CWE-330 · Use of Insufficiently Random Values (page 2)
Page 2 of 5 — CVEs classified under CWE-330, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-5868 | Medium | 6.5 | 2024-06-15 | The WooCommerce - Social Login plugin for WordPress is vulnerable to Email Verification in all versions up to, and including, 2.6.2 via the use of insufficient… |
CVE-2024-35292 | High | 8.2 | 2024-06-11 | A vulnerability has been identified in SIMATIC S7-200 SMART CPU CR40 (6ES7288-1CR40-0AA0) (All versions), SIMATIC S7-200 SMART CPU CR60 (6ES7288-1CR60-0AA0) (A… |
CVE-2024-5149 | Medium | 6.5 | 2024-06-05 | The BuddyForms plugin for WordPress is vulnerable to Email Verification Bypass in all versions up to, and including, 2.8.9 via the use of an insufficiently ran… |
CVE-2024-36389 | Critical | 9.8 | 2024-06-02 | MileSight DeviceHub - CWE-330 Use of Insufficiently Random Values may allow Authentication Bypass |
CVE-2024-4185 | High | 8.1 | 2024-04-30 | The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Email Verification and Authentication Bypass in all versions up to, and i… |
CVE-2023-6799 | Medium | 5.9 | 2024-04-09 | The WP Reset – Most Advanced WordPress Reset Tool plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2… |
CVE-2024-28013 | Medium | 5.3 | 2024-03-28 | Use of Insufficiently Random Values vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP… |
CVE-2024-1631 | Critical | 9.1 | 2024-02-21 | Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, w… |
CVE-2024-21495 | Medium | 6.5 | 2024-02-17 | Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure random number generatio… |
CVE-2024-0761 | High | 8.1 | 2024-02-05 | The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to insufficient randomnes… |
CVE-2024-23688 | Medium | 5.3 | 2024-01-19 | Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally be unique for every message. The node's p… |
CVE-2023-46740 | Medium | 6.5 | 2024-01-03 | CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to generate user-specific, s… |
CVE-2023-32831 | Medium | 5.5 | 2024-01-02 | In wlan driver, there is a possible PIN crack due to use of insufficiently random values. This could lead to local information disclosure with no execution pri… |
CVE-2023-4462 | Low | 3.7 | 2023-12-29 | A vulnerability classified as problematic has been found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 500, CCX 505, CCX 600, CCX 70… |
CVE-2023-6376 | Medium | 5.3 | 2023-11-30 | Henschen & Associates court document management software does not sufficiently randomize file names of cached documents, allowing a remote, unauthenticated att… |
CVE-2023-48056 | High | 7.5 | 2023-11-16 | PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of infor… |
CVE-2020-27636 | Critical | 9.1 | 2023-10-10 | In Microchip MPLAB Net 3.6.1, TCP ISNs are improperly random. |
CVE-2020-27635 | Critical | 9.1 | 2023-10-10 | In PicoTCP 1.7.0, TCP ISNs are improperly random. |
CVE-2020-27634 | Critical | 9.1 | 2023-10-10 | In Contiki 4.5, TCP ISNs are improperly random. |
CVE-2020-27633 | Critical | 9.1 | 2023-10-10 | In FNET 4.6.3, TCP ISNs are improperly random. |
CVE-2020-27631 | Critical | 9.8 | 2023-10-10 | In Oryx CycloneTCP 1.9.6, TCP ISNs are improperly random. |
CVE-2020-27630 | Critical | 9.8 | 2023-10-10 | In Silicon Labs uC/TCP-IP 3.6.0, TCP ISNs are improperly random. |
CVE-2020-27213 | High | 7.5 | 2023-10-10 | An issue was discovered in Ethernut Nut/OS 5.1. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficien… |
CVE-2023-29332 | High | 7.5 | 2023-09-12 | Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability |
CVE-2023-41879 | High | 7.5 | 2023-09-11 | Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "pr… |
CVE-2023-34353 | High | 7.5 | 2023-09-05 | An authentication bypass vulnerability exists in the OAS Engine authentication functionality of Open Automation Software OAS Platform v18.00.0072. A specially… |
CVE-2023-39979 | Critical | 9.8 | 2023-09-02 | There is a vulnerability in MXsecurity versions prior to 1.0.1 that can be exploited to bypass authentication. A remote attacker might access the system if the… |
CVE-2023-4344 | Critical | 9.8 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection |
CVE-2023-24478 | Medium | 5.5 | 2023-08-15 | Use of insufficiently random values for some Intel Agilex(R) software included as part of Intel(R) Quartus(R) Prime Pro Edition for linux before version 22.4 m… |
CVE-2023-3373 | Medium | 5.9 | 2023-08-04 | Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior and GOT SI… |
CVE-2023-26451 | High | 7.5 | 2023-08-02 | Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predi… |
CVE-2023-3247 | Low | 2.6 | 2023-07-22 | In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked… |
CVE-2023-3803 | Low | 2.6 | 2023-07-21 | A vulnerability classified as problematic has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This affects an unknown part of the… |
CVE-2023-20185 | High | 7.4 | 2023-07-12 | A vulnerability in the Cisco ACI Multi-Site CloudSec encryption feature of Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an unauthenticated… |
CVE-2023-1898 | Critical | 9.4 | 2023-06-12 | Atlas Copco Power Focus 6000 web server uses a small amount of session ID numbers. An attacker could enter a session ID number to retrieve data for an active u… |
CVE-2020-36732 | Medium | 5.3 | 2023-06-12 | The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictab… |
CVE-2022-43485 | Medium | 6.2 | 2023-05-30 | Use of Insufficiently Random Values in Honeywell OneWireless. This vulnerability may allow attacker to manipulate claims in client's JWT token. This issue aff… |
CVE-2023-31147 | Medium | 5.9 | 2023-05-25 | c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS que… |
CVE-2023-31124 | Low | 3.7 | 2023-05-25 | c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when c… |
CVE-2023-2884 | Critical | 9.8 | 2023-05-25 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Use of Insufficiently Random Values vulnerability in CBOT Chatbot allows Signature Spoofin… |
CVE-2023-1385 | High | 7.1 | 2023-05-03 | Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authent… |
CVE-2023-2418 | Low | 3.1 | 2023-04-29 | A vulnerability was found in Konga 2.8.3 on Kong. It has been classified as problematic. This affects an unknown part of the component Login API. The manipulat… |
CVE-2023-30797 | High | 7.5 | 2023-04-19 | Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacke… |
CVE-2023-26855 | High | 7.5 | 2023-04-04 | The hashing algorithm of ChurchCRM v4.5.3 utilizes a non-random salt value which allows attackers to use precomputed hash tables or dictionary attacks to crack… |
CVE-2023-0343 | Medium | 6.5 | 2023-03-31 | Akuvox E11 contains a function that encrypts messages which are then forwarded. The IV vector and the key are static, and this may allow an attacker to decrypt… |
CVE-2022-43636 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of TP-Link TL-WR940N 6_211111 3.20.1(US) routers. Authe… |
CVE-2022-26080 | Medium | 6.3 | 2023-03-16 | Use of Insufficiently Random Values vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant.This issue affects Pulsar Plus Syst… |
CVE-2022-39216 | High | 7.4 | 2023-03-14 | Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, the reset password token is generated without an… |
CVE-2023-20016 | Medium | 6.3 | 2023-02-23 | A vulnerability in the backup configuration feature of Cisco UCS Manager Software and in the configuration export feature of Cisco FXOS Software could allow an… |
CVE-2022-43501 | Critical | 9.1 | 2023-02-10 | KASAGO TCP/IP stack provided by Zuken Elmic generates ISNs(Initial Sequence Number) for TCP connections from an insufficiently random source. An attacker may b… |
CVE-2023-22746 | High | 8.6 | 2023-02-03 | CKAN is an open-source DMS (data management system) for powering data hubs and data portals. When creating a new container based on one of the Docker images li… |
CVE-2023-22912 | Medium | 5.3 | 2023-01-20 | An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. CheckUser TokenManager insecurely uses AES-C… |
CVE-2023-22601 | Critical | 10.0 | 2023-01-12 | InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-330: Us… |
CVE-2017-5242 | High | 7.7 | 2023-01-12 | Nexpose and InsightVM virtual appliances downloaded between April 5th, 2017 and May 3rd, 2017 contain identical SSH host keys. Normally, a unique SSH host key… |
CVE-2021-26407 | Medium | 5.5 | 2023-01-11 | A randomly generated Initialization Vector (IV) may lead to a collision of IVs with the same key potentially resulting in information disclosure. |
CVE-2019-25089 | Low | 3.1 | 2022-12-27 | A vulnerability has been found in Morgawr Muon 0.1.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file src/… |
CVE-2021-4277 | Low | 2.6 | 2022-12-25 | A vulnerability, which was classified as problematic, has been found in fredsmith utils. This issue affects some unknown processing of the file screenshot_sync… |
CVE-2021-4248 | Medium | 5.6 | 2022-12-18 | A vulnerability was found in kapetan dns up to 6.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file DNS/Pr… |
CVE-2022-46353 | Critical | 9.8 | 2022-12-13 | A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HS… |
CVE-2022-44938 | Critical | 9.8 | 2022-12-08 | Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack. |
CVE-2021-4241 | Low | 2.6 | 2022-11-15 | A vulnerability, which was classified as problematic, was found in phpservermon. Affected is the function setUserLoggedIn of the file src/psm/Service/User.php… |
CVE-2021-4240 | Low | 2.6 | 2022-11-15 | A vulnerability, which was classified as problematic, was found in phpservermon. This affects the function generatePasswordResetToken of the file src/psm/Servi… |
CVE-2022-3959 | Low | 3.1 | 2022-11-11 | A vulnerability, which was classified as problematic, has been found in drogon up to 1.8.1. Affected by this issue is some unknown functionality of the compone… |
CVE-2022-36022 | Medium | 5.3 | 2022-11-10 | Deeplearning4J is a suite of tools for deploying and training deep learning models using the JVM. Packages org.deeplearning4j:dl4j-examples and org.deeplearnin… |
CVE-2022-42787 | High | 8.8 | 2022-11-10 | Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker ca… |
CVE-2022-44795 | Medium | 6.5 | 2022-11-07 | An issue was discovered in Object First Ootbi BETA build 1.0.7.712. A flaw was found in the Web Service, which could lead to local information disclosure. The… |
CVE-2022-31008 | Medium | 5.5 | 2022-10-06 | RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (li… |
CVE-2022-30935 | Critical | 9.1 | 2022-09-28 | An authorization bypass in b2evolution allows remote, unauthenticated attackers to predict password reset tokens for any user through the use of a bad randomne… |
CVE-2022-38970 | Medium | 6.5 | 2022-09-26 | ieGeek IG20 hipcam RealServer V1.0 is vulnerable to Incorrect Access Control. The algorithm used to generate device IDs (UIDs) for devices that utilize Shenzhe… |
CVE-2022-36536 | Critical | 9.8 | 2022-09-16 | An issue in the component post_applogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privil… |
CVE-2022-40299 | High | 7.8 | 2022-09-09 | In Singular before 4.3.1, a predictable /tmp pathname is used (e.g., by sdb.cc), which allows local users to gain the privileges of other users via a procedure… |
CVE-2022-1615 | Medium | 5.5 | 2022-09-01 | In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values. |
CVE-2022-36045 | Critical | 9.0 | 2022-08-31 | NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes web sockets for instant interactions and… |
CVE-2022-37400 | High | 8.8 | 2022-08-15 | Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single… |
CVE-2022-30629 | Low | 3.1 | 2022-08-10 | Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to corr… |
CVE-2022-29808 | High | 7.5 | 2022-08-02 | In Quest KACE Systems Management Appliance (SMA) through 12.0, predictable token generation occurs when appliance linking is enabled. |
CVE-2022-24406 | Medium | 6.5 | 2022-07-27 | OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter… |
CVE-2022-26306 | High | 7.5 | 2022-07-25 | LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master… |
CVE-2021-23451 | Medium | 6.5 | 2022-07-25 | The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-f… |
CVE-2022-31157 | High | 7.5 | 2022-07-15 | LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the function used to generate random non… |
CVE-2022-33707 | Medium | 5.3 | 2022-07-12 | Improper identifier creation logic in Find My Mobile prior to version 7.2.24.12 allows attacker to identify the device. |
CVE-2022-26647 | High | 8.8 | 2022-07-12 | A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT PRO (Al… |
CVE-2020-35163 | Medium | 5.3 | 2022-07-11 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain a Use of Insufficiently Random Value… |
CVE-2022-25047 | Medium | 5.9 | 2022-07-07 | The password reset token in CWP v0.9.8.1126 is generated using known or predictable values. |
CVE-2022-32284 | High | 7.5 | 2022-07-04 | Use of insufficiently random values vulnerability exists in Vnet/IP communication module VI461 of YOKOGAWA Wide Area Communication Router (WAC Router) AW810D… |
CVE-2022-31034 | High | 8.3 | 2022-06-27 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v0.11.0 are vulnerable to a variety of attacks… |
CVE-2022-29330 | Medium | 4.9 | 2022-06-24 | Missing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows attackers to access the PJSIP and SIP extension credentials, cryptographic… |
CVE-2022-34295 | Medium | 6.5 | 2022-06-23 | totd before 1.5.3 does not properly randomize mesg IDs. |
CVE-2022-23138 | High | 7.5 | 2022-06-09 | ZTE's MF297D product has cryptographic issues vulnerability. Due to the use of weak random values, the security of the device is reduced, and it may face the r… |
CVE-2022-32296 | Low | 3.3 | 2022-06-05 | The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occurs because of use of Algorithm 4 ("Doub… |
CVE-2022-30782 | High | 7.5 | 2022-05-16 | Openmoney API through 2020-06-29 uses the JavaScript Math.random function, which does not provide cryptographically secure random numbers. |
CVE-2022-29930 | High | 8.7 | 2022-05-12 | SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. The issue was fixed in Ktor version 2.0.1. |
CVE-2022-30295 | Medium | 6.5 | 2022-05-06 | uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may lead to DNS cache poisoning. This is related to a reset of a… |
CVE-2022-26071 | High | 7.4 | 2022-05-05 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all… |
CVE-2021-41994 | Medium | 6.6 | 2022-04-30 | A misconfiguration of RSA in PingID iOS app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID… |
CVE-2021-41993 | Medium | 6.6 | 2022-04-30 | A misconfiguration of RSA in PingID Android app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using Pin… |
CVE-2021-40422 | Critical | 10.0 | 2022-04-14 | An authentication bypass vulnerability exists in the device password generation functionality of Swift Sensors Gateway SG3-1010. A specially-crafted network re… |
CVE-2022-25752 | Critical | 9.8 | 2022-04-12 | A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC (24V, coa… |
CVE-2022-27577 | Critical | 9.1 | 2022-04-11 | The vulnerability in the MSC800 in all versions before 4.15 allows for an attacker to predict the TCP initial sequence number. When the TCP sequence is predict… |
CVE-2022-29035 | Low | 3.3 | 2022-04-11 | In JetBrains Ktor Native before version 2.0.0 random values used for nonce generation weren't using SecureRandom implementations |