CWE-330 · Use of Insufficiently Random Values (page 2)
Page 2 of 4 — CVEs classified under CWE-330, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-29332 | High | 7.5 | 2023-09-12 | Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability |
CVE-2023-41879 | High | 7.5 | 2023-09-11 | Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "pr… |
CVE-2023-34353 | High | 7.5 | 2023-09-05 | An authentication bypass vulnerability exists in the OAS Engine authentication functionality of Open Automation Software OAS Platform v18.00.0072. A specially… |
CVE-2023-39979 | Critical | 9.8 | 2023-09-02 | There is a vulnerability in MXsecurity versions prior to 1.0.1 that can be exploited to bypass authentication. A remote attacker might access the system if the… |
CVE-2023-4344 | Critical | 9.8 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection |
CVE-2023-24478 | Medium | 5.5 | 2023-08-15 | Use of insufficiently random values for some Intel Agilex(R) software included as part of Intel(R) Quartus(R) Prime Pro Edition for linux before version 22.4 m… |
CVE-2023-3373 | Medium | 5.9 | 2023-08-04 | Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior and GOT SI… |
CVE-2023-26451 | High | 7.5 | 2023-08-02 | Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predi… |
CVE-2023-3247 | Low | 2.6 | 2023-07-22 | In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked… |
CVE-2023-3803 | Low | 2.6 | 2023-07-21 | A vulnerability classified as problematic has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This affects an unknown part of the… |
CVE-2023-20185 | High | 7.4 | 2023-07-12 | A vulnerability in the Cisco ACI Multi-Site CloudSec encryption feature of Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an unauthenticated… |
CVE-2023-1898 | Critical | 9.4 | 2023-06-12 | Atlas Copco Power Focus 6000 web server uses a small amount of session ID numbers. An attacker could enter a session ID number to retrieve data for an active u… |
CVE-2020-36732 | Medium | 5.3 | 2023-06-12 | The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictab… |
CVE-2022-43485 | Medium | 6.2 | 2023-05-30 | Use of Insufficiently Random Values in Honeywell OneWireless. This vulnerability may allow attacker to manipulate claims in client's JWT token. This issue aff… |
CVE-2023-31147 | Medium | 5.9 | 2023-05-25 | c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS que… |
CVE-2023-31124 | Low | 3.7 | 2023-05-25 | c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when c… |
CVE-2023-2884 | Critical | 9.8 | 2023-05-25 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Use of Insufficiently Random Values vulnerability in CBOT Chatbot allows Signature Spoofin… |
CVE-2023-1385 | High | 7.1 | 2023-05-03 | Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authent… |
CVE-2023-2418 | Low | 3.1 | 2023-04-29 | A vulnerability was found in Konga 2.8.3 on Kong. It has been classified as problematic. This affects an unknown part of the component Login API. The manipulat… |
CVE-2023-30797 | High | 7.5 | 2023-04-19 | Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacke… |
CVE-2023-26855 | High | 7.5 | 2023-04-04 | The hashing algorithm of ChurchCRM v4.5.3 utilizes a non-random salt value which allows attackers to use precomputed hash tables or dictionary attacks to crack… |
CVE-2023-0343 | Medium | 6.5 | 2023-03-31 | Akuvox E11 contains a function that encrypts messages which are then forwarded. The IV vector and the key are static, and this may allow an attacker to decrypt… |
CVE-2022-43636 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of TP-Link TL-WR940N 6_211111 3.20.1(US) routers. Authe… |
CVE-2022-26080 | Medium | 6.3 | 2023-03-16 | Use of Insufficiently Random Values vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant.This issue affects Pulsar Plus Syst… |
CVE-2022-39216 | High | 7.4 | 2023-03-14 | Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, the reset password token is generated without an… |
CVE-2023-20016 | Medium | 6.3 | 2023-02-23 | A vulnerability in the backup configuration feature of Cisco UCS Manager Software and in the configuration export feature of Cisco FXOS Software could allow an… |
CVE-2022-43501 | Critical | 9.1 | 2023-02-10 | KASAGO TCP/IP stack provided by Zuken Elmic generates ISNs(Initial Sequence Number) for TCP connections from an insufficiently random source. An attacker may b… |
CVE-2023-22746 | High | 8.6 | 2023-02-03 | CKAN is an open-source DMS (data management system) for powering data hubs and data portals. When creating a new container based on one of the Docker images li… |
CVE-2023-22912 | Medium | 5.3 | 2023-01-20 | An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. CheckUser TokenManager insecurely uses AES-C… |
CVE-2023-22601 | Critical | 10.0 | 2023-01-12 | InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-330: Us… |
CVE-2017-5242 | High | 7.7 | 2023-01-12 | Nexpose and InsightVM virtual appliances downloaded between April 5th, 2017 and May 3rd, 2017 contain identical SSH host keys. Normally, a unique SSH host key… |
CVE-2021-26407 | Medium | 5.5 | 2023-01-11 | A randomly generated Initialization Vector (IV) may lead to a collision of IVs with the same key potentially resulting in information disclosure. |
CVE-2019-25089 | Low | 3.1 | 2022-12-27 | A vulnerability has been found in Morgawr Muon 0.1.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file src/… |
CVE-2021-4277 | Low | 2.6 | 2022-12-25 | A vulnerability, which was classified as problematic, has been found in fredsmith utils. This issue affects some unknown processing of the file screenshot_sync… |
CVE-2021-4248 | Medium | 5.6 | 2022-12-18 | A vulnerability was found in kapetan dns up to 6.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file DNS/Pr… |
CVE-2022-46353 | Critical | 9.8 | 2022-12-13 | A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HS… |
CVE-2022-44938 | Critical | 9.8 | 2022-12-08 | Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack. |
CVE-2021-4241 | Low | 2.6 | 2022-11-15 | A vulnerability, which was classified as problematic, was found in phpservermon. Affected is the function setUserLoggedIn of the file src/psm/Service/User.php… |
CVE-2021-4240 | Low | 2.6 | 2022-11-15 | A vulnerability, which was classified as problematic, was found in phpservermon. This affects the function generatePasswordResetToken of the file src/psm/Servi… |
CVE-2022-3959 | Low | 3.1 | 2022-11-11 | A vulnerability, which was classified as problematic, has been found in drogon up to 1.8.1. Affected by this issue is some unknown functionality of the compone… |
CVE-2022-36022 | Medium | 5.3 | 2022-11-10 | Deeplearning4J is a suite of tools for deploying and training deep learning models using the JVM. Packages org.deeplearning4j:dl4j-examples and org.deeplearnin… |
CVE-2022-42787 | High | 8.8 | 2022-11-10 | Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker ca… |
CVE-2022-44795 | Medium | 6.5 | 2022-11-07 | An issue was discovered in Object First Ootbi BETA build 1.0.7.712. A flaw was found in the Web Service, which could lead to local information disclosure. The… |
CVE-2022-31008 | Medium | 5.5 | 2022-10-06 | RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (li… |
CVE-2022-30935 | Critical | 9.1 | 2022-09-28 | An authorization bypass in b2evolution allows remote, unauthenticated attackers to predict password reset tokens for any user through the use of a bad randomne… |
CVE-2022-38970 | Medium | 6.5 | 2022-09-26 | ieGeek IG20 hipcam RealServer V1.0 is vulnerable to Incorrect Access Control. The algorithm used to generate device IDs (UIDs) for devices that utilize Shenzhe… |
CVE-2022-36536 | Critical | 9.8 | 2022-09-16 | An issue in the component post_applogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privil… |
CVE-2022-40299 | High | 7.8 | 2022-09-09 | In Singular before 4.3.1, a predictable /tmp pathname is used (e.g., by sdb.cc), which allows local users to gain the privileges of other users via a procedure… |
CVE-2022-1615 | Medium | 5.5 | 2022-09-01 | In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values. |
CVE-2022-36045 | Critical | 9.0 | 2022-08-31 | NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes web sockets for instant interactions and… |
CVE-2022-37400 | High | 8.8 | 2022-08-15 | Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single… |
CVE-2022-30629 | Low | 3.1 | 2022-08-10 | Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to corr… |
CVE-2022-29808 | High | 7.5 | 2022-08-02 | In Quest KACE Systems Management Appliance (SMA) through 12.0, predictable token generation occurs when appliance linking is enabled. |
CVE-2022-24406 | Medium | 6.5 | 2022-07-27 | OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter… |
CVE-2022-26306 | High | 7.5 | 2022-07-25 | LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master… |
CVE-2021-23451 | Medium | 6.5 | 2022-07-25 | The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-f… |
CVE-2022-31157 | High | 7.5 | 2022-07-15 | LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the function used to generate random non… |
CVE-2022-33707 | Medium | 5.3 | 2022-07-12 | Improper identifier creation logic in Find My Mobile prior to version 7.2.24.12 allows attacker to identify the device. |
CVE-2022-26647 | High | 8.8 | 2022-07-12 | A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT PRO (Al… |
CVE-2020-35163 | Medium | 5.3 | 2022-07-11 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain a Use of Insufficiently Random Value… |
CVE-2022-25047 | Medium | 5.9 | 2022-07-07 | The password reset token in CWP v0.9.8.1126 is generated using known or predictable values. |
CVE-2022-32284 | High | 7.5 | 2022-07-04 | Use of insufficiently random values vulnerability exists in Vnet/IP communication module VI461 of YOKOGAWA Wide Area Communication Router (WAC Router) AW810D… |
CVE-2022-31034 | High | 8.3 | 2022-06-27 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v0.11.0 are vulnerable to a variety of attacks… |
CVE-2022-29330 | Medium | 4.9 | 2022-06-24 | Missing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows attackers to access the PJSIP and SIP extension credentials, cryptographic… |
CVE-2022-34295 | Medium | 6.5 | 2022-06-23 | totd before 1.5.3 does not properly randomize mesg IDs. |
CVE-2022-23138 | High | 7.5 | 2022-06-09 | ZTE's MF297D product has cryptographic issues vulnerability. Due to the use of weak random values, the security of the device is reduced, and it may face the r… |
CVE-2022-32296 | Low | 3.3 | 2022-06-05 | The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occurs because of use of Algorithm 4 ("Doub… |
CVE-2022-30782 | High | 7.5 | 2022-05-16 | Openmoney API through 2020-06-29 uses the JavaScript Math.random function, which does not provide cryptographically secure random numbers. |
CVE-2022-29930 | High | 8.7 | 2022-05-12 | SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. The issue was fixed in Ktor version 2.0.1. |
CVE-2022-30295 | Medium | 6.5 | 2022-05-06 | uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may lead to DNS cache poisoning. This is related to a reset of a… |
CVE-2022-26071 | High | 7.4 | 2022-05-05 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all… |
CVE-2021-41994 | Medium | 6.6 | 2022-04-30 | A misconfiguration of RSA in PingID iOS app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID… |
CVE-2021-41993 | Medium | 6.6 | 2022-04-30 | A misconfiguration of RSA in PingID Android app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using Pin… |
CVE-2021-40422 | Critical | 10.0 | 2022-04-14 | An authentication bypass vulnerability exists in the device password generation functionality of Swift Sensors Gateway SG3-1010. A specially-crafted network re… |
CVE-2022-25752 | Critical | 9.8 | 2022-04-12 | A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC (24V, coa… |
CVE-2022-27577 | Critical | 9.1 | 2022-04-11 | The vulnerability in the MSC800 in all versions before 4.15 allows for an attacker to predict the TCP initial sequence number. When the TCP sequence is predict… |
CVE-2022-29035 | Low | 3.3 | 2022-04-11 | In JetBrains Ktor Native before version 2.0.0 random values used for nonce generation weren't using SecureRandom implementations |
CVE-2022-26851 | Critical | 9.1 | 2022-04-08 | Dell PowerScale OneFS, 8.2.2-9.3.x, contains a predictable file name from observable state vulnerability. An unprivileged network attacker could potentially ex… |
CVE-2022-22517 | High | 7.5 | 2022-04-07 | An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets… |
CVE-2022-28355 | High | 7.5 | 2022-04-02 | randomUUID in Scala.js before 1.10.0 generates predictable values. |
CVE-2021-46010 | High | 8.8 | 2022-03-30 | Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration. The SESSION_ID is predictable. An attacker can hijack a… |
CVE-2022-26320 | Critical | 9.1 | 2022-03-14 | The Rambus SafeZone Basic Crypto Module before 10.4.0, as used in certain Fujifilm (formerly Fuji Xerox) devices before 2022-03-01, Canon imagePROGRAF and imag… |
CVE-2022-26317 | Medium | 6.5 | 2022-03-08 | A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.29). When returning the result of a completed Microflow executi… |
CVE-2022-22700 | Medium | 5.3 | 2022-03-03 | CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource, exposes the response header 'X-CFY-TX-TM'. In certain configurations… |
CVE-2021-36166 | Critical | 9.8 | 2022-03-01 | An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative account's authentication… |
CVE-2021-20322 | High | 7.4 | 2022-02-18 | A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to q… |
CVE-2022-22922 | Critical | 9.8 | 2022-02-18 | TP-Link TL-WA850RE Wi-Fi Range Extender before v6_200923 was discovered to use highly predictable and easily detectable session keys, allowing attackers to gai… |
CVE-2021-26726 | High | 8.8 | 2022-02-16 | A remote code execution vulnerability affecting a Valmet DNA service listening on TCP port 1517, allows an attacker to execute commands with SYSTEM privileges… |
CVE-2021-36294 | Critical | 9.8 | 2022-01-25 | Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authentication bypass vulnerability. A remote unauthenticated attacker may exploit this vulne… |
CVE-2022-23408 | Critical | 9.1 | 2022-01-18 | wolfSSL 5.x before 5.1.1 uses non-random IV values in certain situations. This affects connections (without AEAD) using AES-CBC or DES3 with TLS 1.1 or 1.2 or… |
CVE-2021-45458 | High | 7.5 | 2022-01-06 | Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encrypti… |
CVE-2021-24998 | High | 7.5 | 2021-12-27 | The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is genera… |
CVE-2021-45488 | High | 7.5 | 2021-12-25 | In NetBSD through 9.2, there is an information leak in the TCP ISN (ISS) generation algorithm. |
CVE-2021-45487 | High | 7.5 | 2021-12-25 | In NetBSD through 9.2, the IPv4 ID generation algorithm does not use appropriate cryptographic measures. |
CVE-2021-44151 | High | 7.5 | 2021-12-13 | An issue was discovered in Reprise RLM 14.2. As the session cookies are small, an attacker can hijack any existing sessions by bruteforcing the 4 hex-character… |
CVE-2021-41694 | Critical | 9.8 | 2021-12-09 | An Incorrect Access Control vulnerability exists in Premiumdatingscript 4.2.7.7 via the password change procedure in requests\user.php. |
CVE-2021-38377 | Medium | 6.1 | 2021-11-22 | OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML tra… |
CVE-2021-22968 | High | 7.2 | 2021-11-19 | A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concrete5) versions 8.5.6 a… |
CVE-2021-26322 | High | 7.5 | 2021-11-16 | Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”. |
CVE-2021-28024 | Critical | 9.8 | 2021-11-08 | Unauthorized system access in the login form in ServiceTonic Helpdesk software version < 9.0.35937 allows attacker to login without using a password. |