CWE-340: Generation of Predictable Numbers or Identifiers
The product uses a scheme that generates numbers or identifiers that are more predictable than required.
A kind of CWE-330 Use of Insufficiently Random Values.
From the CWE List. © The MITRE Corporation.
Newest
- ivanti connect secure Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6... 4.3 Medium
- google cloud cloud run mcp Bucket Squatting in Cloud Run MCP leads to Service Account Takeover 7.7 High
- zephyrproject zephyr Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS 5.6 Medium
- intranda goobi-viewer-core Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset 6.8 Medium
- intranda goobi-viewer-core Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset 6.5 Medium
- botslab g980h Botslab G980H Dashcams Generation of Predictable Numbers or Identifiers 7.7 High
- concretecms-community-store community store Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token 8.7 High
- atutor Generation of Predictable Email Confirmation Token in ATutor 6.3 Medium
- vsdesk Weak File Name Generation in vsDesk 5.3 Medium
- jhumanj opnform OpnForm Editable Submission Secret Derivation via Empty Hashids Salt 9.3 Critical
-
libdancer2-perlDebian,perl-Dancer2Mageia +1 more Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable 8.2 High - cyrusimap cyrus imap An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can... 4.0 Medium
- markstos cgi::session::id::md5 CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources 5.9 Medium
- shenzhen i365-tech co. ltd. setracker2 parental control app (android) package com.tgelec.setracker Setracker2 Children's Smartwatch Ecosystem Generation of Predictable Numbers or Identifiers 8.3 High
- zohocorp manageengine adselfservice plus, manageengine adaudit plus, manageengine m365 manager plus +1 more +3 more Account Takeover via Predictable SSO Ticket Generation 9.0 Critical
- hayajo mojolicious::plugin::web::auth::oauth2 Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter 9.1 Critical
- hayajo mojolicious::sessions::storable Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely 5.3 Medium
- naxclow ix cam, smart doorbell x3, v720 +1 more +3 more Naxclow IoT Platform Generation of Predictable Numbers or Identifiers 6.9 Medium
- guimard apache::session::generate::sha256, apache\ +1 more Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids 6.5 Medium
- aspeer webdyne::session WebDyne::Session versions before 3.003_704 for Perl generate the session id insecurely 6.5 Medium
- chorny apache::session::generate::moduniqueid, apache\, red hat hardened images +2 more Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure 9.1 Critical
- bigpresh dancer::session::abstract, perldancer dancer\ +1 more Dancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurely 5.9 Medium
- freescout FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force 8.8 High
- mcrawfor solstice::session, solstice\ +1 more Solstice::Session versions through 1440 for Perl generates session ids insecurely 9.1 Critical
- berov ado::sessions, ado\ +1 more Ado::Sessions versions through 0.935 for Perl generates insecure session ids 5.3 Medium
- tokuhirom amon2::plugin::web::csrfdefender, amon2\ +1 more Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id 5.3 Medium
- erlang otp, erlang\/otp +1 more Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver 6.3 Medium
- ibm concert Multiple Vulnerabilities in IBM Concert Software 6.2 Medium
- ktat http::session, http\ +1 more HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids 9.8 Critical
- tokuhirom amon2 Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions 9.8 Critical
- amazon bedrock agentcore starter toolkit Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit 5.8 Medium
- chorny apache::session::generate::md5, apache\ +1 more Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id 9.1 Critical
- kazeburo plack::middleware::session::simple, plack\ +1 more Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely 9.8 Critical
- tokuhirom http::session2, http\ +1 more HTTP::Session2 versions before 1.12 for Perl may generate weak session ids using the rand() function 6.5 Medium
- grichter apache::sessionx, apache\ +1 more Apache::SessionX versions through 2.01 for Perl create insecure session id 8.2 High
- google cloud vertex ai experiments Bucket Squatting in Vertex AI Experiments leads to RCE and Model Theft. 7.7 High
- bva concierge::sessions, concierge\ +1 more Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids 9.8 Critical
- samrocketman jervis Jervis has Deterministic AES IV Derivation from Passphrase 8.7 High
- infiniflow ragflow RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability 8.9 High
- soplanning Predictable Generation of Password Recovery Token 8.7 High
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +19 more +21 more BIG-IP TMM vulnerability 6.3 Medium
- b&r industrial automation gmbh automation runtime Weak Session Token used in Automation Runtime SDM 2.3 Low
- yosmart yolink api The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a device's... 5.8 Medium
- bluefeet starch Starch versions 0.14 and earlier generate session ids insecurely 9.1 Critical
- kgoldov apache::authany Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely 7.5 High
- curl predictable WebSocket mask 5.3 Medium
- ether catalyst::authentication::credential::http Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces 8.6 High
- haarg catalyst::plugin::session Catalyst::Plugin::Session before version 0.44 for Perl generates session ids insecurely 6.5 Medium
- salva authen::digestmd5 Authen::DigestMD5 versions 0.01 through 0.04 for Perl generate the cnonce insecurely 6.5 Medium
- ehuels authen::sasl::perl::digest md5 Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely 6.5 Medium
- Show olderLoading…