CWE-330: Use of Insufficiently Random Values, page 3
Filter
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
What the weakness is: CWE-330 at MITRE
Ask an AI about CWE-330
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-330: Use of Insufficiently Random Values and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/330.html and https://cve.bz/cve/cwe/330?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.3CVE-2024-52615EPSS 0.6%
A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.
- 9.0CVE-2024-10082EPSS 0.5%
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication method confusion allows logging in as the built-in root user from an external service. The built-in root…
- 5.9CVE-2024-20331EPSS 0.7%
A vulnerability in the session authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote a…
- 7.5CVE-2024-47188EPSS 0.3%
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for "thash" leads to byte-range tracking having predict…
- 7.5CVE-2024-47187EPSS 0.3%
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for "thash" leads to datasets having predictable hash t…
- 8.0CVE-2024-7558EPSS 0.5%
JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the J…
- 7.5CVE-2024-41708EPSS 0.4%
An issue was discovered in AdaCore ada_web_services 20.0 allows an attacker to escalate privileges and steal sessions via the Random_String() function in the src/core/aws-utils.adb module.
- 5.3CVE-2024-6348EPSS 0.4%
Predictable seed generation in the security access mechanism of UDS in the Blind Spot Protection Sensor ECU in Nissan Altima (2022) allows attackers to predict the requested seeds and bypass security controls via repeated ECU resets and se…
- 6.5CVE-2024-42475EPSS 0.2%
In the OAuth library for nim prior to version 0.11, the `state` values generated by the `generateState` function do not have sufficient entropy. These can be successfully guessed by an attacker allowing them to perform a CSRF vs a user, as…
- 6.3CVE-2024-7659EPSS 0.8%
A vulnerability, which was classified as problematic, was found in projectsend up to r1605. Affected is the function generate_random_string of the file includes/functions.php of the component Password Reset Token Handler. The manipulation …
- 5.4CVE-2024-42165EPSS 0.4%
Insufficiently random values for generating activation token in FIWARE Keyrock <= 8.4 allow attackers to activate accounts of any user by predicting the token for the activation link.
- 4.3CVE-2024-42164EPSS 0.4%
Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to disable two factor authorization of any user by predicting the token for the disable_2fa link.
- 6.5CVE-2024-21460EPSS 0.1%
Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space.
- 9.8CVE-2024-25943EPSS 0.7%
iDRAC9, versions prior to 7.00.00.172 for 14th Generation and 7.10.50.00 for 15th and 16th Generations, contains a session hijacking vulnerability in IPMI. A remote attacker could potentially exploit this vulnerability, leading to arbitrar…
- 5.3CVE-2024-5868EPSS 0.3%
The WooCommerce - Social Login plugin for WordPress is vulnerable to Email Verification in all versions up to, and including, 2.6.2 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers …
- 8.8CVE-2024-35292EPSS 0.4%
A vulnerability has been identified in SIMATIC S7-200 SMART CPU CR40 (6ES7288-1CR40-0AA0) (All versions), SIMATIC S7-200 SMART CPU CR60 (6ES7288-1CR60-0AA0) (All versions), SIMATIC S7-200 SMART CPU SR20 (6ES7288-1SR20-0AA0) (All versions),…
- 5.3CVE-2024-5149EPSS 0.4%
The BuddyForms plugin for WordPress is vulnerable to Email Verification Bypass in all versions up to, and including, 2.8.9 via the use of an insufficiently random activation code. This makes it possible for unauthenticated attackers to byp…
- 9.8CVE-2024-36389EPSS 0.5%
MileSight DeviceHub - CWE-330 Use of Insufficiently Random Values may allow Authentication Bypass
- 8.1CVE-2024-4185EPSS 0.9%
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Email Verification and Authentication Bypass in all versions up to, and including, 2.7.4 via the use of insufficiently random activation code. This makes…
- 5.9CVE-2023-6799EPSS 0.7%
The WP Reset – Most Advanced WordPress Reset Tool plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0 via the use of insufficiently random snapshot names. This makes it possible fo…
- 5.3CVE-2024-28013EPSS 0.4%
Use of Insufficiently Random Values vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS, WG1200HP, WF300HP2, W300P, WF800HP, WR8165N, WG2200HP…
- 9.1CVE-2024-1631EPSS 0.9%
Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which will then be used as the secret key. When no seed value is provided, it is …
- 9.8CVE-2024-21495EPSS 0.7%
Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure random number generation library which could possibly be predicted via a brute-force search. Attackers …
- 7.5CVE-2024-0761EPSS 1.0%
The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to insufficient randomness in the backup filenames, which use a timestamp plus 4 random digits. This make…
- 5.3CVE-2024-23688EPSS 0.5%
Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally be unique for every message. The node's private key isn't compromised, only the session key generated for specific peer c…
- 9.8CVE-2023-46740EPSS 0.4%
CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allo…
- 5.5CVE-2023-32831EPSS 0.2%
In wlan driver, there is a possible PIN crack due to use of insufficiently random values. This could lead to local information disclosure with no execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR…
- 5.9CVE-2023-4462EPSS 0.9%
A vulnerability classified as problematic has been found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 500, CCX 505, CCX 600, CCX 700, EDGE E100, EDGE E220, EDGE E300, EDGE E320, EDGE E350, EDGE E400, EDGE E450, …
- 7.5CVE-2023-6376EPSS 1.1%
Henschen & Associates court document management software does not sufficiently randomize file names of cached documents, allowing a remote, unauthenticated attacker to access restricted documents.
- 7.5CVE-2023-48056EPSS 0.4%
PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.
- 9.1CVE-2020-27636EPSS 0.9%
In Microchip MPLAB Net 3.6.1, TCP ISNs are improperly random.
- 9.1CVE-2020-27635EPSS 0.9%
In PicoTCP 1.7.0, TCP ISNs are improperly random.
- 9.1CVE-2020-27634EPSS 1.7%
In Contiki 4.5, TCP ISNs are improperly random.
- 9.1CVE-2020-27633EPSS 0.9%
In FNET 4.6.3, TCP ISNs are improperly random.
- 9.8CVE-2020-27631EPSS 1.1%
In Oryx CycloneTCP 1.9.6, TCP ISNs are improperly random.
- 9.8CVE-2020-27630EPSS 1.1%
In Silicon Labs uC/TCP-IP 3.6.0, TCP ISNs are improperly random.
- 7.5CVE-2020-27213EPSS 1.0%
An issue was discovered in Ethernut Nut/OS 5.1. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of …
- 9.8CVE-2023-29332EPSS 2.7%
Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
- 7.5CVE-2023-41879EPSS 1.3%
Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "protect_code". This code is 6 hexadecimal characters which is arguably not enough …
- 7.5CVE-2023-34353EPSS 1.2%
An authentication bypass vulnerability exists in the OAS Engine authentication functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted network sniffing can lead to decryption of sensitive information. An att…
- 9.8CVE-2023-39979EPSS 1.0%
There is a vulnerability in MXsecurity versions prior to 1.0.1 that can be exploited to bypass authentication. A remote attacker might access the system if the web service authenticator has insufficient random values.
- 9.8CVE-2023-4344EPSS 0.7%
Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection
- 5.5CVE-2023-24478EPSS 0.2%
Use of insufficiently random values for some Intel Agilex(R) software included as part of Intel(R) Quartus(R) Prime Pro Edition for linux before version 22.4 may allow an authenticated user to potentially enable information disclosure via …
- 9.1CVE-2023-3373EPSS 1.0%
Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior and GOT SIMPLE Series GS21 model versions 01.49.000 and prior allows a remote unauthentica…
- 7.5CVE-2023-26451EPSS 1.2%
Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client…
- 4.3CVE-2023-3247EPSS 0.7%
In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In cas…
- 3.7CVE-2023-3803EPSS 0.7%
A vulnerability classified as problematic has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This affects an unknown part of the file /Service/ImageStationDataService.asmx of the component File Name Handler. …
- 7.4CVE-2023-20185EPSS 0.3%
A vulnerability in the Cisco ACI Multi-Site CloudSec encryption feature of Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an unauthenticated, remote attacker to read or modify intersite encrypted traffic. This vulnerabi…
- 7.5CVE-2023-1898EPSS 0.6%
Atlas Copco Power Focus 6000 web server uses a small amount of session ID numbers. An attacker could enter a session ID number to retrieve data for an active user’s session.
- 5.3CVE-2020-36732EPSS 1.1%
The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary.