TYPE DE FAIBLESSE

CWE-330

161 CVE, des plus récentes aux plus anciennes. Définition MITRE de CWE-330 (en anglais) →

CVE-2024-21495Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure random number generation library which could… 6.5 MOYENNE

CVE-2024-23688Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally be unique for every message. The node's private key isn't comp… 5.3 MOYENNE

CVE-2023-46740CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to… 6.5 MOYENNE

CVE-2023-32831In wlan driver, there is a possible PIN crack due to use of insufficiently random values. This could lead to local information disclosure with no execution privileges needed. User … 5.5 MOYENNE

CVE-2023-6376Henschen & Associates court document management software does not sufficiently randomize file names of cached documents, allowing a remote, unauthenticated attacker to access restr… 5.3 MOYENNE

CVE-2023-24478Use of insufficiently random values for some Intel Agilex(R) software included as part of Intel(R) Quartus(R) Prime Pro Edition for linux before version 22.4 may allow an authentic… 5.5 MOYENNE

CVE-2023-3373Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior and GOT SIMPLE Series GS21 mode… 5.9 MOYENNE

CVE-2020-36732The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary. 5.3 MOYENNE

CVE-2022-43485 Use of Insufficiently Random Values in Honeywell OneWireless. This vulnerability may allow attacker to manipulate claims in client's JWT token. This issue affects OneWireless vers… 6.2 MOYENNE

CVE-2023-31147c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a… 5.9 MOYENNE

CVE-2023-0343Akuvox E11 contains a function that encrypts messages which are then forwarded. The IV vector and the key are static, and this may allow an attacker to decrypt messages. 6.5 MOYENNE

CVE-2022-26080Use of Insufficiently Random Values vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant.This issue affects Pulsar Plus System Controller NE843_S… 6.3 MOYENNE

CVE-2023-20016A vulnerability in the backup configuration feature of Cisco UCS Manager Software and in the configuration export feature of Cisco FXOS Software could allow an unauthenticated atta… 6.3 MOYENNE

CVE-2023-22912An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. CheckUser TokenManager insecurely uses AES-CTR encryption with a … 5.3 MOYENNE

CVE-2021-26407A randomly generated Initialization Vector (IV) may lead to a collision of IVs with the same key potentially resulting in information disclosure. 5.5 MOYENNE

CVE-2021-4248A vulnerability was found in kapetan dns up to 6.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file DNS/Protocol/Request.cs. Th… 5.6 MOYENNE

CVE-2022-36022Deeplearning4J is a suite of tools for deploying and training deep learning models using the JVM. Packages org.deeplearning4j:dl4j-examples and org.deeplearning4j:platform-tests th… 5.3 MOYENNE

CVE-2022-44795An issue was discovered in Object First Ootbi BETA build 1.0.7.712. A flaw was found in the Web Service, which could lead to local information disclosure. The command that creates … 6.5 MOYENNE

CVE-2022-31008RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryp… 5.5 MOYENNE

CVE-2022-38970ieGeek IG20 hipcam RealServer V1.0 is vulnerable to Incorrect Access Control. The algorithm used to generate device IDs (UIDs) for devices that utilize Shenzhen Yunni Technology iL… 6.5 MOYENNE

CVE-2022-1615In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values. 5.5 MOYENNE

CVE-2022-24406OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter API calls. 6.5 MOYENNE

CVE-2021-23451The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack. 6.5 MOYENNE

CVE-2022-33707Improper identifier creation logic in Find My Mobile prior to version 7.2.24.12 allows attacker to identify the device. 5.3 MOYENNE

CVE-2020-35163Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain a Use of Insufficiently Random Values Vulnerability. 5.3 MOYENNE

CVE-2022-25047The password reset token in CWP v0.9.8.1126 is generated using known or predictable values. 5.9 MOYENNE

CVE-2022-29330Missing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows attackers to access the PJSIP and SIP extension credentials, cryptographic keys and voicemails … 4.9 MOYENNE

CVE-2022-34295totd before 1.5.3 does not properly randomize mesg IDs. 6.5 MOYENNE

CVE-2022-30295uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may lead to DNS cache poisoning. This is related to a reset of a value to 0x2. 6.5 MOYENNE

CVE-2021-41994A misconfiguration of RSA in PingID iOS app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login. 6.6 MOYENNE

CVE-2021-41993A misconfiguration of RSA in PingID Android app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login. 6.6 MOYENNE

CVE-2022-26317A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.29). When returning the result of a completed Microflow execution call the affected … 6.5 MOYENNE

CVE-2022-22700CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource, exposes the response header 'X-CFY-TX-TM'. In certain configurations, that response heade… 5.3 MOYENNE

CVE-2021-38377OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML transformation results. 6.1 MOYENNE

CVE-2021-41061In RIOT-OS 2021.01, nonce reuse in 802.15.4 encryption in the ieee820154_security component allows attackers to break encryption by triggering reboots. 5.5 MOYENNE

CVE-2021-37186A vulnerability has been identified in LOGO! CMR2020 (All versions < V2.2), LOGO! CMR2040 (All versions < V2.2), SIMATIC RTU3010C (All versions < V4.0.9), SIMATIC RTU3030C (All ver… 5.4 MOYENNE

CVE-2021-0417In memory management driver, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional execution privileges n… 5.5 MOYENNE

CVE-2021-39249Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows reflected XSS because the filenames of uploaded files become predictable through a brute-force attack… 6.1 MOYENNE

CVE-2021-3692yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator 5.3 MOYENNE

CVE-2021-25444An IV reuse vulnerability in keymaster prior to SMR AUG-2021 Release 1 allows decryption of custom keyblob with privileged process. 5.5 MOYENNE

CVE-2021-26098An instance of small space of random values in the RPC API of FortiSandbox before 4.0.0 may allow an attacker in possession of a few information pieces about the state of the devic… 5.3 MOYENNE

CVE-2021-27499Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior to 1.7.5,The application layer encryption… 5.9 MOYENNE

CVE-2021-28674The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node (outside of the attacker's perimeter) via an account with wr… 5.4 MOYENNE

CVE-2021-32791mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID … 5.9 MOYENNE

CVE-2021-29480Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the client side session module uses the application startup time as the signing key by default. This… 4.4 MOYENNE

CVE-2021-23020The NAAS 3.x before 3.10.0 API keys were generated using an insecure pseudo-random string and hashing algorithm which could lead to predictable keys. 5.5 MOYENNE

CVE-2020-10729A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for t… 5.5 MOYENNE

CVE-2021-27393A vulnerability has been identified in Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2013.08), Nucleus Source Code (Versions including affected DNS modules). T… 5.3 MOYENNE

CVE-2021-25677A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (… 5.3 MOYENNE

CVE-2021-28055An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. The anti-CSRF token generation is predictable, which might allow CSRF attacks that add an admin user. 6.5 MOYENNE