CWE-338 · 187 kayıt
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Bu sınıftaki CVE’ler
187 kayıt
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
51Planlayın | CVE-2008-0166Kavram kanıtı | OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable openssl · openssl · CWE-338 | Yüksek7,5 | — | %70,7 | 13 May 2008 |
46Planlayın | CVE-2009-2367Silahlaştırılmış | cgi-bin/makecgi-pro in Iomega StorCenter Pro generates predictable session IDs, which allows remote attackers to hijack active sessions and iomega · storcenter pro firmware · CWE-338 | Kritik9,8 | — | %23,2 | 8 Tem 2009 |
41Planlayın | CVE-2021-43799Kavram kanıtı | RabbitMQ exposes ports with weak default secrets in Zulip Serverzulip · zulip · CWE-338 | Kritik9,8 | — | %5,4 | 25 Oca 2022 |
40Planlayın | CVE-2019-16303İstismar yok | A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of jhipster · jhipster · CWE-338 | Kritik9,8 | — | %3,7 | 13 Eyl 2019 |
40Planlayın | CVE-2020-28642İstismar yok | In InfiniteWP Admin Panel before 3.1.12.3, resetPasswordSendMail generates a weak password-reset code, which makes it easier for remote attainfinitewp · infinitewp · CWE-338 | Kritik9,8 | — | %2,6 | 15 Kas 2020 |
40Planlayın | CVE-2017-18021İstismar yok | It was discovered that QtPass before 1.2.1, when using the built-in password generator, generates possibly predictable and enumerable passwoqtpass · qtpass · CWE-338 | Kritik9,8 | — | %2,4 | 5 Oca 2018 |
40Planlayın | CVE-2021-3538İstismar yok | A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7satori · uuid · CWE-338 | Kritik9,8 | — | %2,3 | 2 Haz 2021 |
40Planlayın | CVE-2015-9435İstismar yok | The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers.dash10 · oauth server · CWE-338 | Kritik9,8 | — | %2,1 | 25 Eyl 2019 |
39İzleyin | CVE-2011-4574İstismar yok | PolarSSL versions prior to v1.1 use the HAVEGE random number generation algorithm.polarssl · polarssl · CWE-338 | Kritik9,8 | — | %1,1 | 26 Eki 2021 |
39İzleyin | CVE-2024-40762İstismar yok | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the SonicOS SSLVPN authentication token generator that, in certain casonicwall · sonicos · CWE-338 | Kritik9,8 | — | %1,0 | 9 Oca 2025 |
39İzleyin | CVE-2023-36993İstismar yok | The cryptographically insecure random number generator being used in TravianZ 8.3.4 and 8.3.3 in the password reset function allows an attactravianz project · travianz · CWE-338 | Kritik9,8 | — | %1,0 | 7 Tem 2023 |
39İzleyin | CVE-2025-3495İstismar yok | COMMGR - Insufficient Randomization Authentication Bypassdelta electronics · commgr · CWE-338 | Kritik9,8 | — | %0,7 | 15 Nis 2025 |
39İzleyin | CVE-2022-44796İstismar yok | An issue was discovered in Object First Ootbi BETA build 1.0.7.712.objectfirst · ootbi · CWE-338 | Kritik9,8 | — | %0,7 | 7 Kas 2022 |
39İzleyin | CVE-2026-3256İstismar yok | HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session idsktat · http\ · CWE-338 | Kritik9,8 | — | %0,7 | 28 Mar 2026 |
39İzleyin | CVE-2025-59390Kavram kanıtı | Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.apache · druid · CWE-338 | Kritik9,8 | — | %0,6 | 26 Kas 2025 |
39İzleyin | CVE-2026-16235İstismar yok | Crypt::Password versions through 0.28 for Perl generate insecure random values for saltsdrsteve · crypt::password · CWE-338 | Kritik9,8 | — | %0,6 | 20 Tem 2026 |
39İzleyin | CVE-2026-56141İstismar yok | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictjetbrains · hub · CWE-338 | Kritik9,8 | — | %0,5 | 19 Haz 2026 |
39İzleyin | CVE-2025-15604İstismar yok | Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functionstokuhirom · amon2 · CWE-338 | Kritik9,8 | — | %0,5 | 28 Mar 2026 |
39İzleyin | CVE-2026-25726İstismar yok | Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding)cloudreve · cloudreve · CWE-338 | Kritik9,8 | — | %0,5 | 3 Nis 2026 |
39İzleyin | CVE-2025-40926İstismar yok | Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurelykazeburo · plack\ · CWE-338 | Kritik9,8 | — | %0,4 | 4 Mar 2026 |
39İzleyin | CVE-2026-2439İstismar yok | Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session idsbva · concierge\ · CWE-338 | Kritik9,8 | — | %0,4 | 16 Şub 2026 |
39İzleyin | CVE-2026-9205İstismar yok | Langflow is affected by weaknesses in secret handling and sensitive configuration accesslangflow · langflow · CWE-338 | Kritik9,8 | — | %0,4 | 5 Ağu 2026 |
39İzleyin | CVE-2025-15578İstismar yok | Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurelyteejay · maypole · CWE-338 | Kritik9,8 | — | %0,3 | 16 Şub 2026 |
39İzleyin | GHSA-rc7v-65v6-m2v3İstismar yok | Withdrawn Advisory: go-mysql affected by go.uuid's Predictable UUID IdentifiersGo · github.com/go-mysql-org/go-mysql · CWE-338 | Kritik9,8 | — | — | 28 Eki 2024 |
38İzleyin | CVE-2024-29868Kavram kanıtı | Apache StreamPipes, Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generationapache · streampipes · CWE-338 | Kritik9,1 | — | %6,0 | 24 Haz 2024 |
- CVE-2008-016651Planlayın
OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable
YüksekCVSS 7,5Kavram kanıtıEPSS %71openssl · openssl13 May 2008
- CVE-2009-236746Planlayın
cgi-bin/makecgi-pro in Iomega StorCenter Pro generates predictable session IDs, which allows remote attackers to hijack active sessions and
KritikCVSS 9,8SilahlaştırılmışEPSS %23iomega · storcenter pro firmware8 Tem 2009
- CVE-2021-4379941Planlayın
RabbitMQ exposes ports with weak default secrets in Zulip Server
KritikCVSS 9,8Kavram kanıtıEPSS %5zulip · zulip25 Oca 2022
- CVE-2019-1630340Planlayın
A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of
KritikCVSS 9,8İstismar yokEPSS %4jhipster · jhipster13 Eyl 2019
- CVE-2020-2864240Planlayın
In InfiniteWP Admin Panel before 3.1.12.3, resetPasswordSendMail generates a weak password-reset code, which makes it easier for remote atta
KritikCVSS 9,8İstismar yokEPSS %3infinitewp · infinitewp15 Kas 2020
- CVE-2017-1802140Planlayın
It was discovered that QtPass before 1.2.1, when using the built-in password generator, generates possibly predictable and enumerable passwo
KritikCVSS 9,8İstismar yokEPSS %2qtpass · qtpass5 Oca 2018
- CVE-2021-353840Planlayın
A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7
KritikCVSS 9,8İstismar yokEPSS %2satori · uuid2 Haz 2021
- CVE-2015-943540Planlayın
The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers.
KritikCVSS 9,8İstismar yokEPSS %2dash10 · oauth server25 Eyl 2019
- CVE-2011-457439İzleyin
PolarSSL versions prior to v1.1 use the HAVEGE random number generation algorithm.
KritikCVSS 9,8İstismar yokEPSS %1polarssl · polarssl26 Eki 2021
- CVE-2024-4076239İzleyin
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the SonicOS SSLVPN authentication token generator that, in certain ca
KritikCVSS 9,8İstismar yokEPSS %1sonicwall · sonicos9 Oca 2025
- CVE-2023-3699339İzleyin
The cryptographically insecure random number generator being used in TravianZ 8.3.4 and 8.3.3 in the password reset function allows an attac
KritikCVSS 9,8İstismar yokEPSS %1travianz project · travianz7 Tem 2023
- CVE-2025-349539İzleyin
COMMGR - Insufficient Randomization Authentication Bypass
KritikCVSS 9,8İstismar yokEPSS %1delta electronics · commgr15 Nis 2025
- CVE-2022-4479639İzleyin
An issue was discovered in Object First Ootbi BETA build 1.0.7.712.
KritikCVSS 9,8İstismar yokEPSS %1objectfirst · ootbi7 Kas 2022
- CVE-2026-325639İzleyin
HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids
KritikCVSS 9,8İstismar yokEPSS %1ktat · http\28 Mar 2026
- CVE-2025-5939039İzleyin
Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.
KritikCVSS 9,8Kavram kanıtıEPSS %1apache · druid26 Kas 2025
- CVE-2026-1623539İzleyin
Crypt::Password versions through 0.28 for Perl generate insecure random values for salts
KritikCVSS 9,8İstismar yokEPSS %1drsteve · crypt::password20 Tem 2026
- CVE-2026-5614139İzleyin
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predict
KritikCVSS 9,8İstismar yokEPSS %1jetbrains · hub19 Haz 2026
- CVE-2025-1560439İzleyin
Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions
KritikCVSS 9,8İstismar yokEPSS %1tokuhirom · amon228 Mar 2026
- CVE-2026-2572639İzleyin
Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding)
KritikCVSS 9,8İstismar yokEPSS %1cloudreve · cloudreve3 Nis 2026
- CVE-2025-4092639İzleyin
Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely
KritikCVSS 9,8İstismar yokEPSS %0kazeburo · plack\4 Mar 2026
- CVE-2026-243939İzleyin
Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids
KritikCVSS 9,8İstismar yokEPSS %0bva · concierge\16 Şub 2026
- CVE-2026-920539İzleyin
Langflow is affected by weaknesses in secret handling and sensitive configuration access
KritikCVSS 9,8İstismar yokEPSS %0langflow · langflow5 Ağu 2026
- CVE-2025-1557839İzleyin
Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely
KritikCVSS 9,8İstismar yokEPSS %0teejay · maypole16 Şub 2026
- GHSA-rc7v-65v6-m2v339İzleyin
Withdrawn Advisory: go-mysql affected by go.uuid's Predictable UUID Identifiers
KritikCVSS 9,8İstismar yokGo · github.com/go-mysql-org/go-mysql28 Eki 2024
- CVE-2024-2986838İzleyin
Apache StreamPipes, Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation
KritikCVSS 9,1Kavram kanıtıEPSS %6apache · streampipes24 Haz 2024