TYPE DE FAIBLESSE

CWE-331

50 CVE, des plus récentes aux plus anciennes. Définition MITRE de CWE-331 (en anglais) →

CVE-2026-4937Les hyperviseurs IBM PowerVM (versions FW1110, FW1060 et FW950) sont affectés par une faille où certains appels système utilisent une entropie insuffisante lors du chiffrement. Un … 5.3 MOYENNE

CVE-2026-4936Les hyperviseurs IBM PowerVM utilisant certaines versions de firmware présentent une faille dans la manière dont les clés de chiffrement sont générées, ce qui produit des clés AES … 5.1 MOYENNE

CVE-2026-19906Les utilisateurs de la bibliothèque pkp-lib (versions 3.3.0 à 3.5.0) peuvent être affectés par une faille dans la manière dont les clés API sont générées. Un attaquant distant pour… 6.3 MOYENNE

CVE-2025-15629Les contrôleurs TP-Link Omada et les appareils qu'ils gèrent sont affectés par une faiblesse dans la manière dont les clés de chiffrement de session sont générées. Un attaquant dis… 6.9 MOYENNE

CVE-2026-4932Certaines versions de l'hyperviseur IBM PowerVM sont sensibles à une faille où une entropie cryptographique insuffisante fragilise le chiffrement de la mémoire. Un attaquant ayant … 4.2 MOYENNE

CVE-2026-13199Les appareils Raspberry Pi 5 et Compute Module 5 sont touchés par un problème où l'EEPROM génère des graines prévisibles pour le générateur de nombres aléatoires du noyau et la dis… 5.1 MOYENNE

CVE-2025-14972Ce problème affecte les appareils SixG301xxx utilisant le moteur SYMCRYPTO pour les clés KSU. Un attaquant ayant un accès physique au matériel pourrait potentiellement récupérer de… 4.1 MOYENNE

CVE-2026-7210Les applications Python utilisant les modules `xml.parsers.expat` ou `xml.etree.ElementTree` sont vulnérables à une attaque par déni de service. Un attaquant distant non authentifi… 6.3 MOYENNE

CVE-2026-2878Les applications utilisant Progress Telerik UI for AJAX (versions antérieures à 2026.1.225) sont affectées via le composant RadAsyncUpload. Un attaquant non authentifié peut modifi… 5.3 MOYENNE

CVE-2025-0577Les systèmes Linux utilisant la bibliothèque glibc sont concernés s'ils utilisent des fonctions de génération de nombres aléatoires spécifiques lors d'une bifurcation de processus … 4.8 MOYENNE

CVE-2026-2541Le système de sécurité pour véhicule Micca KE700 utilise un code tournant avec une entropie très faible, ne laissant que 64 combinaisons possibles pour une partie essentielle de so… 6.4 MOYENNE

CVE-2026-1814Les versions 6.4.50 et ultérieures de Rapid7 Nexpose utilisent une méthode faible pour générer les nouveaux mots de passe du magasin de clés (keystore), créant ainsi un ensemble li… 6.8 MOYENNE

CVE-2025-32898The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before 1.33.0 on Android, KDE… 4.7 MOYENNE

CVE-2025-59015A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out… 6.3 MOYENNE

CVE-2025-54885Thinbus Javascript Secure Remote Password is a browser SRP6a implementation for zero-knowledge password authentication. In versions 2.0.0 and below, a protocol compliance bug cause… 6.9 MOYENNE

CVE-2025-2814Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.… 4.0 MOYENNE

CVE-2024-56370Net::Xero 0.044 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Ne… 6.5 MOYENNE

CVE-2024-52322WebService::Xero 0.11 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifica… 5.5 MOYENNE

CVE-2024-58036Net::Dropbox::API 1.9 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifica… 5.5 MOYENNE

CVE-2024-57868Web::API 2.8 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Web::… 5.5 MOYENNE

CVE-2025-27552DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes. This vulnerability is associated with program files Crypt/Eksblo… 4.0 MOYENNE

CVE-2025-27551DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes. This vulnerability is associated with program files lib/DBIx/Cla… 4.0 MOYENNE

CVE-2024-9055The DPA countermeasures on Silicon Labs' Series 2 devices are not reseeded periodically as they should be. This may allow an attacker to eventually extract secret keys through a DP… 4.2 MOYENNE

CVE-2024-20331A vulnerability in the session authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defe… 6.8 MOYENNE

CVE-2024-8796Under the default configuration, Devise-Two-Factor versions >= 2.2.0 & < 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum defined by RFC 4226. Us… 6.0 MOYENNE

CVE-2024-38270An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens generation exists in the Zyxel GS1900-10HP … 5.3 MOYENNE

CVE-2023-49927An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 13… 5.3 MOYENNE

CVE-2024-26329Chilkat before v9.5.0.98, allows attackers to obtain sensitive information via predictable PRNG in ChilkatRand::randomBytes function. 6.2 MOYENNE

CVE-2024-22473TRNG is used before initialization by ECDSA signing driver when exiting EM2/EM3 on Virtual Secure Vault (VSE) devices. This defect may allow Signature Spoofing by Key Recreation.Th… 6.8 MOYENNE

CVE-2023-26154Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pub… 5.9 MOYENNE

CVE-2023-38357Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized access to user sessions. 5.3 MOYENNE

CVE-2023-36610 The affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate the software tokens is not initialized correctly, and other … 5.9 MOYENNE

CVE-2020-36732The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary. 5.3 MOYENNE

CVE-2022-20941A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to access sensitive inform… 5.3 MOYENNE

CVE-2022-34746An insufficient entropy vulnerability caused by the improper use of randomness sources with low entropy for RSA key pair generation was found in Zyxel GS1900 series firmware versio… 5.9 MOYENNE

CVE-2022-33989dproxy-nexgen (aka dproxy nexgen) uses a static UDP source port (selected randomly only at boot time) in upstream queries sent to DNS resolvers. This allows DNS cache poisoning bec… 5.3 MOYENNE

CVE-2020-29508Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Improper Input Validation Vulnerability. 5.3 MOYENNE

CVE-2021-31798The effective key space used to encrypt the cache in CyberArk Credential Provider prior to 12.1 has low entropy, and under certain conditions a local malicious user can obtain the … 4.4 MOYENNE

CVE-2021-31797The user identification mechanism used by CyberArk Credential Provider prior to 12.1 is susceptible to a local host race condition, leading to password disclosure. 5.1 MOYENNE

CVE-2021-3505A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification. The bug is in th… 5.5 MOYENNE

CVE-2015-3006On the QFX3500 and QFX3600 platforms, the number of bytes collected from the RANDOM_INTERRUPT entropy source when the device boots up is insufficient, possibly leading to weak or d… 6.5 MOYENNE

CVE-2019-14317wolfSSL and wolfCrypt 4.1.0 and earlier (formerly known as CyaSSL) generate biased DSA nonces. This allows a remote attacker to compute the long term private key from several hundr… 5.3 MOYENNE

CVE-2019-9555Sagemcom F@st 5260 routers using firmware version 0.4.39, in WPA mode, default to using a PSK that is generated from a 2-part wordlist of known values and a nonce with insufficient… 5.3 MOYENNE

CVE-2018-8435A security feature bypass vulnerability exists when Windows Hyper-V BIOS loader fails to provide a high-entropy source, aka "Windows Hyper-V Security Feature Bypass Vulnerability."… 4.2 MOYENNE

CVE-2017-2626It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using the information avai… 5.2 MOYENNE

CVE-2017-2625It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys. On a multi-user system using xdmcp, a local attacker could potentially use inform… 6.5 MOYENNE

CVE-2017-6030A predictable value range from previous values issue was discovered in Schneider Electric Modicon PLCs Modicon M221, firmware versions prior to Version 1.5.0.0, Modicon M241, firmw… 6.5 MOYENNE

CVE-2016-2564Invision Power Services (IPS) Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the more_entropy flag. Attackers can guess an I… 5.9 MOYENNE

CVE-2016-2858QEMU, when built with the Pseudo Random Number Generator (PRNG) back-end support, allows local guest OS users to cause a denial of service (process crash) via an entropy request, w… 6.5 MOYENNE

CVE-2008-1447The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; an… 6.8 MOYENNE