GHSA-6QQF-VVCR-7QRV Cryptographically Weak PRNG in generate-password

Affected versions of generate-password generate random values that are biased towards certain characters depending on the chosen character sets. This may result in guessable passwords. Recommendation Update to version 1.4.1 or later...

@troveng/trov-web-config (1.0.5), @zce/ghost-cli (>=1.9.7, <=1.9.8) +13 more potentially affected by unknown CVE via generate-password (>=1.3.0, <=1.4.0)

generate-password NPM version =1.3.0, =1.9.7, =1.0.2, =1.16.0, =0.1.4, =0.1.11, =1.4.0, =0.6.0, =0.9.11, =0.0.2, =1.6.0, =4.20.9, =0.9.0, =1.0.79, =1.4.0, =1.11.0 Source cves: unknown CVE Source advisory: OSV:GHSA-6QQF-VVCR-7QRV...

PT-2019-20015

Name of the Vulnerable Software and Affected Versions generate-password versions prior to 1.4.1 Description The issue affects the generation of random passwords, causing them to be biased towards certain characters based on the chosen character sets. This bias can result in passwords that are mor...

PT-2019-5137

Name of the Vulnerable Software and Affected Versions Pallets Werkzeug versions prior to 0.15.3 Description The issue is related to insufficient entropy in the PIN selection of the generate function in the Werkzeug web application library. This can allow a remote attacker to gain unauthorized...

PT-2019-7078

Name of the Vulnerable Software and Affected Versions Ubuntu MAAS versions prior to 1.9.2 Description A vulnerability in the generate filestorage key function of Ubuntu MAAS allows an attacker to brute-force filenames. Recommendations For versions prior to 1.9.2, update to version 1.9.2 or later ...

OFCMS Backend SQL Injection Vulnerability

OFCMS is a content management system based on Java technology. A backend SQL injection vulnerability exists in versions of OFCMS prior to 1.1.3. An attacker can exploit the vulnerability to launch admin/system/generate/create?sql= SQL injection attack...

CVE-2019-9615: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in OFCMS before 1.1.3. It allows admin/system/generate/create?sql= SQL injection, related to SystemGenerateController.java...

PT-2019-19754

Name of the Vulnerable Software and Affected Versions OFCMS versions prior to 1.1.3 Description An issue in OFCMS allows SQL injection, related to the SystemGenerateController.java file. This is specifically exploitable through the "admin/system/generate/create" API endpoint with the sql paramete...

Information Leakage

libxslt is vulnerable to an information leakage. It happens because generate-id function in libxslt/functions.c exposes sensitive information about heap memory addresses...

Cryptographically Weak PRNG

Overview Affected versions of generate-password generate random values that are biased towards certain characters depending on the chosen character sets. This may result in guessable passwords. Recommendation Update to version 1.4.1 or later. References - GitHub Pull - GitHub Advisory...

PT-2018-14972

Name of the Vulnerable Software and Affected Versions Gnuplot version 5.2.5 Description An issue in datafile.c allows an attacker to conduct a heap-based buffer overflow with an arbitrary amount of data in df generate ascii array entry. This can be exploited by passing an overlong string as the...

generate-password.com XSS vulnerability

Open Bug Bounty ID: OBB-692129 Description| Value ---|--- Affected Website:| generate-password.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

GHSA-Q7PF-QR96-2VQ5 Deserialization of Untrusted Data in swagger-parser

A vulnerability in Swagger-Parser's version = 1.0.30 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen = 2.2.2 and can lead to...

One-Lin3r v1.1 - Gives You One-Liners That Aids In Penetration Testing Operations

One-Lin3r is simple and light-weight framework inspired by the web-delivery module in Metasploit. It consists of various one-liners that aids in penetration testing operations: Reverser : Give it IP & port and it returns a reverse shell liner ready for copy & paste. Dropper : Give it an...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15883)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the "Generate Diagnostics" method in Quest DR Series disk backup software versions prior to 4.0.3.1. The vulnerability can be exploited to execute arbitrary system commands via a special...

PT-2018-4537

Name of the Vulnerable Software and Affected Versions Android versions prior to 2018-04-05 security patch level Description A buffer overread issue occurs in the playready leavedomain generate challenge function when the cchFriendlyName is greater than TZ PR MAX NAME LEN. This issue affects Andro...

UBUNTU-CVE-2018-7998

In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vipsregiongenerate function in region.c, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted image file. This occurs because of a race conditi...

PT-2018-18368 · Libvips +3 · Libvips +3

Name of the Vulnerable Software and Affected Versions: libvips versions prior to 8.6.3 Description: A NULL function pointer dereference issue was found in the vips region generate function, which can be exploited by remote attackers using a crafted image file. This issue arises due to a race...

CVE-2017-18032

The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdmgeneratepassword action to wp-admin/admin-ajax.php...

PT-2018-6624

Name of the Vulnerable Software and Affected Versions: WordPress download-manager plugin versions prior to 2.9.52 Description: The issue concerns a security problem where an attacker can exploit the id parameter in a wpdm generate password action to wp-admin/admin-ajax.php API endpoint, leading t...