cve.bz

CWE-340: Generation of Predictable Numbers or Identifiers, page 2

Filter

The product uses a scheme that generates numbers or identifiers that are more predictable than required.

What the weakness is: CWE-340 at MITRE. OWASP Top 10: A04:2025 Cryptographic Failures

Ask an AI about CWE-340

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-340: Generation of Predictable Numbers or Identifiers and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/340.html and https://cve.bz/cve/cwe/340?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2025-40918EPSS 0.5%

    Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely. The cnonce (client nonce) is generated from an MD5 hash of the PID, the epoch time and the built-in rand function. The PID will come fro…

  2. 7.3CVE-2025-40923EPSS 0.4%

    Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a sm…

  3. 6.3CVE-2024-10603EPSS 0.3%

    Weaknesses in the generation of TCP/UDP source ports and some other header values in Google's gVisor allowed them to be predicted by an external attacker in some circumstances.

  4. 7.1CVE-2025-0218EPSS 0.2%

    When batch jobs are executed by pgAgent, a script is created in a temporary directory and then executed. In versions of pgAgent prior to 4.2.3, an insufficiently seeded random number generator is used when generating the directory name, le…

  5. 5.3CVE-2024-12034EPSS 0.3%

    The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to IP unblocking in all versions up to, and including, 1.25. This is due to the plugin not utilizing a strong unique key when generating an unblock request. This makes it pos…

  6. 7.5CVE-2024-52299EPSS 0.5%

    macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in the wiki as the "key" that is passed to prevent this is computed incorrectly, call…

  7. 9.8CVE-2024-47945EPSS 0.9%

    The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm. The session IDs are predictable, with only 32,768 possible values per user, which allows attackers to pre-generate valid…

  8. 8.0CVE-2024-7558EPSS 0.5%

    JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the J…

  9. 5.3CVE-2024-28957EPSS 0.8%

    Generation of predictable identifiers issue exists in Cente middleware TCP/IP Network Series. If this vulnerability is exploited, a remote unauthenticated attacker may interfere communications by predicting some packet header IDs of the de…

  10. 3.1CVE-2021-29480EPSS 0.3%

    Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the client side session module uses the application startup time as the signing key by default. This means that if an attacker can determine this time, and if …

  11. 3.3CVE-2020-1905EPSS 0.6%

    Media ContentProvider URIs used for opening attachments in other apps were generated sequentially prior to WhatsApp for Android v2.20.185, which could have allowed a malicious third party app chosen to open the file to guess the URIs for p…