CVE-2025-1796

A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts, by exploiting a weak pseudo-random number generator PRNG used for generating password reset codes. The application uses "random.randint" for this purpose, which is not suitabl...

CVE-2025-1796

CVE-2025-1796 affects langgenius/dify v0.10.1. The root cause is a weak pseudo-random number generator used for password reset codes, implemented via random.randint, which is unsuitable for cryptographic use. An attacker with access to workflow tools can observe PRNG output and predict future res...

CVE-2025-1796 Admin account takeover through weak Pseudo-Random number generator used in generating password reset codes in langgenius/dify

A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts, by exploiting a weak pseudo-random number generator PRNG used for generating password reset codes. The application uses random.randint for this purpose, which is not suitable...

CVE-2025-1796 Admin account takeover through weak Pseudo-Random number generator used in generating password reset codes in langgenius/dify

A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts, by exploiting a weak pseudo-random number generator PRNG used for generating password reset codes. The application uses random.randint for this purpose, which is not suitable...

dify security feature vulnerability

dify is an open source LLM application development platform from LangGenius Open Source. A security feature issue vulnerability exists in dify version v0.10.1 that stems from a weak pseudo-random number generator that could lead to account takeover...

com.squareup.wire:wire-compiler (3.2.1), com.squareup.wire:wire-gradle-plugin (3.2.1) +7 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (3.2.1)

com.squareup.wire:wire-runtime MAVEN version 3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 3.2.1 - com.squareup.wire:wire-gradle-plugin 3.2.1 -...

com.squareup.wire:wire-compiler (2.0.0-beta6), com.squareup.wire:wire-gson-support (2.0.0-beta6) +3 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (2.0.0-beta6)

com.squareup.wire:wire-runtime MAVEN version 2.0.0-beta6 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.0-beta6 - com.squareup.wire:wire-gson-support 2.0.0-beta6...

com.squareup.wire:wire-compiler (3.3.0), com.squareup.wire:wire-gradle-plugin (3.3.0) +8 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (3.3.0)

com.squareup.wire:wire-runtime MAVEN version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 3.3.0 - com.squareup.wire:wire-gradle-plugin 3.3.0 -...

com.squareup.wire:wire-compiler (3.3.0-alpha1), com.squareup.wire:wire-gradle-plugin (3.3.0-alpha1) +8 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (3.3.0-alpha1)

com.squareup.wire:wire-runtime MAVEN version 3.3.0-alpha1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 3.3.0-alpha1 - com.squareup.wire:wire-gradle-plugin...

com.codellyrandom.wiretypescriptgenerator:wire-typescript-generator (0.1.8), com.codellyrandom:wire-typescript-generator (>=0.1.0, <=0.1.8) +44 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (3.7.0)

com.squareup.wire:wire-runtime MAVEN version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.codellyrandom.wiretypescriptgenerator:wire-typescript-generator 0.1.8 -...

com.squareup.wire:wire-compiler (2.0.3), com.squareup.wire:wire-gson-support (2.0.3) +4 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (2.0.3)

com.squareup.wire:wire-runtime MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.3 - com.squareup.wire:wire-gson-support 2.0.3 -...

com.squareup.wire:wire-compiler (2.0.1), com.squareup.wire:wire-gson-support (2.0.1) +4 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (2.0.1)

com.squareup.wire:wire-runtime MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.1 - com.squareup.wire:wire-gson-support 2.0.1 -...

com.squareup.retrofit2:converter-wire (2.0.0-beta3), com.squareup.wire:wire-compiler (2.0.0) +6 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (2.0.0)

com.squareup.wire:wire-runtime MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.retrofit2:converter-wire 2.0.0-beta3 - com.squareup.wire:wire-compiler 2.0.0 -...

com.squareup.wire:wire-compiler (2.0.0-beta9), com.squareup.wire:wire-gson-support (2.0.0-beta9) +4 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (2.0.0-beta9)

com.squareup.wire:wire-runtime MAVEN version 2.0.0-beta9 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.0-beta9 - com.squareup.wire:wire-gson-support 2.0.0-beta9...

com.squareup.wire:wire-compiler (2.0.0-beta8), com.squareup.wire:wire-gson-support (2.0.0-beta8) +4 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (2.0.0-beta8)

com.squareup.wire:wire-runtime MAVEN version 2.0.0-beta8 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.0-beta8 - com.squareup.wire:wire-gson-support 2.0.0-beta8...

com.squareup.wire:wire-compiler (2.0.0-beta7), com.squareup.wire:wire-gson-support (2.0.0-beta7) +3 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (2.0.0-beta7)

com.squareup.wire:wire-runtime MAVEN version 2.0.0-beta7 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.0-beta7 - com.squareup.wire:wire-gson-support 2.0.0-beta7...

com.jiechic.library.wire:wire-gradle-plugin (>=1.0.0, <=1.0.1), com.squareup.wire:wire-codegen-sample (2.1.2) +9 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (2.1.2)

com.squareup.wire:wire-runtime MAVEN version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.jiechic.library.wire:wire-gradle-plugin =1.0.0, =0.6.6, =2.0.0.m5, =2.0.0.m5, =2.0.0.m7 Source...

pktgen: Avoid out-of-bounds access in get_imix_entries

...

MAL-2025-2425 Malicious code in transaction-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 87755b296ad253c8447b95f24b7d6466b841905df1b49006e65716c41887e19d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in transaction-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 87755b296ad253c8447b95f24b7d6466b841905df1b49006e65716c41887e19d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...