CVE-2021-3505: Insufficient Entropy

A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with 1984 bit strength due to a bug in the TCG specification. The bug is in the key creation algorithm in RsaAdjustPrimeCandidate, which is called before the prime number check. The highest threat...

CVE-2021-27378: Incorrect Calculation of Buffer Size

An issue was discovered in the randcore crate before 0.6.2 for Rust. Because readu32into and readu64into mishandle certain buffer-length checks, a random number generator may be seeded with too little data...

GHSA-VJVW-WCMW-PR26 Insufficient Entropy in parsel

All versions of parsel use an insecure key derivation function. The package runs keys of arbitrary lengths through one round of SHA256 hashing for key stretching. This allows for the use of keys of insufficient entropy with inappropriate key stretching. Recommendation The package is deprecated an...

Insufficient Entropy in Spring Security

Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has...

CVE-2020-11957: Insufficient Entropy

The Bluetooth Low Energy implementation in Cypress PSoC Creator BLE 4.2 component versions before 3.64 generates a random number Pairing Random with significantly less entropy than the specified 128 bits during BLE pairing. This is the case for both authenticated and unauthenticated pairing with...

Remote Code Execution (RCE)

serialize-javascript is vulnerable to remote code execution RCE. The attack exists because the deleteFunctions within index.js does not sanitize the objects foo and bar and generates the value of internal UID using Math.random function with insufficient entropy, allowing an attacker to brute forc...

Design/Logic Flaw

reset.php in DomainMOD 4.13.0 uses insufficient entropy for password reset requests, leading to account takeover...

CVE-2020-12735

reset.php in DomainMOD 4.13.0 uses insufficient entropy for password reset requests, leading to account takeover...

CVE-2020-12735

DomainMOD 4.13.0 suffers a vulnerability in reset.php due to insufficient entropy in password reset requests, which can lead to account takeover. Affected component: reset functionality in DomainMOD; root cause described as low-entropy or predictable reset token handling. CVSS data is provided (b...

CVE-2020-12735: Insufficient Entropy

reset.php in DomainMOD 4.13.0 uses insufficient entropy for password reset requests, leading to account takeover...

CVE-2020-1773: Insufficient Entropy

An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, password reset tokens and automatically generated passwords. This issue affects OTRS Community Edition:...

CVE-2019-10064: Insufficient Entropy

hostapd before 2.6, in EAP mode, makes calls to the rand and random standard library functions without any preceding srand or srandom call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743...

CVE-2012-5618

Ushahidi before 2.6.1 has insufficient entropy for forgot-password tokens...

Default credentials

Ushahidi before 2.6.1 has insufficient entropy for forgot-password tokens...

Design/Logic Flaw

ZPanel 10.0.1 has insufficient entropy for its password reset process...

CVE-2012-5686

ZPanel 10.0.1 has insufficient entropy for its password reset process...

CVE-2012-5618: Weak Password Recovery Mechanism for Forgotten Password

Ushahidi before 2.6.1 has insufficient entropy for forgot-password tokens...

CVE-2012-5686: Weak Password Recovery Mechanism for Forgotten Password

ZPanel 10.0.1 has insufficient entropy for its password reset process...

CVE-2015-8851: Insufficient Entropy

node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing...

Insufficient Entropy

Overview Versions of cryptiles prior to 4.1.2 are vulnerable to Insufficient Entropy. The randomDigits method does not provide sufficient entropy and its generates digits that are not evenly distributed. Recommendation Upgrade to version 4.1.2. The package is deprecated and has been moved to...