Skip to content
Noroxi

CWE-335 · 33 records

Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

CVEs in this class

34 records

  • CVE-2017-11519
    40Plan

    passwd_recovery.lua on the TP-Link Archer C9(UN)_V2_160517 allows an attacker to reset the admin password by leveraging a predictable random

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    tp-link · archer c9 \(2.0\) firmwareJul 21, 2017

  • CVE-2019-11495
    40Plan

    In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely.

    CriticalCVSS 9.8No exploitEPSS 2%

    couchbase · couchbase serverSep 10, 2019

  • CVE-2019-10908
    39Monitor

    In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random in

    CriticalCVSS 9.8No exploitEPSS 2%

    airsonic project · airsonicApr 7, 2019

  • CVE-2012-1577
    39Monitor

    lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0.

    CriticalCVSS 9.8No exploitEPSS 2%

    openbsd · openbsdDec 10, 2019

  • CVE-2024-36048
    39Monitor

    QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.

    CriticalCVSS 9.8No exploitEPSS 1%

    qt · qtMay 18, 2024

  • CVE-2023-4472
    39Monitor

    Cryptographically weak PRNG in Opinio 7.22

    CriticalCVSS 9.8No exploitEPSS 1%

    objectplanet · opinioFeb 1, 2024

  • CVE-2021-41117
    37Monitor

    Insecure random number generation

    CriticalCVSS 9.1Proof of conceptEPSS 3%

    keypair project · keypairOct 11, 2021

  • CVE-2018-1426
    37Monitor

    IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system calls when multiple

    CriticalCVSS 9.1No exploitEPSS 2%

    ibm · db2Mar 22, 2018

  • CVE-2018-12520
    35Monitor

    An issue was discovered in ntopng 3.4 before 3.4.180617.

    HighCVSS 8.1Proof of conceptEPSS 11%

    ntop · ntopngJul 5, 2018

  • CVE-2024-27632
    35Monitor

    An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the form_id in the form_header() function.

    HighCVSS 8.8Proof of conceptEPSS 1%

    gnu · savaneApr 8, 2024

  • CVE-2018-14647
    33Monitor

    Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization.

    HighCVSS 7.5No exploitEPSS 11%

    python · pythonSep 25, 2018

  • CVE-2016-3735
    32Monitor

    Piwigo is image gallery software written in PHP.

    HighCVSS 8.1No exploitEPSS 1%

    piwigo · piwigoJan 28, 2022

  • CVE-2024-1579
    32Monitor

    Insufficient seeding of random number generator

    HighCVSS 8.1No exploitEPSS 1%

    secomea · gatemanagerApr 29, 2024

  • CVE-2016-10180
    31Monitor

    An issue was discovered on the D-Link DWR-932B router.

    HighCVSS 7.5No exploitEPSS 5%

    dlink · dwr-932b firmwareJan 30, 2017

  • CVE-2021-27211
    31Monitor

    steghide 0.5.1 relies on a certain 32-bit seed value, which makes it easier for attackers to detect hidden data.

    HighCVSS 7.5Proof of conceptEPSS 3%

    steghide project · steghideFeb 15, 2021

  • CVE-2019-25061
    31Monitor

    The random_password_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due to

    HighCVSS 7.5No exploitEPSS 2%

    random password generator project · random password generatorMay 18, 2022

  • CVE-2020-7010
    30Monitor

    Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator.

    HighCVSS 7.5No exploitEPSS 1%

    elastic · elastic cloud on kubernetesJun 3, 2020

  • CVE-2020-13784
    30Monitor

    D-Link DIR-865L Ax 1.20B01 Beta devices have a predictable seed in a Pseudo-Random Number Generator.

    HighCVSS 7.5No exploitEPSS 1%

    dlink · dir-865l firmwareJun 3, 2020

  • CVE-2017-5214
    30Monitor

    The Codextrous B2J Contact (aka b2j_contact) extension before 2.1.13 for Joomla! allows prediction of a uniqid value based on knowledge of a

    HighCVSS 7.5No exploitEPSS 1%

    codextrous · b2j contactMay 17, 2017

  • CVE-2022-39218
    30Monitor

    Random number seed fixed during compilation

    HighCVSS 7.5No exploitEPSS 1%

    fastly · js-computeSep 20, 2022

  • CVE-2025-24783
    30Monitor

    Apache Cocoon: continuations may not be private

    HighCVSS 7.5No exploitEPSS 1%

    apache · cocoonJan 27, 2025

  • CVE-2025-27580
    30Monitor

    NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, ti

    HighCVSS 7.5Proof of conceptEPSS 1%

    nih · bricsApr 23, 2025

  • CVE-2026-41564
    30Monitor

    CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking

    HighCVSS 7.5No exploitEPSS 1%

    dcit · cryptxApr 23, 2026

  • CVE-2026-11625
    30Monitor

    Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes

    HighCVSS 7.5No exploitEPSS 1%

    davido · bytes::random::secureJun 26, 2026

  • CVE-2026-11702
    30Monitor

    Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes

    HighCVSS 7.5No exploitEPSS 1%

    davido · bytes::random::secure::tinyJun 26, 2026

All vulnerability classes