ibm api connect Multiple Vulnerabilities in IBM API Connect 5.1 Medium
- ibm api connect Multiple Vulnerabilities in IBM API Connect 8.1 High
- cotonti Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime()) 6.3 Medium
- No product listed CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand() 7.5 High
- tp-link systems inc. re305 v3 Administrator Password Reset Through the Verification-Code Interface in TP-Link RE305 6.1 Medium
- zephyrproject zephyr IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key 3.7 Low
- typo3 extension "typo3 fluid-form by coding.ms" Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form) 6.3 Medium
- diem-project diem diem-project diem dmString.php random weak prng 6.3 Medium
- glavsoft tightvnc World-accessible IPC shared memory with predictable name in TightVNC Server 7.8 High
- asynchttpclient async-http-client AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source 3.7 Low
- hascheksolutions pictshare PictShare < 3.7.1 Predictable Delete Code via rand() 8.2 High
- getsimplecms-ce GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover 9.1 Critical
- fortra core privileged access manager (boks) Fortra BoKS Server Agent adjoin machine-account password generation vulnerability 4.8 Medium
- fortra boks manager boks-server Predictable Active Directory service-account passwords in BoKS Manager 9.9 Critical
- eclipse foundation threadx netx duo NetX Secure DTLS server issues predictable HelloVerifyRequest cookies, so a spoofed client can pass the return-routability check 6.3 Medium
- gitroomhq postiz-app Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys 9.1 Critical
- nivocart NivoCart through 2.4.0 Predictable Administrator Password Reset Token 9.2 Critical
- cotonti Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG 9.2 Critical
- chaitin safeline SafeLine through 9.4.1 Authentication Bypass via Weak Session Secret 9.2 Critical
- espocrm EspoCRM through 10.0.8 Weak Token Generation via rand() 6.3 Medium
-
github.com/gorilla/websocketGo Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key 6.9 Medium - jahlives openssl encrypt openssl_encrypt before 1.4.0 Insecure Random Import in PQC Module 6.3 Medium
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +1 more +3 more Data-science-pipelines-operator: dspo: cryptographically weak secret generation (math/rand) for db and s3 credentials 7.5 High
- brix crypto-js crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain 9.0 Critical
- ibm langflow oss, langflow +1 more Langflow is affected by weaknesses in secret handling and sensitive configuration access 7.4 High
- broadcom spring tools, spring tools for eclipse +1 more Spring Boot DevTools remote secret generated with a non-cryptographic PRNG 8.3 High
- juneandgreen sm-crypto sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock 9.1 Critical
- regularlabs.com ip login extension for joomla Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension 9.1 Critical
- gnome librest, red hat enterprise linux 10, enterprise linux 10.0 extended update support +2 more Librest: weak random number generation in pkce implementation 6.8 Medium
- extreme networks switch engine (exos) ExtremeXOS Debug-Mode Privilege Escalation via Weak PRNG 8.7 High
-
libdancer2-perlDebian,perl-Dancer2Mageia +1 more Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable 8.2 High - drsteve crypt::password Crypt::Password versions through 0.28 for Perl generate insecure random values for salts 9.8 Critical
- urwid Insecure PRNG and Information Exposure in urwid Web Display Backend 9.2 Critical
- burak gd::securityimage GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets 5.3 Medium
- wg-easy WireGuard Easy Weak Token Generation Information Disclosure via OTL Route 9.0 Critical
- rejetto hfs Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Key 9.3 Critical
- unknown dologin security DoLogin Security <= 4.3 - Unauthenticated Authentication Bypass via Insufficient Randomness via 'dologin' Parameter Weak PRNG Token 8.8 High
- uvnc ultravnc UltraVNC MS-Logon II uses 64-bit Diffie-Hellman and seeded libc rand() enabling credential interception 7.4 High
- uvnc ultravnc UltraVNC vncauth.c uses time-seeded libc rand() to generate VNC authentication challenge bytes 4.8 Medium
- markstos cgi::session::id::md5 CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources 5.9 Medium
- ibm langflow oss, langflow +1 more Weak Cryptographic Key Derivation Exposed All Stored Credentials 9.1 Critical
- sanko net::bittorrent Net::BitTorrent versions before 2.1.0 for Perl generate the MSE Diffie-Hellman private key with a non-cryptographic PRNG 5.9 Medium
- hayajo mojolicious::plugin::web::auth::oauth2 Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter 9.1 Critical
- jetbrains hub In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430,... 9.8 Critical
- hayajo mojolicious::sessions::storable Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely 5.3 Medium
- biafra dancer2::plugin::auth::oauth Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce 9.1 Critical
- arodland crypt::pbkdf2 Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts 7.5 High
- haxtheweb haxcms-php haxtheweb/haxcms-php uses insecure method for generating salt 7.5 High
- linqi gmbh linqi Hardcoded Cryptographic Keys and Weak IV Generation in linqi 8.5 High
- cloud foundry foundation windows-utilities-release Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH... 6.5 Medium
- Show olderLoading…