CWE-338 · Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (page 2)
Page 2 of 3 — CVEs classified under CWE-338, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-22376 | Medium | 5.3 | 2025-01-03 | In Net::OAuth::Client in the Net::OAuth package before 0.29 for Perl, the default nonce is a 32-bit integer generated from the built-in rand() function, which… |
CVE-2024-56830 | Medium | 5.4 | 2025-01-02 | The Net::EasyTCP package 0.15 through 0.26 for Perl uses Perl's builtin rand() if no strong randomization module is present. |
CVE-2002-20002 | Medium | 5.4 | 2025-01-02 | The Net::EasyTCP package before 0.15 for Perl always uses Perl's builtin rand(), which is not a strong random number generator, for cryptographic keys. |
CVE-2018-25107 | High | 7.5 | 2024-12-29 | The Crypt::Random::Source package before 0.13 for Perl has a fallback to the built-in rand() function, which is not a secure source of random bits. |
CVE-2024-53702 | Medium | 5.3 | 2024-12-05 | Use of cryptographically weak pseudo-random number generator (PRNG) vulnerability in the SonicWall SMA100 SSLVPN backup code generator that, in certain cases… |
CVE-2024-7315 | High | 7.5 | 2024-10-02 | The Migration, Backup, Staging WordPress plugin before 0.9.106 does not use sufficient randomness in the filename that is created when generating a backup, wh… |
CVE-2024-47126 | Medium | 6.5 | 2024-09-26 | The goTenna Pro App does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attack… |
CVE-2024-45723 | Medium | 6.5 | 2024-09-26 | The goTenna Pro ATAK Plugin does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier fo… |
CVE-2024-45751 | Medium | 5.9 | 2024-09-06 | tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of c… |
CVE-2023-31305 | Low | 1.9 | 2024-08-13 | Generation of weak and predictable Initialization Vector (IV) in PMFW (Power Management Firmware) may allow an attacker with privileges to reuse IV values to r… |
CVE-2024-38353 | Medium | 5.3 | 2024-07-10 | CodiMD allows realtime collaborative markdown notes on all platforms. CodiMD before 2.5.4 is missing authentication and access control vulnerability allowing a… |
CVE-2024-29868 | Critical | 9.1 | 2024-06-24 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-registration and password recovery mechanism… |
CVE-2024-24554 | High | 8.2 | 2024-06-24 | Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the user token. This allow… |
CVE-2024-5264 | Medium | 5.9 | 2024-05-23 | Network Transfer with AES KHT in Thales Luna EFT 2.1 and above allows a user with administrative console access to access backups taken via offline analysis |
CVE-2024-4772 | Medium | 5.9 | 2024-05-14 | An HTTP digest authentication nonce value was generated using `rand()` which could lead to predictable values. This vulnerability affects Firefox < 126. |
CVE-2024-34538 | High | 7.5 | 2024-05-06 | Mateso PasswordSafe through 8.13.9.26689 has Weak Cryptography. |
CVE-2023-50059 | Medium | 5.3 | 2024-04-30 | An issue ingalxe.com Galxe platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Galxe, the signed messa… |
CVE-2024-31497 | Medium | 5.9 | 2024-04-15 | In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approx… |
CVE-2024-25389 | High | 7.5 | 2024-03-27 | RT-Thread through 5.0.2 generates random numbers with a weak algorithm of "seed = 214013L * seed + 2531011L; return (seed >> 16) & 0x7FFF;" in calc_random in d… |
CVE-2024-23660 | High | 7.5 | 2024-02-08 | The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and consequently gener… |
CVE-2023-45237 | Medium | 5.3 | 2024-01-16 | EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized a… |
CVE-2023-45236 | Medium | 5.8 | 2024-01-16 | EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized a… |
CVE-2023-48224 | High | 8.2 | 2023-11-15 | Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of pri… |
CVE-2023-27791 | High | 8.1 | 2023-10-19 | An issue found in IXP Data Easy Install 6.6.148840 allows a remote attacker to escalate privileges via insecure PRNG. |
CVE-2022-26943 | High | 8.8 | 2023-10-19 | The Motorola MTM5000 series firmwares generate TETRA authentication challenges using a PRNG using a tick count register as its sole entropy source. Low boottim… |
CVE-2023-39910 | High | 7.5 | 2023-08-09 | The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use of an mt19937 Mers… |
CVE-2023-36993 | Critical | 9.8 | 2023-07-07 | The cryptographically insecure random number generator being used in TravianZ 8.3.4 and 8.3.3 in the password reset function allows an attacker to guess the pa… |
CVE-2022-48506 | Low | 2.4 | 2023-06-19 | A flawed pseudorandom number generator in Dominion Voting Systems ImageCast Precinct (ICP and ICP2) and ImageCast Evolution (ICE) scanners allows anyone to det… |
CVE-2023-34363 | Medium | 5.9 | 2023-06-09 | An issue was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle. When using Oracle Advanced Security (OAS) encryption, if an error… |
CVE-2023-32549 | Medium | 6.8 | 2023-06-06 | Landscape cryptographic keys were insecurely generated with a weak pseudo-random generator. |
CVE-2023-2884 | Critical | 9.8 | 2023-05-25 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Use of Insufficiently Random Values vulnerability in CBOT Chatbot allows Signature Spoofin… |
CVE-2023-31290 | Medium | 5.9 | 2023-04-27 | Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploite… |
CVE-2023-28835 | Low | 3.5 | 2023-03-30 | Nextcloud server is an open source home cloud implementation. In affected versions the generated fallback password when creating a share was using a weak compl… |
CVE-2023-28395 | High | 8.3 | 2023-03-28 | Osprey Pump Controller version 1.01 is vulnerable to a weak session token generation algorithm that can be predicted and can aid in authentication and authoriz… |
CVE-2023-24828 | High | 8.1 | 2023-02-08 | Onedev is a self-hosted Git Server with CI/CD and Kanban. In versions prior to 7.9.12 the algorithm used to generate access token and password reset keys was n… |
CVE-2022-45782 | High | 8.8 | 2023-02-01 | An issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1. A cryptographically insecure random generation algorithm for passwor… |
CVE-2022-23472 | Medium | 5.9 | 2022-12-06 | Passeo is an open source python password generator. Versions prior to 1.0.5 rely on the python `random` library for random value selection. The python `random`… |
CVE-2022-35255 | Critical | 9.1 | 2022-12-05 | A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/c… |
CVE-2022-44796 | Critical | 9.8 | 2022-11-07 | An issue was discovered in Object First Ootbi BETA build 1.0.7.712. The authorization service has a flow that allows getting access to the Web UI without knowi… |
CVE-2022-41210 | Medium | 5.2 | 2022-10-11 | SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses insecure random number generator program which makes it easy for the attacker to pre… |
CVE-2022-40769 | High | 7.5 | 2022-09-18 | profanity through 1.60 has only four billion possible RNG initializations. Thus, attackers can recover private keys from Ethereum vanity addresses and steal cr… |
CVE-2022-36045 | Critical | 9.0 | 2022-08-31 | NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes web sockets for instant interactions and… |
CVE-2022-33738 | High | 7.5 | 2022-07-06 | OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal |
CVE-2022-20817 | High | 7.4 | 2022-06-15 | A vulnerability in Cisco Unified IP Phones could allow an unauthenticated, remote attacker to impersonate another user's phone if the Cisco Unified Communicati… |
CVE-2022-29245 | Medium | 6.5 | 2022-05-31 | SSH.NET is a Secure Shell (SSH) library for .NET. In versions 2020.0.0 and 2020.0.1, during an `X25519` key exchange, the client’s private key is generated wit… |
CVE-2022-0828 | High | 7.5 | 2022-04-11 | The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force… |
CVE-2022-26779 | High | 7.5 | 2022-03-15 | Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email… |
CVE-2021-36171 | High | 8.1 | 2022-03-01 | The use of a cryptographically weak pseudo-random number generator in the password reset feature of FortiPortal before 6.0.6 may allow a remote unauthenticated… |
CVE-2013-20003 | High | 8.3 | 2022-02-04 | Z-Wave devices from Sierra Designs (circa 2013) and Silicon Labs (using S0 security) may use a known, shared network key of all zeros, allowing an attacker wit… |
CVE-2021-43799 | High | 8.6 | 2022-01-25 | Zulip is an open-source team collaboration tool. Zulip Server installs RabbitMQ for internal message passing. In versions of Zulip Server prior to 4.9, the ini… |
CVE-2021-45489 | High | 7.5 | 2021-12-25 | In NetBSD through 9.2, the IPv6 Flow Label generation algorithm employs a weak cryptographic PRNG. |
CVE-2021-45484 | High | 7.5 | 2021-12-25 | In NetBSD through 9.2, the IPv6 fragment ID generation algorithm employs a weak cryptographic PRNG. |
CVE-2021-3990 | Medium | 6.5 | 2021-12-01 | showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) |
CVE-2011-4574 | Critical | 9.8 | 2021-10-27 | PolarSSL versions prior to v1.1 use the HAVEGE random number generation algorithm. At its heart, this uses timing information based on the processor's high res… |
CVE-2021-22948 | High | 7.1 | 2021-09-23 | Vulnerability in the generation of session IDs in revive-adserver < 5.3.0, based on the cryptographically insecure uniqid() PHP function. Under some circumstan… |
CVE-2021-27913 | Low | 3.5 | 2021-08-30 | The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker ca… |
CVE-2021-3047 | Medium | 4.2 | 2021-08-11 | A cryptographically weak pseudo-random number generator (PRNG) is used during authentication to the Palo Alto Networks PAN-OS web interface. This enables an au… |
CVE-2021-37553 | High | 7.5 | 2021-08-06 | In JetBrains YouTrack before 2021.2.16363, an insecure PRNG was used. |
CVE-2021-3678 | Medium | 5.9 | 2021-08-04 | showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) |
CVE-2021-34430 | High | 7.5 | 2021-07-08 | Eclipse TinyDTLS through 0.9-rc1 relies on the rand function in the C library, which makes it easier for remote attackers to compute the master key and then de… |
CVE-2021-0131 | Medium | 6.5 | 2021-06-09 | Use of cryptographically weak pseudo-random number generator (PRNG) in an API for the Intel(R) Security Library before version 3.3 may allow an authenticated u… |
CVE-2021-3538 | Critical | 9.8 | 2021-06-02 | A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7daf2b8e1d60c45. Due… |
CVE-2008-3280 | Medium | 5.9 | 2021-05-21 | It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator… |
CVE-2021-29245 | Medium | 5.3 | 2021-05-05 | BTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate a legacy API key. |
CVE-2021-23126 | Medium | 5.3 | 2021-03-04 | An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of the insecure rand() function within the process of generating the 2FA secret. |
CVE-2019-14480 | Critical | 9.8 | 2020-12-16 | AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead to an authentication bypass or escalatio… |
CVE-2020-28924 | High | 7.5 | 2020-11-19 | An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords wit… |
CVE-2020-28642 | Critical | 9.8 | 2020-11-16 | In InfiniteWP Admin Panel before 3.1.12.3, resetPasswordSendMail generates a weak password-reset code, which makes it easier for remote attackers to conduct ad… |
CVE-2020-11616 | High | 7.5 | 2020-10-29 | NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which the Pseudo-Random Number Generator (PR… |
CVE-2020-10560 | Medium | 5.9 | 2020-03-30 | An issue was discovered in Open Source Social Network (OSSN) through 5.3. A user-controlled file path with a weak cryptographic rand() can be used to read any… |
CVE-2019-19794 | Medium | 5.9 | 2019-12-13 | The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The… |
CVE-2019-8113 | Medium | 5.3 | 2019-11-05 | Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 uses cryptographically weak random number generator to brute-force the confirmation code fo… |
CVE-2012-6124 | Medium | 5.3 | 2019-10-31 | A casting error in Chicken before 4.8.0 on 64-bit platform caused the random number generator to return a constant value. NOTE: the vendor states "This functio… |
CVE-2015-9435 | Critical | 9.8 | 2019-09-26 | The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers. |
CVE-2019-10755 | Medium | 4.9 | 2019-09-23 | The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due… |
CVE-2019-10754 | High | 8.1 | 2019-09-23 | Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes th… |
CVE-2019-16303 | Critical | 9.8 | 2019-09-14 | A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness (apache… |
CVE-2019-7860 | High | 7.5 | 2019-08-02 | A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2… |
CVE-2019-7855 | Medium | 5.3 | 2019-08-02 | A cryptograhic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could be abused by an unauthenticated user to discov… |
CVE-2019-5440 | High | 8.1 | 2019-05-28 | Use of cryptographically weak PRNG in the password recovery token generation of Revive Adserver < v4.2.1 causes a potential authentication bypass attack if an… |
CVE-2019-11842 | High | 7.5 | 2019-05-09 | An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. Random number generation is mishandled, which makes it easier for attackers… |
CVE-2019-11808 | Low | 3.7 | 2019-05-07 | Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can dete… |
CVE-2018-15795 | High | 8.1 | 2018-11-13 | Pivotal CredHub Service Broker, versions prior to 1.1.0, uses a guessable form of random number generation in creating service broker's UAA client. A remote ma… |
CVE-2018-17968 | High | 7.5 | 2018-10-23 | A gambling smart contract implementation for RuletkaIo, an Ethereum gambling game, generates a random value that is predictable by an external contract call. T… |
CVE-2018-17877 | High | 7.5 | 2018-10-23 | A lottery smart contract implementation for Greedy 599, an Ethereum gambling game, generates a random value that is predictable via an external contract call… |
CVE-2018-12975 | High | 7.5 | 2018-09-24 | The random() function of the smart contract implementation for CryptoSaga, an Ethereum game, generates a random value with publicly readable variables such as… |
CVE-2018-5871 | Medium | 6.5 | 2018-09-20 | In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD… |
CVE-2018-5837 | High | 7.5 | 2018-09-20 | In Snapdragon (Automobile, Mobile, Wear) in version IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD… |
CVE-2018-11291 | High | 7.5 | 2018-09-20 | In Snapdragon (Automobile, Mobile, Wear) in version IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA4531, QCA6174A, QCA6564, QCA6574, QCA6574AU, QCA… |
CVE-2018-11290 | High | 7.5 | 2018-09-20 | In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, QCA6584, SD 210/SD 212/SD 205, SD 425, SD 427, SD… |
CVE-2018-17071 | High | 7.5 | 2018-09-18 | The fallback function of a simple lottery smart contract implementation for Lucky9io, an Ethereum gambling game, generates a random value with the publicly rea… |
CVE-2018-15552 | High | 7.5 | 2018-09-07 | The "PayWinner" function of a simplelottery smart contract implementation for The Ethereum Lottery, an Ethereum gambling game, generates a random value with pu… |
CVE-2018-16115 | Critical | 9.1 | 2018-08-29 | Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of an RNG error. A random number generator is used in Akka Remoting for T… |
CVE-2018-12056 | High | 7.5 | 2018-08-15 | The maxRandom function of a smart contract implementation for All For One, an Ethereum gambling game, generates a random value with publicly readable variables… |
CVE-2018-12885 | Medium | 5.9 | 2018-08-07 | The randMod() function of the smart contract implementation for MyCryptoChamp, an Ethereum game, generates a random value with publicly readable variables such… |
CVE-2018-14715 | High | 7.5 | 2018-08-03 | The endCoinFlip function and throwSlammer function of the smart contract implementations for Cryptogs, an Ethereum game, generate random numbers with an old bl… |
CVE-2018-12454 | High | 7.5 | 2018-06-17 | The _addguess function of a simplelottery smart contract implementation for 1000 Guess, an Ethereum gambling game, generates a random value with publicly reada… |
CVE-2017-16028 | Medium | 5.3 | 2018-06-04 | react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically s… |
CVE-2017-18021 | Critical | 9.8 | 2018-01-05 | It was discovered that QtPass before 1.2.1, when using the built-in password generator, generates possibly predictable and enumerable passwords. This only appl… |
CVE-2017-17845 | High | 7.3 | 2017-12-27 | An issue was discovered in Enigmail before 1.9.9. Improper Random Secret Generation occurs because Math.Random() is used by pretty Easy privacy (pEp), aka TBE-… |