PT-2021-23101

Name of the Vulnerable Software and Affected Versions keypair versions up to and including 1.0.3 Description The keypair library, a JavaScript RSA PEM key generator, has a poor random number generation issue. This is due to the library not relying entirely on a platform-provided CSPRNG and instea...

CVE-2021-41117: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

keypair is a a RSA PEM key generator written in javascript. keypair implements a lot of cryptographic primitives on its own or by borrowing from other libraries where possible, including node-forge. An issue was discovered where this library was generating identical RSA keys used in SSH. This wou...

CVE-2021-27884

Weak JSON Web Token JWT signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used...

PT-2021-17644

Name of the Vulnerable Software and Affected Versions: YMFE YApi versions 1.9.2 and earlier Description: The issue arises from weak JSON Web Token JWT signing secret generation. This is due to the use of Math.random in Node.js, which does not provide cryptographically secure random numbers,...

CVE-2021-27884: Use of Insufficiently Random Values

Weak JSON Web Token JWT signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used...

CSS paint API: Being predictably random

Take a look at this: Space invaders If you're using a browser that supports the CSS paint API, the element will have a 'random' pixel-art gradient in the background. But it turns out, doing random in CSS isn't as easy as it seems… Initial implementation This isn't a full tutorial on the CSS paint...

Insecure Randomness

firefox is vulnerable to insecure randomness. The vulnerability exists as a flaw was found in the Firefox Math.random function. This function could be used to identify a browsing session and track a user across different websites...

PT-2020-7911

Name of the Vulnerable Software and Affected Versions: node-uuid versions prior to 1.4.4 Description: The issue is related to the generation of GUIDs using insufficiently random data, which could make it easier for attackers to have an unspecified impact via brute force guessing. Affected version...

Huawei EulerOS: Security Advisory for libxslt (EulerOS-SA-2019-1052)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2013-4102

Cryptocat before 2.0.22 strophe.js Math.random Random Number Generator Weakness...

CVE-2013-4102: Use of Insufficiently Random Values

Cryptocat before 2.0.22 strophe.js Math.random Random Number Generator Weakness...

EulerOS Virtualization for ARM 64 3.0.2.0 : libxslt (EulerOS-SA-2019-1625)

According to the versions of the libxslt packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite...

Security Bulletin: Current Releases of IBM® SDK for Node.js™ are affected by CVE-2015-8851

Summary Unsafe fallback to Math.random in module node-uuid, used by the npm package management tool Vulnerability Details CVE-ID: CVE-2015-8851 Description: node.js node-uuid could provide weaker than expected, caused by the use of Math.random instead of a more cryptographically sound source of...

Security Bulletin: node-uuid unsafe fallback to Math.random affects IBM Rational Application Developer for WebSphere Software included in Rational Developer for i and Rational Developer for AIX and Linux (CVE-2015-8851)

Summary Portions of IBM Rational Application Developer for WebSphere Software are shipped as a component of Rational Developer for i RPG and COBOL + Modernization Tools, Java and EGL editions, and Rational Developer for AIX and Linux. A vulnerability in the node-uuid module causes the module to...

Security Bulletin: node-uuid unsafe fallback to Math.random (CVE-2015-8851)

Summary A vulnerability in the node-uuid module causes the module to fallback on math.random under certain circumstances, which leads to predictable UUIDs. The node-uuid module is used by the Node.js Package Manager npm. Vulnerability Details CVEID: CVE-2015-8851 DESCRIPTION: node.js node-uuid...

Unspecified vulnerability in socket.io

socket.io is an application framework that supports real-time two-way traffic. A security vulnerability exists in socket.io that stems from the program's reliance on the 'Math.random' function to create socket IDs, which can be exploited by an attacker to guess the socket ID and gain access to th...

CVE-2017-16031

Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on Math.random to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access to socket.io servers, potentially obtainin...

CVE-2017-16031

Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on Math.random to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access to socket.io servers, potentially obtainin...

CVE-2017-16028

react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically strong RNG Math.random...

CVE-2017-16031

Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on Math.random to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access to socket.io servers, potentially obtainin...