CWE-334 Small Space of Random Values
baseThe number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (18)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-39979US | critical9.8OT erhöht | — | ||
There is a vulnerability in MXsecurity versions prior to 1.0.1 that can be exploited to bypass authentication. A remote attacker might access the system if the web service authenti… | ||||
| CVE-2024-31497US | medium5.9 | Exploit | ||
In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures… | ||||
| CVE-2019-7280US | high8.8 | — | ||
Prima Systems FlexAir, Versions 2.3.38 and prior. The session-ID is of an insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a val… | ||||
| CVE-2024-6890US | high8.8OT erhöht | — | ||
Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and c… | ||||
| CVE-2022-24402US | high7.5 | — | ||
The TETRA TEA1 keystream generator implements a key register initialization function that compresses the 80-bit key to only 32 bits for usage during the keystream generation phase,… | ||||
| CVE-2023-1898US | high7.5OT erhöht | — | ||
Atlas Copco Power Focus 6000 web server uses a small amount of session ID numbers. An attacker could enter a session ID number to retrieve data for an active user’s session. | ||||
| CVE-2022-22517US | high7.5OT erhöht | — | ||
An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets. This results in the c… | ||||
| CVE-2021-21955US | high7.5 | — | ||
An authentication bypass vulnerability exists in the get_aes_key_info_by_packetid() function of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. Generic network sniffing… | ||||
| CVE-2020-7566US | high7.3 | — | ||
A CWE-334: Small Space of Random Values vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption keys when the atta… | ||||
| CVE-2022-20941US | medium5.3OT erhöht | — | ||
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to access sensitive inform… | ||||
| CVE-2022-33707US | medium5.3OT erhöht | — | ||
Improper identifier creation logic in Find My Mobile prior to version 7.2.24.12 allows attacker to identify the device. | ||||
| CVE-2026-71851US | — | Exploit | ||
crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the M… | ||||
| CVE-2024-54017US | — | — | ||
A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V11.0), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All versions >= V7.80 < V… | ||||
| CVE-2025-3895US | — | — | ||
Token used for resetting passwords in MegaBIP software are generated using a small space of random values combined with a queryable value.
It allows an unauthenticated attacker wh… | ||||
| CVE-2024-52616US | — | — | ||
A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior f… | ||||
| CVE-2024-51720US | — | — | ||
An insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially en… | ||||
| CVE-2023-6951US | —OT erhöht | — | ||
A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive the WPA2 PSK key and authenticate witho… | ||||
| CVE-2022-42787US | —OT erhöht | — | ||
Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the use… | ||||
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan