200 matches found
Design/Logic Flaw
Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...
CVE-2023-31290
Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...
Osprey Pump Controller 1.0.1 Predictable Session Token / Session Hijacking Vulnerabilities
Osprey Pump Controller version 1.0.1 has an ELF binary called MirageCreateSessionCode.x that contains a weak session token generation algorithm that can be predicted and can aid in authentication and authorization bypass attacks. Further, session hijacking is possible due to MitM attack exploitin...
Osprey Pump Controller 1.0.1 Predictable Session Token / Session Hijack
Summary Providing pumping systems and automated controls for golf courses and turf irrigation, municipal water and sewer, biogas, agricultural, and industrial markets. Osprey: door-mounted, irrigation and landscape pump controller. Technology hasn't changed dramatically on pump and electric motor...
K13607: Hosts may generate weak RSA keys under low entropy conditions
Security Advisory Description A recent study, linked in the Supplemental Information section, has revealed that when a system generates new RSA keys under low-entropy conditions, such as during the first system boot, the resulting keys may not be cryptographically strong. During its first boot, t...
SUSE CVE-2014-0691
Cisco WebEx Meetings Server before 1.1 uses meeting IDs with insufficient entropy, which makes it easier for remote attackers to bypass authentication and join arbitrary meetings without a password, aka Bug ID CSCuc79643...
SUSE CVE-2020-28924
An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limi...
libreoffice: Weak Master Keys
A flaw was found in LibreOffice, where the master key was poorly encoded, resulting in weakening its entropy from 128 to 43 bits. This issue makes the stored passwords that are encrypted with a single master key provided by the user vulnerable to a brute force attack if an attacker has access to...
The vulnerability in the web interface of Cisco Firepower Management Center’s software for network management allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the web interface for managing Cisco Firepower Management Center FMC software involves insufficient entropy in resource names. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to protected information by sending specially crafted HTTPS reques...
PT-2022-22313 · Zyxel · Zyxel Gs1900
Name of the Vulnerable Software and Affected Versions: Zyxel GS1900 series firmware versions prior to V2.70 Description: An insufficient entropy issue, caused by the improper use of randomness sources with low entropy for RSA key pair generation, affects the web administration interface. This cou...
PT-2022-23153 · Unknown · Growthbook
Name of the Vulnerable Software and Affected Versions: GrowthBook versions prior to 2022-08-29 Description: GrowthBook is an open-source platform for feature flagging and A/B testing. With some self-hosted configurations, attackers can register new accounts and upload files to arbitrary directori...
CVE-2022-29965
The Emerson DeltaV Distributed Control System DCS controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the maintenance port TELNET interface 23/TCP on M-series and SIS CSLS/LSNB/LSNG nodes is controlled by means of utility passwords. These passwords are...
CVE-2022-29965
The Emerson DeltaV Distributed Control System DCS controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the maintenance port TELNET interface 23/TCP on M-series and SIS CSLS/LSNB/LSNG nodes is controlled by means of utility passwords. These passwords are...
PT-2022-3163 · Emerson · Emerson Deltav Distributed Control System
Name of the Vulnerable Software and Affected Versions: Emerson DeltaV Distributed Control System DCS controllers and IO cards through 2022-04-29 Description: The issue concerns the misuse of passwords in the Emerson DeltaV Distributed Control System. Access to privileged operations on the...
GHSA-W8CC-3H7Q-JHC3 Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data...
Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data...
CVE-2021-31798
The effective key space used to encrypt the cache in CyberArk Credential Provider prior to 12.1 has low entropy, and under certain conditions a local malicious user can obtain the plaintext of cache files...
CVE-2021-31798
The effective key space used to encrypt the cache in CyberArk Credential Provider prior to 12.1 has low entropy, and under certain conditions a local malicious user can obtain the plaintext of cache files...
PT-2021-23607 · Softwarex · Softwarex
Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to 1.1.1 Description: Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least o...
The vulnerability of the rand() and random() functions in software certification for wireless network WPA devices, related to the lack of entropy in PIN selection, allows a hacker to trigger a service failure.
The vulnerability of the rand and random functions in software device certification for wireless networks with WPA security is related to a lack of entropy in the PIN selection process. Exploiting this vulnerability could allow an attacker to trigger a service failure...