CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
A kind of CWE-330 Use of Insufficiently Random Values.
From the CWE List. © The MITRE Corporation.
Newest
- travianz project travianzThe cryptographically insecure random number generator being used in TravianZ 8.3.4 and 8.3.3 in...9.8 Critical
- dominionvoting democracy suiteA flawed pseudorandom number generator in Dominion Voting Systems ImageCast Precinct (ICP and...2.4 Low
- progress datadirect odbc oracle wire protocol driverAn issue was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle....5.9 Medium
- canonical landscapeLandscape insecure token generation6.8 Medium
- cbot core, panel, chatbot +2 moreInsecure Randomness in CBOT's Chatbot9.8 Critical
- trustwallet trust wallet browser extension, trust wallet core +1 moreTrust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183,...5.9 Medium
- nextcloud server, kiteworks security-advisories +1 moreInsecure randomness for default password in nextcloud3.5 Low
- propump and controls, inc. osprey pump controller, propumpservice osprey pump controller firmware +1 moreCVE-2023-283958.3 High
- onedev project onedevUse of Cryptographically Weak Pseudo-Random Number Generator in Onedev8.1 High
- dotcmsAn issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1. A...8.8 High
- arjunsharda passeoUse of insecure random number generator in Passeo5.9 Medium
- objectfirst ootbiAn issue was discovered in Object First 1.0.7.712. The authorization service has a flow that...9.8 Critical
- dlink covr 1200 firmware, covr 1202 firmware, covr 1203 firmware +2 moreD-Link COVR 1200,1202,1203 v1.08 was discovered to have a predictable seed in a Pseudo-Random...4.3 Medium
- sap customer data cloud, sap se customer data cloud (gigya) +1 moreSAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses insecure random number...5.2 Medium
- nodejs node, node.js, debian linux +1 more +3 moreA weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with...9.1 Critical
- profanity project profanityprofanity through 1.60 has only four billion possible RNG initializations. Thus, attackers can...7.5 High
- nodebbAccount takeover via cryptographically weak PRNG in NodeBB Forum9.0 Critical
- openvpn access serverOpenVPN Access Server before 2.11 uses a weak random generator used to create user session token...7.5 High
- cisco ata 187 analog telephone adapter firmware, ip phones with multiplatform firmware, unified ip phone 6911 firmware +9 more +11 moreCisco IP Phone Duplicate Key Vulnerability7.4 High
- ssh.net project ssh.netWeak private key generation in SSH.NET6.5 Medium
- codename065 download managerDownload Manager < 3.2.39 - Unauthenticated brute force of files master key7.5 High
- apache cloudstackApache Cloudstack insecure random number generation affects project email invitation7.5 High
- fortinet fortiportalThe use of a cryptographically weak pseudo-random number generator in the password reset feature...8.1 High
- sierra designs z-wave, silabs zgm130s037hgn firmware, zgm2305a27hgn firmware +3 more +5 moreZ-Wave devices from Sierra Designs (circa 2013) and Silicon Labs (using S0 security) may use a...8.3 High
- zulipRabbitMQ exposes ports with weak default secrets in Zulip Server8.6 High
- telenot compasxTelenot complex: Insecure AES Key Generation5.5 Medium
- netbsdIn NetBSD through 9.2, the IPv6 fragment ID generation algorithm employs a weak cryptographic PRNG.7.5 High
- netbsdIn NetBSD through 9.2, the IPv6 Flow Label generation algorithm employs a weak cryptographic PRNG.7.5 High
- showdoc, star7th star7th/showdoc +1 moreUse of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in star7th/showdoc6.5 Medium
- polarsslPolarSSL versions prior to v1.1 use the HAVEGE random number generation algorithm. At its heart,...9.8 Critical
- revive-adserver revive adserverVulnerability in the generation of session IDs in revive-adserver < 5.3.0, based on the...7.1 High
- acquia mauticUse of a Broken or Risky Cryptographic Algorithm3.5 Low
- palo alto networks pan-osPAN-OS: Weak Cryptography Used in Web Interface Authentication4.2 Medium
- yiiframework yii, yiisoft yiisoft/yii2 +1 moreUse of Predictable Algorithm in Random Number Generator in yiisoft/yii28.1 High
- jetbrains youtrackIn JetBrains YouTrack before 2021.2.16363, an insecure PRNG was used.7.5 High
- showdoc, star7th star7th/showdoc +1 moreUse of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in star7th/showdoc7.5 High
- eclipse tinydtls, the eclipse foundation eclipse tinydtls +1 moreEclipse TinyDTLS through 0.9-rc1 relies on the rand function in the C library, which makes it...7.5 High
- intel secl-dcUse of cryptographically weak pseudo-random number generator (PRNG) in an API for the Intel(R)...6.5 Medium
- satori uuidgo.uuid has Predictable UUID Identifiers9.8 Critical
- diso development team openidIt was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys,...5.9 Medium
- btcpayserver btcpay serverBTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate...5.3 Medium
- joomla joomla\!, joomla! project cms +1 more[20210301] - Core - Insecure randomness within 2FA secret generation5.3 Medium
- adremsoft netcrunchAdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web...9.8 Critical
- nanorand project nanorandImproper random number generation in nanorand9.8 Critical
- rclone, fedoraproject fedora +1 moreUse of Cryptographically Weak Pseudo-Random Number Generator in Rclone7.5 High
- infinitewpIn InfiniteWP Admin Panel before 3.1.12.3, resetPasswordSendMail generates a weak password-reset...9.8 Critical
- intel bmc firmware, nvidia dgx servers +1 moreNVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the...7.5 High
- dlink dir-865l firmwareD-Link DIR-865L Ax 1.20B01 Beta devices have a predictable seed in a Pseudo-Random Number Generator.7.5 High
- apple ipados, iphone os, mac os x +1 more +3 moreSome Broadcom chips mishandle Bluetooth random-number generation because a low-entropy Pseudo...6.5 Medium
- opensource-socialnetwork open source social networkAn issue was discovered in Open Source Social Network (OSSN) through 5.3. A user-controlled file...5.9 Medium
- Show moreLoading…