CWE-335 · Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
43 CVEs classified under CWE-335 (Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)). Browse by severity and year.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-36048 | Critical | 9.8 | 2024-05-18 | QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses… |
CVE-2023-4472 | Critical | 9.8 | 2024-02-01 | Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead… |
CVE-2012-1577 | Critical | 9.8 | 2019-12-10 | lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0. |
CVE-2019-11495 | Critical | 9.8 | 2019-09-10 | In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely. Couchbase Server uses erlang:now() to seed the PRNG which r… |
CVE-2019-10908 | Critical | 9.8 | 2019-04-07 | In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally. This PRNG… |
CVE-2017-11519 | Critical | 9.8 | 2017-07-21 | passwd_recovery.lua on the TP-Link Archer C9(UN)_V2_160517 allows an attacker to reset the admin password by leveraging a predictable random number generator s… |
CVE-2024-27632 | High | 8.8 | 2024-04-08 | An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the form_id in the form_header() function. |
CVE-2024-7558 | High | 8.7 | 2024-10-02 | JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the… |
CVE-2021-41117 | High | 8.7 | 2021-10-11 | keypair is a a RSA PEM key generator written in javascript. keypair implements a lot of cryptographic primitives on its own or by borrowing from other librarie… |
CVE-2022-31034 | High | 8.3 | 2022-06-27 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v0.11.0 are vulnerable to a variety of attacks… |
CVE-2024-1579 | High | 8.1 | 2024-04-29 | Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Secomea GateManager (Webserver modules) allows Session Hijacking.This issue… |
CVE-2022-26852 | High | 8.1 | 2022-04-08 | Dell PowerScale OneFS, versions 8.2.x-9.3.x, contain a predictable seed in pseudo-random number generator. A remote unauthenticated attacker could potentially… |
CVE-2016-3735 | High | 8.1 | 2022-01-28 | Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmt_rand in order to generate password reset toke… |
CVE-2018-12520 | High | 8.1 | 2018-07-05 | An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in d… |
CVE-2021-42810 | High | 7.8 | 2022-01-19 | A flaw in the previous versions of the product may allow an authenticated attacker the ability to execute code as a privileged user on a system where the agent… |
CVE-2026-25835 | High | 7.7 | 2026-04-01 | Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG). |
CVE-2026-11702 | High | 7.5 | 2026-06-26 | Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised before forking, then t… |
CVE-2026-11625 | High | 7.5 | 2026-06-26 | Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, or when the f… |
CVE-2026-41564 | High | 7.5 | 2026-04-23 | CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking. The Crypt::PK::RSA, Crypt::PK::DSA, Crypt::PK::DH, Crypt::PK::ECC… |
CVE-2025-27580 | High | 7.5 | 2025-04-24 | NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, time, and the fixed 7… |