CWE-341: Predictable from Observable State
A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.
A kind of CWE-340 Generation of Predictable Numbers or Identifiers.
From the CWE List. © The MITRE Corporation.
Newest
- gitroomhq postiz-app Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys 9.1 Critical
- aws security agent mcp server Missing S3 bucket ownership verification in the AWS Security Agent MCP server 5.1 Medium
- aws security agent plugin Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops 5.1 Medium
- No product listed Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey 3.7 Low
- red hat build of keycloak 26.6, build of keycloak 26.6.6, data grid 8 +2 more +4 more Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc client 7.3 High
- ntop ntopng ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session... 9.8 Critical
- No product listed Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication... 7.3 High
- chorny apache::session::generate::moduniqueid, apache\, red hat hardened images +2 more Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure 9.1 Critical
- geovision gv-lpc2011 firmware, gv-lpc2211 firmware, geovision inc. gv-lpc2011/lpc2211 +2 more GeoVision LPC2011/LPC2211 Web Interface guessable session cookie vulnerability 8.6 High
- jqlang jq, red hat ai inference server 3.2, ai inference server 3.3 +24 more +26 more jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed 7.5 High
- isc bind 9 Cache poisoning due to weak PRNG 8.6 High
- sap se netweaver as java (iiop service) Predictable Object Identifier vulnerability in SAP NetWeaver AS Java (IIOP Service) 4.3 Medium
- advantech wireless sensing and equipment (wise), wise-4010lan firmware, wise-4050lan firmware +1 more +3 more Weak Session Cookie Entropy 5.0 Medium
- jsbroks coco annotator jsbroks COCO Annotator Session predictable state 6.3 Medium
- hongdian h8951-4g-esp, h8951-4g-esp firmware +1 more Bruteforcing authentication cookie for a given user 7.5 High
- fredsmith utils fredsmith utils Filename screenshot_sync predictable state 2.6 Low
- dell emc isilon onefs, isilon onefs +1 more Dell EMC Isilon versions 8.2.2 and earlier contain a remotesupport vulnerability. The pre... 5.3 Medium
- keycloak, redhat keycloak operator +1 more Predictable password in Keycloak 9.1 Critical
- ics-cert moxa iks, eds, moxa eds-405a firmware, eds-408a firmware +2 more +4 more Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker... 9.8 Critical
- hangzhou xiongmai technology co., ltd xmeye p2p cloud server All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an... 5.3 Medium