CWE-335 · Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

43 CVEs classified under CWE-335 (Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)). Browse by severity and year.

Top CVEs for CWE-335
CVESeverityScorePublishedSummary
CVE-2024-36048Critical9.82024-05-18QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses…
CVE-2023-4472Critical9.82024-02-01Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead…
CVE-2012-1577Critical9.82019-12-10lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0.
CVE-2019-11495Critical9.82019-09-10In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely. Couchbase Server uses erlang:now() to seed the PRNG which r…
CVE-2019-10908Critical9.82019-04-07In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally. This PRNG…
CVE-2017-11519Critical9.82017-07-21passwd_recovery.lua on the TP-Link Archer C9(UN)_V2_160517 allows an attacker to reset the admin password by leveraging a predictable random number generator s…
CVE-2024-27632High8.82024-04-08An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the form_id in the form_header() function.
CVE-2024-7558High8.72024-10-02JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the…
CVE-2021-41117High8.72021-10-11keypair is a a RSA PEM key generator written in javascript. keypair implements a lot of cryptographic primitives on its own or by borrowing from other librarie…
CVE-2022-31034High8.32022-06-27Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v0.11.0 are vulnerable to a variety of attacks…
CVE-2024-1579High8.12024-04-29Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Secomea GateManager (Webserver modules) allows Session Hijacking.This issue…
CVE-2022-26852High8.12022-04-08Dell PowerScale OneFS, versions 8.2.x-9.3.x, contain a predictable seed in pseudo-random number generator. A remote unauthenticated attacker could potentially…
CVE-2016-3735High8.12022-01-28Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmt_rand in order to generate password reset toke…
CVE-2018-12520High8.12018-07-05An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in d…
CVE-2021-42810High7.82022-01-19A flaw in the previous versions of the product may allow an authenticated attacker the ability to execute code as a privileged user on a system where the agent…
CVE-2026-25835High7.72026-04-01Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG).
CVE-2026-11702High7.52026-06-26Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised before forking, then t…
CVE-2026-11625High7.52026-06-26Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, or when the f…
CVE-2026-41564High7.52026-04-23CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking. The Crypt::PK::RSA, Crypt::PK::DSA, Crypt::PK::DH, Crypt::PK::ECC…
CVE-2025-27580High7.52025-04-24NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, time, and the fixed 7…
All CVEs classified under CWE-335 — newest first (page 1 of 1)
CVESeverityScorePublishedSummary
CVE-2026-11702High7.52026-06-26Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised before forking, then t…
CVE-2026-11625High7.52026-06-26Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, or when the f…
CVE-2026-41564High7.52026-04-23CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking. The Crypt::PK::RSA, Crypt::PK::DSA, Crypt::PK::DH, Crypt::PK::ECC…
CVE-2026-25835High7.72026-04-01Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG).
CVE-2026-3503Medium5.22026-03-19Protection mechanism failure in wolfCrypt post-quantum implementations (ML-KEM and ML-DSA) in wolfSSL on ARM Cortex-M microcontrollers allows a physical attack…
CVE-2025-52578Medium5.72025-11-18Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM may allow a sophisticated attacker with physical access…
CVE-2025-27580High7.52025-04-24NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, time, and the fixed 7…
CVE-2024-10026Medium5.32025-01-30A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot ident…
CVE-2025-24783High7.52025-01-27** UNSUPPORTED WHEN ASSIGNED ** Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Apache Cocoon. This issue affects Apache Co…
CVE-2024-55566Medium6.62024-12-09ColPack 1.0.10 through 9a7293a has a predictable temporary file (located under /tmp with a name derived from an unseeded RNG). The impact can be overwriting fi…
CVE-2024-9312High7.52024-10-10Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another u…
CVE-2024-7558High8.72024-10-02JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the…
CVE-2024-36048Critical9.82024-05-18QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses…
CVE-2024-1579High8.12024-04-29Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Secomea GateManager (Webserver modules) allows Session Hijacking.This issue…
CVE-2024-27632High8.82024-04-08An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the form_id in the form_header() function.
CVE-2023-4472Critical9.82024-02-01Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead…
CVE-2023-49343Medium6.02023-12-14Temporary data passed between application components by Budgie Extras Dropby applet could potentially be viewed or manipulated. The data is stored in a locatio…
CVE-2022-40267Medium5.92023-01-20Predictable Seed in Pseudo-Random Number Generator (PRNG) vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=…
CVE-2022-42159Medium4.32022-10-13D-Link COVR 1200,1202,1203 v1.08 was discovered to have a predictable seed in a Pseudo-Random Number Generator.
CVE-2022-31008Medium5.52022-10-06RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (li…
CVE-2022-39218High7.52022-09-20The JS Compute Runtime for Fastly's Compute@Edge platform provides the environment JavaScript is executed in when using the Compute@Edge JavaScript SDK. In ver…
CVE-2022-31034High8.32022-06-27Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v0.11.0 are vulnerable to a variety of attacks…
CVE-2019-25061High7.52022-05-18The random_password_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due to its cyclic nature…
CVE-2022-26852High8.12022-04-08Dell PowerScale OneFS, versions 8.2.x-9.3.x, contain a predictable seed in pseudo-random number generator. A remote unauthenticated attacker could potentially…
CVE-2016-3735High8.12022-01-28Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmt_rand in order to generate password reset toke…
CVE-2021-34600Medium5.52022-01-20Telenot CompasX versions prior to 32.0 use a weak seed for random number generation leading to predictable AES keys used in the NFC tags used for local authori…
CVE-2021-42810High7.82022-01-19A flaw in the previous versions of the product may allow an authenticated attacker the ability to execute code as a privileged user on a system where the agent…
CVE-2021-41117High8.72021-10-11keypair is a a RSA PEM key generator written in javascript. keypair implements a lot of cryptographic primitives on its own or by borrowing from other librarie…
CVE-2021-32033Medium4.62021-06-16Protectimus SLIM NFC 70 10.01 devices allow a Time Traveler attack in which attackers can predict TOTP passwords in certain situations. The time value used by…
CVE-2020-28597High7.52021-03-03A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predicting the seed it is possible to generate th…
CVE-2021-27211High7.52021-02-15steghide 0.5.1 relies on a certain 32-bit seed value, which makes it easier for attackers to detect hidden data.
CVE-2020-7010High7.52020-06-03Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the…
CVE-2020-13784High7.52020-06-03D-Link DIR-865L Ax 1.20B01 Beta devices have a predictable seed in a Pseudo-Random Number Generator.
CVE-2012-1577Critical9.82019-12-10lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0.
CVE-2019-11495Critical9.82019-09-10In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely. Couchbase Server uses erlang:now() to seed the PRNG which r…
CVE-2018-12384Medium5.92019-04-29When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full…
CVE-2019-10908Critical9.82019-04-07In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally. This PRNG…
CVE-2018-14647High7.52018-09-25Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks a…
CVE-2018-12520High8.12018-07-05An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in d…
CVE-2018-1426High7.42018-03-22IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system calls when multiple ICC instances are…
CVE-2017-11519Critical9.82017-07-21passwd_recovery.lua on the TP-Link Archer C9(UN)_V2_160517 allows an attacker to reset the admin password by leveraging a predictable random number generator s…
CVE-2017-5214High7.52017-05-17The Codextrous B2J Contact (aka b2j_contact) extension before 2.1.13 for Joomla! allows prediction of a uniqid value based on knowledge of a time value. This m…
CVE-2016-10180High7.52017-01-30An issue was discovered on the D-Link DWR-932B router. WPS PIN generation is based on srand(time(0)) seeding.