CWE-338

Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which i

Formidable (aka node-formidable) 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for un

Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient

Vision UI is a collection of enterprise-grade, dependency-free modules for modern web projects. In versions 1.4.0 and be

Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets.

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-regist

Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the A

The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezo

RT-Thread through 5.0.2 generates random numbers with a weak algorithm of "seed = 214013L * seed + 2531011L; return (see

Mateso PasswordSafe through 8.13.9.26689 has Weak Cryptography.

The Migration, Backup, Staging WordPress plugin before 0.9.106 does not use sufficient randomness in the filename that

The Crypt::Random::Source package before 0.13 for Perl has a fallback to the built-in rand() function, which is not a se

The goTenna Pro ATAK Plugin does not use SecureRandom when generating passwords for sharing cryptographic keys. The ran

The goTenna Pro App does not use SecureRandom when generating passwords for sharing cryptographic keys. The random func

In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521

An HTTP digest authentication nonce value was generated using `rand()` which could lead to predictable values. This vuln

Network Transfer with AES KHT in Thales Luna EFT 2.1 and above allows a user with administrative console access to acces

tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed

EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited

EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited

An issue ingalxe.com Galxe platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentica

CodiMD allows realtime collaborative markdown notes on all platforms. CodiMD before 2.5.4 is missing authentication and

Use of cryptographically weak pseudo-random number generator (PRNG) vulnerability in the SonicWall SMA100 SSLVPN backup

Generation of weak and predictable Initialization Vector (IV) in PMFW (Power Management Firmware) may allow an attacker

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Use of Insufficiently Random Values vulnerability i

The cryptographically insecure random number generator being used in TravianZ 8.3.4 and 8.3.3 in the password reset func

An issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1. A cryptographically insecure

The Motorola MTM5000 series firmwares generate TETRA authentication challenges using a PRNG using a tick count register

Osprey Pump Controller version 1.01 is vulnerable to a weak session token generation algorithm that can be predicted and

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime

Onedev is a self-hosted Git Server with CI/CD and Kanban. In versions prior to 7.9.12 the algorithm used to generate acc

An issue found in IXP Data Easy Install 6.6.148840 allows a remote attacker to escalate privileges via insecure PRNG.

The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Mil

Landscape cryptographic keys were insecurely generated with a weak pseudo-random generator.

Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds beca

An issue was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle. When using Oracle Advanced

Nextcloud server is an open source home cloud implementation. In affected versions the generated fallback password when

A flawed pseudorandom number generator in Dominion Voting Systems ImageCast Precinct (ICP and ICP2) and ImageCast Evolut

An issue was discovered in Object First Ootbi BETA build 1.0.7.712. The authorization service has a flow that allows get

A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretK

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes we

Zulip is an open-source team collaboration tool. Zulip Server installs RabbitMQ for internal message passing. In version

Z-Wave devices from Sierra Designs (circa 2013) and Silicon Labs (using S0 security) may use a known, shared network key

The use of a cryptographically weak pseudo-random number generator in the password reset feature of FortiPortal before 6

Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project i

The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a downlo

OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal

profanity through 1.60 has only four billion possible RNG initializations. Thus, attackers can recover private keys from

A vulnerability in Cisco Unified IP Phones could allow an unauthenticated, remote attacker to impersonate another user's

SSH.NET is a Secure Shell (SSH) library for .NET. In versions 2020.0.0 and 2020.0.1, during an `X25519` key exchange, th