CWE-330 · Use of Insufficiently Random Values (page 3)
Page 3 of 4 — CVEs classified under CWE-330, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-22038 | High | 8.8 | 2021-10-29 | On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed (the originally called uninstaller exits, so it does not… |
CVE-2021-41829 | High | 7.5 | 2021-09-30 | Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number to calculate a certain encryption key. |
CVE-2021-41061 | Medium | 5.5 | 2021-09-15 | In RIOT-OS 2021.01, nonce reuse in 802.15.4 encryption in the ieee820154_security component allows attackers to break encryption by triggering reboots. |
CVE-2021-37186 | Medium | 5.4 | 2021-09-14 | A vulnerability has been identified in LOGO! CMR2020 (All versions < V2.2), LOGO! CMR2040 (All versions < V2.2), SIMATIC RTU3010C (All versions < V4.0.9), SIMA… |
CVE-2021-34646 | Critical | 9.8 | 2021-08-30 | Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verificatio… |
CVE-2020-35685 | Critical | 9.1 | 2021-08-19 | An issue was discovered in HCC Nichestack 3.0. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficient… |
CVE-2021-31228 | High | 7.5 | 2021-08-19 | An issue was discovered in HCC embedded InterNiche 4.0.1. This vulnerability allows the attacker to predict a DNS query's source port in order to send forged D… |
CVE-2021-0417 | Medium | 5.5 | 2021-08-18 | In memory management driver, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional e… |
CVE-2021-39249 | Medium | 6.1 | 2021-08-17 | Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows reflected XSS because the filenames of uploaded files become predictable through… |
CVE-2021-38606 | Critical | 9.8 | 2021-08-12 | reNgine through 0.5 relies on a predictable directory name. |
CVE-2021-3692 | Medium | 5.3 | 2021-08-10 | yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator |
CVE-2021-3689 | High | 7.5 | 2021-08-10 | yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator |
CVE-2021-25444 | Medium | 5.5 | 2021-08-05 | An IV reuse vulnerability in keymaster prior to SMR AUG-2021 Release 1 allows decryption of custom keyblob with privileged process. |
CVE-2021-26098 | Medium | 5.3 | 2021-08-04 | An instance of small space of random values in the RPC API of FortiSandbox before 4.0.0 may allow an attacker in possession of a few information pieces about t… |
CVE-2021-27499 | Medium | 5.9 | 2021-08-02 | Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior to 1.7.5,The applica… |
CVE-2021-28674 | Medium | 5.4 | 2021-07-30 | The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node (outside of the attacker's perimeter) v… |
CVE-2021-32791 | Medium | 5.9 | 2021-07-26 | mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating use… |
CVE-2021-29480 | Medium | 4.4 | 2021-06-29 | Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the client side session module uses the application startup time as the signing… |
CVE-2021-27200 | Critical | 9.8 | 2021-06-11 | In WoWonder 3.0.4, remote attackers can take over any account due to the weak cryptographic algorithm in recover.php. The code parameter is easily predicted fr… |
CVE-2021-0466 | High | 7.5 | 2021-06-11 | In startIpClient of ClientModeImpl.java, there is a possible identifier which could be used to track a device. This could lead to remote information disclosure… |
CVE-2021-23020 | Medium | 5.5 | 2021-06-01 | The NAAS 3.x before 3.10.0 API keys were generated using an insecure pseudo-random string and hashing algorithm which could lead to predictable keys. |
CVE-2020-10729 | Medium | 5.5 | 2021-05-27 | A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template… |
CVE-2021-29499 | High | 7.5 | 2021-05-07 | SIF is an open source implementation of the Singularity Container Image Format. The `siftool new` command and func siftool.New() produce predictable UUID ident… |
CVE-2021-26909 | Low | 3.7 | 2021-04-23 | Automox Agent prior to version 31 uses an insufficiently protected S3 bucket endpoint for storing sensitive files, which could be brute-forced by an attacker t… |
CVE-2021-27393 | Medium | 5.3 | 2021-04-22 | A vulnerability has been identified in Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2013.08), Nucleus Source Code (Versions including aff… |
CVE-2021-25677 | Medium | 5.3 | 2021-04-22 | A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE P… |
CVE-2021-28055 | Medium | 6.5 | 2021-04-15 | An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. The anti-CSRF token generation is predictable, which might allow CSRF attacks that add an… |
CVE-2021-21729 | Medium | 6.5 | 2021-04-13 | Some ZTE products have CSRF vulnerability. Because some pages lack CSRF random value verification, attackers could perform illegal authorization operations by… |
CVE-2021-25375 | Medium | 6.5 | 2021-04-09 | Using predictable index for attachments in Samsung Email prior to version 6.1.41.0 allows remote attackers to get attachments of another emails when users open… |
CVE-2021-3446 | Medium | 5.5 | 2021-03-25 | A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability related to the returned I… |
CVE-2021-28099 | Medium | 4.4 | 2021-03-23 | In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permission… |
CVE-2021-22309 | High | 7.5 | 2021-03-22 | There is insecure algorithm vulnerability in Huawei products. A module uses less random input in a secure mechanism. Attackers can exploit this vulnerability b… |
CVE-2021-0375 | Medium | 5.5 | 2021-03-10 | In onPackageModified of VoiceInteractionManagerService.java, there is a possible change of default applications due to an insecure default value. This could le… |
CVE-2021-21352 | Medium | 6.8 | 2021-03-03 | Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In TimeTracker before version 1.19.24.5415 tokens used in password re… |
CVE-2021-27884 | Medium | 5.1 | 2021-03-01 | Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in… |
CVE-2020-36252 | Medium | 6.8 | 2021-02-19 | ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim, to access any version of any file by sending a request for a p… |
CVE-2020-13860 | High | 7.5 | 2021-02-01 | An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. The one-time password algorithm for the undocumented system account mofidev generat… |
CVE-2020-27264 | High | 8.8 | 2021-01-19 | In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i and AnyDana-A mobile app… |
CVE-2020-35926 | Critical | 9.8 | 2020-12-31 | An issue was discovered in the nanorand crate before 0.5.1 for Rust. It caused any random number generator (even ChaCha) to return all zeroes because integer t… |
CVE-2020-17470 | Medium | 5.3 | 2020-12-11 | An issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface structure does not set sufficiently random transaction IDs (t… |
CVE-2020-15023 | Medium | 5.9 | 2020-12-11 | Askey AP5100W devices through AP5100W_Dual_SIG_1.01.097 are affected by WPS PIN offline brute-force cracking. This arises because of issues with the random num… |
CVE-2020-7548 | Critical | 9.8 | 2020-12-01 | A CWE-330 - Use of Insufficiently Random Values vulnerability exists in Smartlink, PowerTag, and Wiser Series Gateways (see security notification for version i… |
CVE-2020-26550 | High | 7.5 | 2020-11-17 | An issue was discovered in Aviatrix Controller before R5.3.1151. An encrypted file containing credentials to unrelated systems is protected by a three-characte… |
CVE-2020-27556 | Medium | 5.3 | 2020-11-17 | A predictable device ID in BASETech GE-131 BT-1837836 firmware 20180921 allows unauthenticated remote attackers to connect to the device. |
CVE-2020-25705 | High | 7.4 | 2020-11-17 | A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively by… |
CVE-2020-27180 | High | 7.5 | 2020-10-27 | konzept-ix publiXone before 2020.015 allows attackers to download files by iterating over the IXCopy fileID parameter. |
CVE-2020-27743 | Critical | 9.8 | 2020-10-26 | libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes(). This could lead to use of a non-random/predictable session… |
CVE-2020-1905 | Low | 3.3 | 2020-10-06 | Media ContentProvider URIs used for opening attachments in other apps were generated sequentially prior to WhatsApp for Android v2.20.185, which could have all… |
CVE-2020-26107 | High | 7.5 | 2020-09-25 | cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561). |
CVE-2020-0407 | Medium | 4.4 | 2020-09-17 | In various functions in fscrypt_ice.c and related files in some implementations of f2fs encryption that use encryption hardware which only supports 32-bit IVs… |
CVE-2020-13304 | Low | 3.8 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which resulted an a… |
CVE-2020-16271 | Critical | 9.1 | 2020-08-03 | The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 generates insufficiently random numbers, which allows remote attackers to read and modify data… |
CVE-2020-16166 | Low | 3.7 | 2020-07-30 | The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network… |
CVE-2020-10274 | High | 7.1 | 2020-06-24 | The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard… |
CVE-2020-4188 | Medium | 5.3 | 2020-06-23 | IBM Security Guardium 10.6 and 11.1 may use insufficiently random numbers or values in a security context that depends on unpredictable numbers. IBM X-Force ID… |
CVE-2020-14423 | Medium | 5.3 | 2020-06-18 | Convos before 4.20 does not properly generate a random secret in Core/Settings.pm and Util.pm. This leads to a predictable CONVOS_LOCAL_SECRET value, affecting… |
CVE-2020-14422 | Medium | 5.9 | 2020-06-18 | Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to… |
CVE-2020-11901 | Critical | 9.0 | 2020-06-17 | The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response. |
CVE-2020-12712 | High | 7.5 | 2020-06-11 | A vulnerability based on insecure user/password encryption in the JOE (job editor) component of SOS JobScheduler 1.12 and 1.13 allows attackers to decrypt the… |
CVE-2020-13817 | High | 7.4 | 2020-06-04 | ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting tra… |
CVE-2020-5365 | Medium | 5.3 | 2020-05-20 | Dell EMC Isilon versions 8.2.2 and earlier contain a remotesupport vulnerability. The pre-configured support account, remotesupport, is bundled in the Dell EMC… |
CVE-2020-11551 | High | 8.8 | 2020-05-18 | An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106, Outdoor Satellite (RBS50Y) V2.5.1.106, and Pro Tri-B… |
CVE-2020-12858 | High | 7.5 | 2020-05-18 | Non-reinitialisation of random data in the advertising payload in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker to re-identify Android devices running… |
CVE-2020-5408 | Medium | 6.5 | 2020-05-14 | Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null in… |
CVE-2020-9502 | Critical | 9.8 | 2020-05-13 | Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predic… |
CVE-2020-8792 | Medium | 5.3 | 2020-05-04 | The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has an information-exposure issue. In the mobile app, an attempt to add an… |
CVE-2020-12270 | Medium | 6.5 | 2020-04-27 | React Native Bluetooth Scan in Bluezone 1.0.0 uses six-character alphanumeric IDs, which might make it easier for remote attackers to interfere with COVID-19 c… |
CVE-2020-11877 | High | 7.5 | 2020-04-17 | airhost.exe in Zoom Client for Meetings 4.6.11 uses 3423423432325249 as the Initialization Vector (IV) for AES-256 CBC encryption. NOTE: the vendor states that… |
CVE-2020-1759 | Medium | 6.4 | 2020-04-13 | A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was discovered in the secure… |
CVE-2020-11585 | Medium | 4.3 | 2020-04-06 | There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A register… |
CVE-2020-11501 | High | 7.4 | 2020-04-03 | GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit… |
CVE-2020-10870 | Medium | 5.5 | 2020-03-23 | Zim through 0.72.1 creates temporary directories with predictable names. A malicious user could predict and create Zim's temporary directories and prevent othe… |
CVE-2019-20494 | Low | 3.3 | 2020-03-17 | In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525). |
CVE-2019-19135 | High | 7.4 | 2020-03-16 | In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.Opc.Ua before 1.4.35… |
CVE-2019-9102 | High | 8.8 | 2020-03-11 | An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices… |
CVE-2019-12434 | Medium | 4.3 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the contrast… |
CVE-2019-2317 | Critical | 9.8 | 2020-03-05 | The secret key used to make the Initial Sequence Number in the TCP SYN packet could be brute forced and therefore can be predicted in Snapdragon Auto, Snapdrag… |
CVE-2020-1731 | Critical | 9.1 | 2020-03-02 | A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random admin password when inst… |
CVE-2020-9449 | High | 8.8 | 2020-02-28 | An insecure random number generation vulnerability in BlaB! AX, BlaB! AX Pro, BlaB! WS (client), and BlaB! WS Pro (client) version 19.11 allows an attacker (wi… |
CVE-2020-8988 | Medium | 5.9 | 2020-02-13 | The Voatz application 2020-01-01 for Android allows only 100 million different PINs, which makes it easier for attackers (after using root access to make a cop… |
CVE-2020-8631 | Medium | 5.5 | 2020-02-05 | cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudin… |
CVE-2020-2099 | High | 8.6 | 2020-01-29 | Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attac… |
CVE-2013-0294 | Medium | 5.9 | 2020-01-28 | packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obta… |
CVE-2018-19441 | Medium | 4.7 | 2020-01-27 | An issue was discovered in Neato Botvac Connected 2.2.0. The GenerateRobotPassword function of the NeatoCrypto library generates insufficiently random numbers… |
CVE-2020-7241 | High | 7.5 | 2020-01-20 | The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content/uploads/db-backup/. This might allow at… |
CVE-2019-18282 | Medium | 5.3 | 2020-01-16 | The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the… |
CVE-2012-1562 | High | 7.5 | 2020-01-15 | Joomla! core before 2.5.3 allows unauthorized password change. |
CVE-2020-0644 | High | 7.8 | 2020-01-14 | An elevation of privilege vulnerability exists when Microsoft Windows implements predictable memory section names, aka 'Windows Elevation of Privilege Vulnerab… |
CVE-2019-16674 | Critical | 9.8 | 2019-12-06 | An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Auth… |
CVE-2019-18850 | High | 7.5 | 2019-12-04 | TrevorC2 v1.1/v1.2 fails to prevent fingerprinting primarily via a discrepancy between response headers when responding to different HTTP methods, also via pre… |
CVE-2019-5232 | High | 7.5 | 2019-11-29 | There is a use of insufficiently random values vulnerability in Huawei ViewPoint products. An unauthenticated, remote attacker can guess information by a large… |
CVE-2016-4980 | Low | 2.5 | 2019-11-27 | A password generation weakness exists in xquest through 2016-06-13. |
CVE-2014-6311 | Critical | 9.8 | 2019-11-22 | generate_doygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attackers to gain elevated privileges. |
CVE-2019-4411 | Medium | 4.3 | 2019-11-09 | IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 could allow an authenticated user to obtain sensitive information due to easy to guess session identif… |
CVE-2019-16205 | High | 8.8 | 2019-11-08 | A vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute-force a valid session ID. The vulnerability is due to an insuffi… |
CVE-2019-10084 | High | 7.5 | 2019-11-05 | In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries… |
CVE-2010-3666 | Medium | 5.3 | 2019-11-04 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness in the uniqid function. |
CVE-2013-4102 | Critical | 9.1 | 2019-11-04 | Cryptocat before 2.0.22 strophe.js Math.random() Random Number Generator Weakness |
CVE-2019-13929 | Medium | 6.5 | 2019-10-10 | A vulnerability has been identified in SIMATIC IT UADM (All versions < V1.3). An authenticated remote attacker with network access to port 1434/tcp of SIMATIC… |
CVE-2019-17105 | Medium | 5.3 | 2019-10-08 | The token generator in index.php in Centreon Web before 2.8.27 is predictable. |