CWE-330 Use of Insufficiently Random Values
classThe product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (574)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-5420US | critical9.8OT kritisch | Exploit | ||
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. Thi… | ||||
| CVE-2021-34646US | critical9.8OT hoch | Exploit | ||
Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verification function due to a r… | ||||
| CVE-2018-17888US | critical9.8OT hoch | Exploit | ||
NUUO CMS all versions 3.1 and prior, The application uses a session identification mechanism that could allow attackers to obtain the active session ID, which could allow arbitrary… | ||||
| CVE-2017-6026US | critical9.1OT hoch | Exploit | ||
A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware… | ||||
| CVE-2022-36536US | critical9.8OT hoch | Exploit | ||
An issue in the component post_applogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privileges via creating cra… | ||||
| CVE-2020-11901US | critical9.0OT erhöht | — | ||
The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response. | ||||
| CVE-2020-12712US | high7.5OT erhöht | Exploit | ||
A vulnerability based on insecure user/password encryption in the JOE (job editor) component of SOS JobScheduler 1.12 and 1.13 allows attackers to decrypt the user/password that is… | ||||
| CVE-2009-0255US | high7.5OT erhöht | Exploit | ||
The System extension Install tool in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 creates the encryption key with an insufficiently random seed, which ma… | ||||
| CVE-2008-2433US | critical9.8OT erhöht | — | ||
The web management console in Trend Micro OfficeScan 7.0 through 8.0, Worry-Free Business Security 5.0, and Client/Server/Messaging Suite 3.5 and 3.6 creates a random session token… | ||||
| CVE-2021-40422US | critical10.0OT erhöht | — | ||
An authentication bypass vulnerability exists in the device password generation functionality of Swift Sensors Gateway SG3-1010. A specially-crafted network request can lead to rem… | ||||
| CVE-2020-25705US | high7.4OT erhöht | Exploit | ||
A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively bypass source port UDP… | ||||
| CVE-2017-16924US | critical9.8OT erhöht | — | ||
Remote Information Disclosure and Escalation of Privileges in ManageEngine Desktop Central MSP 10.0.137 allows attackers to download unencrypted XML files containing all data for c… | ||||
| CVE-2009-2158US | high7.5OT erhöht | Exploit | ||
account-recover.php in TorrentTrader Classic 1.09 chooses random passwords from an insufficiently large set, which makes it easier for remote attackers to obtain a password via a b… | ||||
| CVE-2008-0141US | high7.5OT erhöht | Exploit | ||
actions.php in WebPortal CMS 0.6-beta generates predictable passwords containing only the time of day, which makes it easier for remote attackers to obtain access to any account vi… | ||||
| CVE-2002-1463US | high7.5OT erhöht | Exploit | ||
Symantec Raptor Firewall 6.5 and 6.5.3, Enterprise Firewall 6.5.2 and 7.0, VelociRaptor Models 500/700/1000 and 1100/1200/1300, and Gateway Security 5110/5200/5300 generate easily… | ||||
| CVE-2001-1104US | high7.5OT erhöht | Exploit | ||
SonicWALL SOHO uses easily predictable TCP sequence numbers, which allows remote attackers to spoof or hijack sessions. | ||||
| CVE-2000-0916US | high7.5OT erhöht | Exploit | ||
FreeBSD 4.1.1 and earlier, and possibly other BSD-based OSes, uses an insufficient random number generator to generate initial TCP sequence numbers (ISN), which allows remote attac… | ||||
| CVE-2021-0466US | high7.5OT erhöht | Exploit | ||
In startIpClient of ClientModeImpl.java, there is a possible identifier which could be used to track a device. This could lead to remote information disclosure to a proximal attack… | ||||
| CVE-2019-7667US | critical9.8OT erhöht | — | ||
Prima Systems FlexAir, Versions 2.3.38 and prior. The application generates database backup files with a predictable name, and an attacker can use brute force to identify the datab… | ||||
| CVE-2019-0007US | critical10.0OT erhöht | — | ||
The vMX Series software uses a predictable IP ID Sequence Number. This leaves the system as well as clients connecting through the device susceptible to a family of attacks which r… | ||||
04
Angriffsmuster (3)
CAPEC-Angriffsmuster, die dies ausnutzen.
05
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan