CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
A kind of CWE-330 Use of Insufficiently Random Values.
From the CWE List. © The MITRE Corporation.
Newest
- miyagawa plack::middleware::sessionPlack-Middleware-Session before version 0.35 for Perl generates session ids insecurely7.3 High
- gryphon mojolicious::plugin::captchapngMojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha text9.1 Critical
- gryphon mojolicious::plugin::csrfMojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens7.0 High
- mojoliciousMojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default5.3 Medium
- node-formidable formidableFormidable relies on hexoid to prevent guessing of filenames for untrusted executable content3.1 Low
- delta electronics commgrCOMMGR - Insufficient Randomization Authentication Bypass9.8 Critical
- lds crypt::cbcCrypt::CBC versions between 1.21 and 3.05 for Perl may use insecure rand() function for cryptographic functions4.0 Medium
- jenkins ssh-slave, jenkins project jenkins/ssh-slave docker images +1 moreIn jenkins/ssh-slave Docker images based on Debian, SSH host keys are generated on image creation...9.1 Critical
- jenkins ssh-agent, jenkins project jenkins/ssh-agent docker images +1 moreIn jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image...9.1 Critical
- elliott net::xeroNet::Xero 0.044 and earlier for Perl uses insecure rand() function for cryptographic functions6.5 Medium
- localshop webservice::xero, webservice\ +1 moreWebService::Xero 0.11 for Perl uses insecure rand() function for cryptographic functions5.5 Medium
- taniguchi amon2::auth::site::line, nipotan line integration for amon2 +1 moreAmon2::Auth::Site::LINE versions through 0.04 for Perl uses insecure rand() function for cryptographic functions5.5 Medium
- norbu net::dropbox::api, norbu09 net\ +1 moreNet::Dropbox::API 1.9 and earlier for Perl uses insecure rand() function for cryptographic functions5.5 Medium
- lev web::api, web\ +1 moreWeb::API 2.8 and earlier for Perl uses insecure rand() function for cryptographic functions5.5 Medium
- hachi crypt::saltCrypt::Salt for Perl uses insecure rand() function when generating salts for cryptographic purposes5.3 Medium
- zefram data::entropyData::Entropy for Perl uses insecure rand() function for cryptographic functions7.7 High
- wreis dbix::class::encodedcolumnDBIx::Class::EncodedColumn until 0.00032 for Perl uses insecure rand() function for salting password hashes in Crypt/Eksblowfish/Bcrypt.pm4.0 Medium
- wreis dbix::class::encodedcolumnDBIx::Class::EncodedColumn until 0.00032 for Perl uses insecure rand() function for salting password hashes in Digest.pm4.0 Medium
- fortinet fortimailA use of a cryptographically weak pseudo-random number generator vulnerability in the...6.9 Medium
- langgenius dify, langgenius/dify +1 moreAdmin account takeover through weak Pseudo-Random number generator used in generating password reset codes in langgenius/dify7.5 High
- perl crypt::random, timlegge crypt\ +1 morePerl's Crypt::Random module after 1.05 and before 1.56 may use rand() function for cryptographic functions8.8 High
- sonicwall sonicosUse of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the SonicOS SSLVPN...9.8 Critical
- guzzle oauth-subscriberGuzzle OAuth Subscriber has insufficient nonce entropy6.3 Medium
libnet-oauth-perlDebian,perl-Crypt-URandomMageia,perl-Module-BuildMageia +1 more +3 moreIn Net::OAuth::Client in the Net::OAuth package before 0.29 for Perl, the default nonce is a 32...5.3 Mediumlibnet-easytcp-perlDebianThe Net::EasyTCP package 0.15 through 0.26 for Perl uses Perl's builtin rand() if no strong...5.4 Medium- No product listedThe Net::EasyTCP package before 0.15 for Perl always uses Perl's builtin rand(), which is not a...5.4 Medium
libcrypt-random-source-perlDebianThe Crypt::Random::Source package before 0.13 for Perl has a fallback to the built-in rand()...7.5 High- sonicwall sma100, sma100 firmware, sma 200 firmware +4 more +6 moreUse of cryptographically weak pseudo-random number generator (PRNG) vulnerability in the...5.3 Medium
- unknown migration, backup, staging, wpvivid migration\, backup\, staging, wpvivid team migration backup staging +2 moreMigration, Backup, Staging – WPvivid < 0.9.106 - Unauthenticated Sensitive Data Exposure7.5 High
- gotenna, gotenna pro atak plugin +1 moregoTenna Pro ATAK Plugin Use of Cryptographically Weak Pseudo-Random Number Generator7.1 High
- emlog pro, gotenna pro app +1 moreUse of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in goTenna Pro7.1 High
tgtDebian,iscsitargetUbuntu,scsi-target-utilsopenEuler +2 moretgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand...5.9 Medium- amd radeon™ pro w6000 series graphics cards, radeon™ rx 6000 series graphics cards +1 moreGeneration of weak and predictable Initialization Vector (IV) in PMFW (Power Management Firmware)...1.9 Low
- hackmd codimdCodiMD - Missing Image Access Controls and Unauthorized Image Access5.3 Medium
- apache streampipesApache StreamPipes, Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation9.1 Critical
- bluditBludit - Insecure Token Generation6.0 Medium
stormpath/sdkPackagiststormpath/sdk uses Insecure Random Number Generator5.3 Medium- thales luna eftNetwork Key Transfer with AES KHT vulnerability in Luna EFT5.9 Medium
- mozilla firefoxAn HTTP digest authentication nonce value was generated using `rand()` which could lead to...5.9 Medium
- mateso passwordsafeMateso PasswordSafe through 8.13.9.26689 has Weak Cryptography.7.5 High
- No product listedAn issue ingalxe.com Galxe platform 1.0 allows a remote attacker to obtain sensitive information...5.3 Medium
- putty, tigris tortoisesvn, tortoisegit +3 more +5 moreIn PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to...5.9 Medium
- rt-threadRT-Thread through 5.0.2 generates random numbers with a weak algorithm of "seed = 214013L * seed ...7.5 High
- binance trust walletThe Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag...7.5 High
- tianocore edk2Use of a Weak PseudoRandom Number Generator in EDK II Network Package5.3 Medium
- tianocore edk2Predictable TCP ISNs in EDK II Network Package5.8 Medium
- ethyca fidesCryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides8.2 High
- motorola mtm5000 series firmware, mobile radio, mtm5400 firmware +1 more +3 moreWeak PRNG entropy source used for authentication challenge generation in Motorola MTM50008.8 High
- ixpdata easyinstallAn issue found in IXP Data Easy Install 6.6.148840 allows a remote attacker to escalate...8.1 High
- libbitcoin explorerThe cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6...7.5 High
- Show moreLoading…