{"cve":"CVE-2001-0950","nvd":{"published":"2001-12-04T05:00:00.000","modified":"2026-06-16T21:55:17.333","status":"Modified","description":"ValiCert Enterprise Validation Authority (EVA) Administration Server 3.3 through 4.2.1 uses insufficiently random data to (1) generate session tokens for HSMs using the C rand function, or (2) generate certificates or keys using /dev/urandom instead of another source which blocks when the entropy pool is low, which could make it easier for local or remote attackers to steal tokens or certificates via brute force guessing.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-331"],"references":["http://marc.info/?l=bugtraq&m=100749428517090&w=2","http://www.securityfocus.com/bid/3618","http://www.securityfocus.com/bid/3620","http://www.valicert.com/support/security_advisory_eva.html","https://exchange.xforce.ibmcloud.com/vulnerabilities/7651"],"products":["valicert:enterprise_validation_authority"],"source":"nvd","synced_at":"2026-10-19T19:34:38.930894741+00:00"},"epss":{"cve":"CVE-2001-0950","score":0.01594,"percentile":0.75713,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}