CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
A kind of CWE-330 Use of Insufficiently Random Values.
From the CWE List. © The MITRE Corporation.
Newest
- mik crypt::scryptkdfCrypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available4.8 Medium
- rrwo crypt::saltedhashCrypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts9.1 Critical
- guimard apache::session::generate::sha256, apache\ +1 moreApache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids6.5 Medium
- bigfoot amazon::credentialsAmazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys5.3 Medium
- aspeer webdyne::sessionWebDyne::Session versions before 3.003_704 for Perl generate the session id insecurely6.5 Medium
- rsavage crypt::passwdmd5Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts7.5 High
- inducer relateRELATE: Predictable Token Generation in auth.py and exam.py8.7 High
- openmage magento-ltsMagento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs9.3 Critical
- bigpresh dancer::session::abstract, perldancer dancer\ +1 moreDancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurely5.9 Medium
- spring boot, vmware spring boot, red hat hawtio hawtio 4.4.0 +14 more +16 moreSpring Boot's random value property source uses a weak PRNG unsuitable for secrets4.8 Medium
- smartertools smartermailSmarterTools SmarterMail < Build 9610 Cryptographic Weakness via Weak RNG8.2 High
- dcit cryptxCryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking7.5 High
- jdeguest apache::api::password, apache\ +1 moreApache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts7.5 High
- mcrawfor solstice::session, solstice\ +1 moreSolstice::Session versions through 1440 for Perl generates session ids insecurely9.1 Critical
- berov ado::sessions, ado\ +1 moreAdo::Sessions versions through 0.935 for Perl generates insecure session ids5.3 Medium
- tokuhirom amon2::plugin::web::csrfdefender, amon2\ +1 moreAmon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id5.3 Medium
- arm mbed tls, trustedfirmware tf-psa-crypto +1 moreAn issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1...6.7 Medium
- jahlives openssl encryptopenssl_encrypt before 1.4.0 Weak PRNG Steganography Pixel Selection8.7 High
- cloudreveCloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding)8.1 High
- jjnapiork pagi::middleware::session::store::cookie, pagi\ +1 morePAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely7.5 High
- mock business::onlinepayment::storedtransaction, business\ +1 moreBusiness::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret key9.1 Critical
- ktat http::session, http\ +1 moreHTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids9.8 Critical
- tokuhirom amon2Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions9.8 Critical
- kjur jsrsasign, red hat migration toolkit for virtualization 2.1, migration toolkit for virtualization 2.9 +5 more +7 morejsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation9.3 Critical
- dougdude net::nsca::client, net\ +1 moreNet::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator9.1 Critical
- chorny apache::session::generate::md5, apache\ +1 moreApache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id9.1 Critical
- kazeburo plack::middleware::session::simple, plack\ +1 morePlack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely9.8 Critical
- tokuhirom http::session2, http\ +1 moreHTTP::Session2 versions before 1.12 for Perl may generate weak session ids using the rand() function6.5 Medium
- grichter apache::sessionx, apache\ +1 moreApache::SessionX versions through 2.01 for Perl create insecure session id8.2 High
- wonko smolderSmolder versions through 1.51 for Perl uses insecure rand() function for cryptographic functions9.1 Critical
- bva concierge::sessions, concierge\ +1 moreConcierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids9.8 Critical
- teejay maypoleMaypole versions from 2.10 through 2.13 for Perl generates session ids insecurely9.8 Critical
- dbook www::oauth, www\ +1 moreWWW::OAuth 1.000 and earlier for Perl uses insecure rand() function for cryptographic functions7.3 High
- gofiber fiberFiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure9.2 Critical
- coturnCoturn has unsafe nonce and relay port randomization due to weak random number generation.7.7 High
- freshrssFreshRSS has weak cryptographic randomness in remember-me token and nonce generation2.9 Low
- johnson controls iq panels2, 2+, iqhub, iqpanel 4, powergJohnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG use of Cryptographically Weak Pseudo-Random Number Generator7.2 High
- wbce cmsWBCE CMS has Weak Random Number Generator in Password Generation Function9.1 Critical
- gofiber utilsFiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values9.3 Critical
- apache druidApache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.9.8 Critical
- jumo varitron300, varitron500, varitron500 touch +2 moreJumo: Insufficient entropy in PRNG may lead to root access7.4 High
- qwer crypt::randomencryption, crypt\ +1 moreCrypt::RandomEncryption for Perl uses insecure rand() function during encryption9.1 Critical
- bluefeet starchStarch versions 0.14 and earlier generate session ids insecurely9.1 Critical
- kgoldov apache::authanyApache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely7.5 High
- ether catalyst::authentication::credential::httpCatalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces8.6 High
- davidosipov vision-uiVision UI's security-kit Contains Cryptographic Weakness9.3 Critical
- wolfsslIn the OpenSSL compatibility layer implementation, the function RAND_poll() was not behaving as...7.0 High
- haarg catalyst::plugin::sessionCatalyst::Plugin::Session before version 0.44 for Perl generates session ids insecurely6.5 Medium
- salva authen::digestmd5Authen::DigestMD5 versions 0.01 through 0.04 for Perl generate the cnonce insecurely6.5 Medium
- ehuels authen::sasl::perl::digest md5Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely6.5 Medium
- Show moreLoading…