CWE-331 · Insufficient Entropy (page 2)
Page 2 of 2 — CVEs classified under CWE-331, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-25926 | High | 7.5 | 2021-08-18 | The DNS client in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Insufficient entropy in the DNS transaction id. The impact is: DNS cache poisoning (remote… |
CVE-2021-22727 | Critical | 9.8 | 2021-07-21 | A CWE-331: Insufficient Entropy vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV… |
CVE-2021-33027 | Critical | 9.8 | 2021-07-19 | Sylabs Singularity Enterprise through 1.6.2 has Insufficient Entropy in a nonce. |
CVE-2021-29471 | Low | 3.7 | 2021-05-11 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP… |
CVE-2021-3505 | Medium | 5.5 | 2021-04-19 | A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specificat… |
CVE-2020-28924 | High | 7.5 | 2020-11-19 | An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords wit… |
CVE-2020-10285 | Critical | 9.8 | 2020-07-15 | The authentication implementation on the xArm controller has very low entropy, making it vulnerable to a brute-force attack. There is no mechanism in place to… |
CVE-2017-18883 | Critical | 9.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorizat… |
CVE-2020-11957 | High | 7.5 | 2020-06-09 | The Bluetooth Low Energy implementation in Cypress PSoC Creator BLE 4.2 component versions before 3.64 generates a random number (Pairing Random) with signific… |
CVE-2020-12735 | Critical | 9.8 | 2020-05-08 | reset.php in DomainMOD 4.13.0 uses insufficient entropy for password reset requests, leading to account takeover. |
CVE-2020-1773 | High | 7.3 | 2020-03-27 | An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able t… |
CVE-2015-3006 | Medium | 6.5 | 2020-02-28 | On the QFX3500 and QFX3600 platforms, the number of bytes collected from the RANDOM_INTERRUPT entropy source when the device boots up is insufficient, possibly… |
CVE-2019-10064 | High | 7.5 | 2020-02-28 | hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which resul… |
CVE-2015-8851 | High | 7.5 | 2020-01-30 | node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force gu… |
CVE-2019-14317 | Medium | 5.3 | 2019-12-11 | wolfSSL and wolfCrypt 4.1.0 and earlier (formerly known as CyaSSL) generate biased DSA nonces. This allows a remote attacker to compute the long term private k… |
CVE-2013-2260 | Critical | 9.8 | 2019-11-04 | Cryptocat before 2.0.22: Cryptocat.random() Function Array Key has Entropy Weakness |
CVE-2019-15703 | High | 7.5 | 2019-10-24 | An Insufficient Entropy in PRNG vulnerability in Fortinet FortiOS 6.2.1, 6.2.0, 6.0.8 and below for device not enable hardware TRNG token and models not suppor… |
CVE-2019-15847 | High | 7.5 | 2019-09-02 | The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus re… |
CVE-2019-14806 | High | 7.5 | 2019-08-09 | Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id. |
CVE-2018-18326 | High | 7.5 | 2019-07-03 | DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists bec… |
CVE-2018-15812 | High | 7.5 | 2019-07-03 | DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy. |
CVE-2019-9555 | Medium | 5.3 | 2019-03-05 | Sagemcom F@st 5260 routers using firmware version 0.4.39, in WPA mode, default to using a PSK that is generated from a 2-part wordlist of known values and a no… |
CVE-2018-8435 | Medium | 4.2 | 2018-09-13 | A security feature bypass vulnerability exists when Windows Hyper-V BIOS loader fails to provide a high-entropy source, aka "Windows Hyper-V Security Feature B… |
CVE-2017-2626 | Medium | 5.2 | 2018-07-27 | It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using… |
CVE-2017-2625 | Medium | 6.5 | 2018-07-27 | It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys. On a multi-user system using xdmcp, a local attacker could p… |
CVE-2018-1000620 | Critical | 9.8 | 2018-07-09 | Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is m… |
CVE-2018-10240 | High | 7.3 | 2018-05-16 | SolarWinds Serv-U MFT before 15.1.6 HFv1 assigns authenticated users a low-entropy session token that can be included in requests to the application as a URL p… |
CVE-2014-8422 | High | 8.1 | 2018-04-12 | The web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 generates session cookie… |
CVE-2014-0691 | High | 7.3 | 2017-10-24 | Cisco WebEx Meetings Server before 1.1 uses meeting IDs with insufficient entropy, which makes it easier for remote attackers to bypass authentication and join… |
CVE-2017-13992 | High | 8.1 | 2017-10-05 | An Insufficient Entropy issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not utilize sufficiently random number generation… |
CVE-2015-7764 | High | 7.5 | 2017-08-09 | Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode. |
CVE-2015-3405 | High | 7.5 | 2017-08-09 | ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest… |
CVE-2017-6030 | Medium | 6.5 | 2017-06-30 | A predictable value range from previous values issue was discovered in Schneider Electric Modicon PLCs Modicon M221, firmware versions prior to Version 1.5.0.0… |
CVE-2017-0897 | High | 7.5 | 2017-06-22 | ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to rem… |
CVE-2016-2564 | Medium | 5.9 | 2017-04-23 | Invision Power Services (IPS) Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the more_entropy flag. Att… |
CVE-2016-2858 | Medium | 6.5 | 2016-04-07 | QEMU, when built with the Pseudo Random Number Generator (PRNG) back-end support, allows local guest OS users to cause a denial of service (process crash) via… |
CVE-2012-4687 | | 2012-12-08 | Post Oak AWAM Bluetooth Reader Traffic System does not use a sufficient source of entropy for private keys, which makes it easier for man-in-the-middle attacke… | |
CVE-2008-1447 | Medium | 6.8 | 2008-07-08 | The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server… |
CVE-2008-2108 | Critical | 9.8 | 2008-05-07 | The GENERATE_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zer… |
CVE-2001-0950 | High | 7.5 | 2001-12-04 | ValiCert Enterprise Validation Authority (EVA) Administration Server 3.3 through 4.2.1 uses insufficiently random data to (1) generate session tokens for HSMs… |