CWE-330 · Use of Insufficiently Random Values (page 3)
Page 3 of 5 — CVEs classified under CWE-330, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-22517 | High | 7.5 | 2022-04-07 | An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets… |
CVE-2022-28355 | High | 7.5 | 2022-04-02 | randomUUID in Scala.js before 1.10.0 generates predictable values. |
CVE-2021-46010 | High | 8.8 | 2022-03-30 | Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration. The SESSION_ID is predictable. An attacker can hijack a… |
CVE-2022-26320 | Critical | 9.1 | 2022-03-14 | The Rambus SafeZone Basic Crypto Module before 10.4.0, as used in certain Fujifilm (formerly Fuji Xerox) devices before 2022-03-01, Canon imagePROGRAF and imag… |
CVE-2022-26317 | Medium | 6.5 | 2022-03-08 | A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.29). When returning the result of a completed Microflow executi… |
CVE-2022-22700 | Medium | 5.3 | 2022-03-03 | CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource, exposes the response header 'X-CFY-TX-TM'. In certain configurations… |
CVE-2021-36166 | Critical | 9.8 | 2022-03-01 | An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative account's authentication… |
CVE-2021-20322 | High | 7.4 | 2022-02-18 | A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to q… |
CVE-2022-22922 | Critical | 9.8 | 2022-02-18 | TP-Link TL-WA850RE Wi-Fi Range Extender before v6_200923 was discovered to use highly predictable and easily detectable session keys, allowing attackers to gai… |
CVE-2021-26726 | High | 8.8 | 2022-02-16 | A remote code execution vulnerability affecting a Valmet DNA service listening on TCP port 1517, allows an attacker to execute commands with SYSTEM privileges… |
CVE-2021-36294 | Critical | 9.8 | 2022-01-25 | Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authentication bypass vulnerability. A remote unauthenticated attacker may exploit this vulne… |
CVE-2022-23408 | Critical | 9.1 | 2022-01-18 | wolfSSL 5.x before 5.1.1 uses non-random IV values in certain situations. This affects connections (without AEAD) using AES-CBC or DES3 with TLS 1.1 or 1.2 or… |
CVE-2021-45458 | High | 7.5 | 2022-01-06 | Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encrypti… |
CVE-2021-24998 | High | 7.5 | 2021-12-27 | The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is genera… |
CVE-2021-45488 | High | 7.5 | 2021-12-25 | In NetBSD through 9.2, there is an information leak in the TCP ISN (ISS) generation algorithm. |
CVE-2021-45487 | High | 7.5 | 2021-12-25 | In NetBSD through 9.2, the IPv4 ID generation algorithm does not use appropriate cryptographic measures. |
CVE-2021-44151 | High | 7.5 | 2021-12-13 | An issue was discovered in Reprise RLM 14.2. As the session cookies are small, an attacker can hijack any existing sessions by bruteforcing the 4 hex-character… |
CVE-2021-41694 | Critical | 9.8 | 2021-12-09 | An Incorrect Access Control vulnerability exists in Premiumdatingscript 4.2.7.7 via the password change procedure in requests\user.php. |
CVE-2021-38377 | Medium | 6.1 | 2021-11-22 | OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML tra… |
CVE-2021-22968 | High | 7.2 | 2021-11-19 | A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concrete5) versions 8.5.6 a… |
CVE-2021-26322 | High | 7.5 | 2021-11-16 | Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”. |
CVE-2021-28024 | Critical | 9.8 | 2021-11-08 | Unauthorized system access in the login form in ServiceTonic Helpdesk software version < 9.0.35937 allows attacker to login without using a password. |
CVE-2021-22038 | High | 8.8 | 2021-10-29 | On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed (the originally called uninstaller exits, so it does not… |
CVE-2021-41829 | High | 7.5 | 2021-09-30 | Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number to calculate a certain encryption key. |
CVE-2021-41061 | Medium | 5.5 | 2021-09-15 | In RIOT-OS 2021.01, nonce reuse in 802.15.4 encryption in the ieee820154_security component allows attackers to break encryption by triggering reboots. |
CVE-2021-37186 | Medium | 5.4 | 2021-09-14 | A vulnerability has been identified in LOGO! CMR2020 (All versions < V2.2), LOGO! CMR2040 (All versions < V2.2), SIMATIC RTU3010C (All versions < V4.0.9), SIMA… |
CVE-2021-34646 | Critical | 9.8 | 2021-08-30 | Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verificatio… |
CVE-2020-35685 | Critical | 9.1 | 2021-08-19 | An issue was discovered in HCC Nichestack 3.0. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficient… |
CVE-2021-31228 | High | 7.5 | 2021-08-19 | An issue was discovered in HCC embedded InterNiche 4.0.1. This vulnerability allows the attacker to predict a DNS query's source port in order to send forged D… |
CVE-2021-0417 | Medium | 5.5 | 2021-08-18 | In memory management driver, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional e… |
CVE-2021-39249 | Medium | 6.1 | 2021-08-17 | Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows reflected XSS because the filenames of uploaded files become predictable through… |
CVE-2021-38606 | Critical | 9.8 | 2021-08-12 | reNgine through 0.5 relies on a predictable directory name. |
CVE-2021-3692 | Medium | 5.3 | 2021-08-10 | yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator |
CVE-2021-3689 | High | 7.5 | 2021-08-10 | yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator |
CVE-2021-25444 | Medium | 5.5 | 2021-08-05 | An IV reuse vulnerability in keymaster prior to SMR AUG-2021 Release 1 allows decryption of custom keyblob with privileged process. |
CVE-2021-26098 | Medium | 5.3 | 2021-08-04 | An instance of small space of random values in the RPC API of FortiSandbox before 4.0.0 may allow an attacker in possession of a few information pieces about t… |
CVE-2021-27499 | Medium | 5.9 | 2021-08-02 | Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior to 1.7.5,The applica… |
CVE-2021-28674 | Medium | 5.4 | 2021-07-30 | The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node (outside of the attacker's perimeter) v… |
CVE-2021-32791 | Medium | 5.9 | 2021-07-26 | mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating use… |
CVE-2021-29480 | Medium | 4.4 | 2021-06-29 | Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the client side session module uses the application startup time as the signing… |
CVE-2021-27200 | Critical | 9.8 | 2021-06-11 | In WoWonder 3.0.4, remote attackers can take over any account due to the weak cryptographic algorithm in recover.php. The code parameter is easily predicted fr… |
CVE-2021-0466 | High | 7.5 | 2021-06-11 | In startIpClient of ClientModeImpl.java, there is a possible identifier which could be used to track a device. This could lead to remote information disclosure… |
CVE-2021-23020 | Medium | 5.5 | 2021-06-01 | The NAAS 3.x before 3.10.0 API keys were generated using an insecure pseudo-random string and hashing algorithm which could lead to predictable keys. |
CVE-2020-10729 | Medium | 5.5 | 2021-05-27 | A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template… |
CVE-2021-29499 | High | 7.5 | 2021-05-07 | SIF is an open source implementation of the Singularity Container Image Format. The `siftool new` command and func siftool.New() produce predictable UUID ident… |
CVE-2021-26909 | Low | 3.7 | 2021-04-23 | Automox Agent prior to version 31 uses an insufficiently protected S3 bucket endpoint for storing sensitive files, which could be brute-forced by an attacker t… |
CVE-2021-27393 | Medium | 5.3 | 2021-04-22 | A vulnerability has been identified in Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2013.08), Nucleus Source Code (Versions including aff… |
CVE-2021-25677 | Medium | 5.3 | 2021-04-22 | A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE P… |
CVE-2021-28055 | Medium | 6.5 | 2021-04-15 | An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. The anti-CSRF token generation is predictable, which might allow CSRF attacks that add an… |
CVE-2021-21729 | Medium | 6.5 | 2021-04-13 | Some ZTE products have CSRF vulnerability. Because some pages lack CSRF random value verification, attackers could perform illegal authorization operations by… |
CVE-2021-25375 | Medium | 6.5 | 2021-04-09 | Using predictable index for attachments in Samsung Email prior to version 6.1.41.0 allows remote attackers to get attachments of another emails when users open… |
CVE-2021-3446 | Medium | 5.5 | 2021-03-25 | A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability related to the returned I… |
CVE-2021-28099 | Medium | 4.4 | 2021-03-23 | In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permission… |
CVE-2021-22309 | High | 7.5 | 2021-03-22 | There is insecure algorithm vulnerability in Huawei products. A module uses less random input in a secure mechanism. Attackers can exploit this vulnerability b… |
CVE-2021-0375 | Medium | 5.5 | 2021-03-10 | In onPackageModified of VoiceInteractionManagerService.java, there is a possible change of default applications due to an insecure default value. This could le… |
CVE-2021-21352 | Medium | 6.8 | 2021-03-03 | Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In TimeTracker before version 1.19.24.5415 tokens used in password re… |
CVE-2021-27884 | Medium | 5.1 | 2021-03-01 | Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in… |
CVE-2020-36252 | Medium | 6.8 | 2021-02-19 | ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim, to access any version of any file by sending a request for a p… |
CVE-2020-13860 | High | 7.5 | 2021-02-01 | An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. The one-time password algorithm for the undocumented system account mofidev generat… |
CVE-2020-27264 | High | 8.8 | 2021-01-19 | In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i and AnyDana-A mobile app… |
CVE-2020-35926 | Critical | 9.8 | 2020-12-31 | An issue was discovered in the nanorand crate before 0.5.1 for Rust. It caused any random number generator (even ChaCha) to return all zeroes because integer t… |
CVE-2020-17470 | Medium | 5.3 | 2020-12-11 | An issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface structure does not set sufficiently random transaction IDs (t… |
CVE-2020-15023 | Medium | 5.9 | 2020-12-11 | Askey AP5100W devices through AP5100W_Dual_SIG_1.01.097 are affected by WPS PIN offline brute-force cracking. This arises because of issues with the random num… |
CVE-2020-7548 | Critical | 9.8 | 2020-12-01 | A CWE-330 - Use of Insufficiently Random Values vulnerability exists in Smartlink, PowerTag, and Wiser Series Gateways (see security notification for version i… |
CVE-2020-26550 | High | 7.5 | 2020-11-17 | An issue was discovered in Aviatrix Controller before R5.3.1151. An encrypted file containing credentials to unrelated systems is protected by a three-characte… |
CVE-2020-27556 | Medium | 5.3 | 2020-11-17 | A predictable device ID in BASETech GE-131 BT-1837836 firmware 20180921 allows unauthenticated remote attackers to connect to the device. |
CVE-2020-25705 | High | 7.4 | 2020-11-17 | A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively by… |
CVE-2020-27180 | High | 7.5 | 2020-10-27 | konzept-ix publiXone before 2020.015 allows attackers to download files by iterating over the IXCopy fileID parameter. |
CVE-2020-27743 | Critical | 9.8 | 2020-10-26 | libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes(). This could lead to use of a non-random/predictable session… |
CVE-2020-1905 | Low | 3.3 | 2020-10-06 | Media ContentProvider URIs used for opening attachments in other apps were generated sequentially prior to WhatsApp for Android v2.20.185, which could have all… |
CVE-2020-26107 | High | 7.5 | 2020-09-25 | cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561). |
CVE-2020-0407 | Medium | 4.4 | 2020-09-17 | In various functions in fscrypt_ice.c and related files in some implementations of f2fs encryption that use encryption hardware which only supports 32-bit IVs… |
CVE-2020-13304 | Low | 3.8 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which resulted an a… |
CVE-2020-16271 | Critical | 9.1 | 2020-08-03 | The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 generates insufficiently random numbers, which allows remote attackers to read and modify data… |
CVE-2020-16166 | Low | 3.7 | 2020-07-30 | The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network… |
CVE-2020-10274 | High | 7.1 | 2020-06-24 | The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard… |
CVE-2020-4188 | Medium | 5.3 | 2020-06-23 | IBM Security Guardium 10.6 and 11.1 may use insufficiently random numbers or values in a security context that depends on unpredictable numbers. IBM X-Force ID… |
CVE-2020-14423 | Medium | 5.3 | 2020-06-18 | Convos before 4.20 does not properly generate a random secret in Core/Settings.pm and Util.pm. This leads to a predictable CONVOS_LOCAL_SECRET value, affecting… |
CVE-2020-14422 | Medium | 5.9 | 2020-06-18 | Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to… |
CVE-2020-11901 | Critical | 9.0 | 2020-06-17 | The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response. |
CVE-2020-12712 | High | 7.5 | 2020-06-11 | A vulnerability based on insecure user/password encryption in the JOE (job editor) component of SOS JobScheduler 1.12 and 1.13 allows attackers to decrypt the… |
CVE-2020-13817 | High | 7.4 | 2020-06-04 | ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting tra… |
CVE-2020-5365 | Medium | 5.3 | 2020-05-20 | Dell EMC Isilon versions 8.2.2 and earlier contain a remotesupport vulnerability. The pre-configured support account, remotesupport, is bundled in the Dell EMC… |
CVE-2020-11551 | High | 8.8 | 2020-05-18 | An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106, Outdoor Satellite (RBS50Y) V2.5.1.106, and Pro Tri-B… |
CVE-2020-12858 | High | 7.5 | 2020-05-18 | Non-reinitialisation of random data in the advertising payload in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker to re-identify Android devices running… |
CVE-2020-5408 | Medium | 6.5 | 2020-05-14 | Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null in… |
CVE-2020-9502 | Critical | 9.8 | 2020-05-13 | Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predic… |
CVE-2020-8792 | Medium | 5.3 | 2020-05-04 | The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has an information-exposure issue. In the mobile app, an attempt to add an… |
CVE-2020-12270 | Medium | 6.5 | 2020-04-27 | React Native Bluetooth Scan in Bluezone 1.0.0 uses six-character alphanumeric IDs, which might make it easier for remote attackers to interfere with COVID-19 c… |
CVE-2020-11877 | High | 7.5 | 2020-04-17 | airhost.exe in Zoom Client for Meetings 4.6.11 uses 3423423432325249 as the Initialization Vector (IV) for AES-256 CBC encryption. NOTE: the vendor states that… |
CVE-2020-1759 | Medium | 6.4 | 2020-04-13 | A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was discovered in the secure… |
CVE-2020-11585 | Medium | 4.3 | 2020-04-06 | There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A register… |
CVE-2020-11501 | High | 7.4 | 2020-04-03 | GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit… |
CVE-2020-10870 | Medium | 5.5 | 2020-03-23 | Zim through 0.72.1 creates temporary directories with predictable names. A malicious user could predict and create Zim's temporary directories and prevent othe… |
CVE-2019-20494 | Low | 3.3 | 2020-03-17 | In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525). |
CVE-2019-19135 | High | 7.4 | 2020-03-16 | In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.Opc.Ua before 1.4.35… |
CVE-2019-9102 | High | 8.8 | 2020-03-11 | An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices… |
CVE-2019-12434 | Medium | 4.3 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the contrast… |
CVE-2019-2317 | Critical | 9.8 | 2020-03-05 | The secret key used to make the Initial Sequence Number in the TCP SYN packet could be brute forced and therefore can be predicted in Snapdragon Auto, Snapdrag… |
CVE-2020-1731 | Critical | 9.1 | 2020-03-02 | A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random admin password when inst… |