Skip to content
Noroxi

CWE-330 · 333 records

Use of Insufficiently Random Values

CVEs in this class

333 records

  • CVE-2018-17888
    48Plan

    NUUO CMS all versions 3.1 and prior, The application uses a session identification mechanism that could allow attackers to obtain the active

    CriticalCVSS 9.8WeaponizedEPSS 30%

    nuuo · nuuo cmsOct 12, 2018

  • CVE-2017-6026
    46Plan

    A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Versi

    CriticalCVSS 9.1Proof of conceptEPSS 32%

    schneider-electric · modicon m251 firmwareJun 29, 2017

  • CVE-2008-2433
    42Plan

    The web management console in Trend Micro OfficeScan 7.0 through 8.0, Worry-Free Business Security 5.0, and Client/Server/Messaging Suite 3.

    CriticalCVSS 9.8No exploitEPSS 11%

    trendmicro · client server messaging suiteAug 27, 2008

  • CVE-2017-16924
    42Plan

    Remote Information Disclosure and Escalation of Privileges in ManageEngine Desktop Central MSP 10.0.137 allows attackers to download unencry

    CriticalCVSS 9.8No exploitEPSS 9%

    zohocorp · manageengine desktop centralFeb 19, 2018

  • CVE-2019-0007
    41Plan

    Junos OS: vMX series: Predictable IP ID sequence numbers vulnerability

    CriticalCVSS 10.0No exploitEPSS 2%

    juniper · junosJan 15, 2019

  • CVE-2008-0087
    40Plan

    The DNS client in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, and Vista uses predictable DNS transaction IDs, which allows

    HighCVSS 7.5No exploitEPSS 32%

    microsoft · windows 2000Apr 8, 2008

  • CVE-2022-36536
    40Plan

    An issue in the component post_applogin.php of Super Flexible Software GmbH & Co.

    CriticalCVSS 9.8WeaponizedEPSS 5%

    syncovery · syncoverySep 15, 2022

  • CVE-2019-7667
    40Plan

    Prima Systems FlexAir, Versions 2.3.38 and prior.

    CriticalCVSS 9.8No exploitEPSS 4%

    primasystems · flexairJul 1, 2019

  • CVE-2019-9898
    40Plan

    Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71.

    CriticalCVSS 9.8No exploitEPSS 4%

    putty · puttyMar 21, 2019

  • CVE-2008-3612
    40Plan

    The Networking subsystem in Apple iPod touch 2.0 through 2.0.2, and iPhone 2.0 through 2.0.2, uses predictable TCP initial sequence numbers,

    CriticalCVSS 9.8No exploitEPSS 4%

    apple · iphone osSep 10, 2008

  • CVE-2021-27200
    40Plan

    In WoWonder 3.0.4, remote attackers can take over any account due to the weak cryptographic algorithm in recover.php.

    CriticalCVSS 9.8No exploitEPSS 3%

    wowonder · wowonderJun 11, 2021

  • CVE-2019-0729
    40Plan

    An Elevation of Privilege vulnerability exists in the way Azure IoT Java SDK generates symmetric keys for encryption, allowing an attacker t

    CriticalCVSS 9.8No exploitEPSS 3%

    microsoft · java software development kitMar 5, 2019

  • CVE-2023-29332
    40Plan

    Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

    CriticalCVSS 9.8No exploitEPSS 3%

    microsoft · azure kubernetes serviceSep 12, 2023

  • CVE-2019-15130
    40Plan

    The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to upload any file type to a candid

    CriticalCVSS 9.8No exploitEPSS 2%

    humanica · humatrix 7Aug 18, 2019

  • CVE-2019-9863
    40Plan

    Due to the use of an insecure algorithm for rolling codes in the ABUS Secvest wireless alarm system FUAA50000 3.01.01 and its remote control

    CriticalCVSS 9.8No exploitEPSS 2%

    abus · secvest wireless alarm system fuaa50000 firmwareMar 27, 2019

  • CVE-2016-5100
    40Plan

    Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the passw

    CriticalCVSS 9.8No exploitEPSS 2%

    froxlor · froxlorFeb 13, 2017

  • CVE-2019-16674
    40Plan

    An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 161

    CriticalCVSS 9.8No exploitEPSS 2%

    weidmueller · ie-sw-pl09m-5gc-4gt firmwareDec 6, 2019

  • CVE-2020-27743
    40Plan

    libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes().

    CriticalCVSS 9.8No exploitEPSS 2%

    pam tacplus project · pam tacplusOct 26, 2020

  • CVE-2014-6311
    40Plan

    generate_doygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attackers to gain elevated p

    CriticalCVSS 9.8No exploitEPSS 2%

    vanderbilt · adaptive communication environmentNov 22, 2019

  • CVE-2020-35926
    39Monitor

    An issue was discovered in the nanorand crate before 0.5.1 for Rust.

    CriticalCVSS 9.8No exploitEPSS 2%

    nanorand project · nanorandDec 31, 2020

  • CVE-2020-9502
    39Monitor

    Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities.

    CriticalCVSS 9.8No exploitEPSS 2%

    dahuasecurity · sd6al firmwareMay 13, 2020

  • CVE-2020-7548
    39Monitor

    A CWE-330 - Use of Insufficiently Random Values vulnerability exists in Smartlink, PowerTag, and Wiser Series Gateways (see security notific

    CriticalCVSS 9.8No exploitEPSS 1%

    schneider-electric · acti9 smartlink si d firmwareDec 1, 2020

  • CVE-2021-36166
    39Monitor

    An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative accou

    CriticalCVSS 9.8No exploitEPSS 1%

    fortinet · fortimailMar 1, 2022

  • CVE-2018-18531
    39Monitor

    text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 us

    CriticalCVSS 9.8No exploitEPSS 1%

    kaptcha project · kaptchaOct 19, 2018

  • CVE-2022-25752
    39Monitor

    A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X

    CriticalCVSS 9.8No exploitEPSS 1%

    siemens · scalance x302-7eec firmwareApr 12, 2022

All vulnerability classes