56 matches found
EulerOS Virtualization for ARM 64 3.0.2.0 : libxslt (EulerOS-SA-2019-1625)
According to the versions of the libxslt packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite...
Security Bulletin: Current Releases of IBM® SDK for Node.js™ are affected by CVE-2015-8851
Summary Unsafe fallback to Math.random in module node-uuid, used by the npm package management tool Vulnerability Details CVE-ID: CVE-2015-8851 Description: node.js node-uuid could provide weaker than expected, caused by the use of Math.random instead of a more cryptographically sound source of...
Security Bulletin: node-uuid unsafe fallback to Math.random affects IBM Rational Application Developer for WebSphere Software included in Rational Developer for i and Rational Developer for AIX and Linux (CVE-2015-8851)
Summary Portions of IBM Rational Application Developer for WebSphere Software are shipped as a component of Rational Developer for i RPG and COBOL + Modernization Tools, Java and EGL editions, and Rational Developer for AIX and Linux. A vulnerability in the node-uuid module causes the module to...
Security Bulletin: node-uuid unsafe fallback to Math.random (CVE-2015-8851)
Summary A vulnerability in the node-uuid module causes the module to fallback on math.random under certain circumstances, which leads to predictable UUIDs. The node-uuid module is used by the Node.js Package Manager npm. Vulnerability Details CVEID: CVE-2015-8851 DESCRIPTION: node.js node-uuid...
Unspecified vulnerability in socket.io
socket.io is an application framework that supports real-time two-way traffic. A security vulnerability exists in socket.io that stems from the program's reliance on the 'Math.random' function to create socket IDs, which can be exploited by an attacker to guess the socket ID and gain access to th...
CVE-2017-16031
Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on Math.random to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access to socket.io servers, potentially obtainin...
CVE-2017-16031
Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on Math.random to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access to socket.io servers, potentially obtainin...
CVE-2017-16031
Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on Math.random to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access to socket.io servers, potentially obtainin...
CVE-2017-16028
react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically strong RNG Math.random...
Design/Logic Flaw
An issue was discovered in Enigmail before 1.9.9. Improper Random Secret Generation occurs because Math.Random is used by pretty Easy privacy pEp, aka TBE-01-001...
CVE-2017-17845
An issue was discovered in Enigmail before 1.9.9. Improper Random Secret Generation occurs because Math.Random is used by pretty Easy privacy pEp, aka TBE-01-001...
CVE-2015-9019
In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs...
CVE-2015-9019
CVE-2015-9019 affects libxslt 1.1.29 and earlier, where the EXSLT math.random function is not initialized with a random seed at startup, which could cause predictable outputs. The Connected Documents confirm this CVE entry and describe the root cause (missing random seed) and the affected version...
Insecure Entropy Source - Math.random()
Overview Affected versions of node-uuid consistently fall back to using Math.random as an entropy source instead of crypto, which may result in guessable UUID's. Recommendation Update to version 1.4.4 or later. References - Issue 108 - Issue 122 - GitHub Advisory...
CVE-2016-1927
The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach...
FreeBSD : phpmyadmin -- Insecure password generation in JavaScript (6f0c2d1b-c60b-11e5-bf36-6805ca0b3d42)
The phpMyAdmin development team reports : Password suggestion functionality uses Math.random which does not provide cryptographically secure random numbers. We consider this vulnerability to be non-critical. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...
phpmyadmin -- Insecure password generation in JavaScript
The phpMyAdmin development team reports: Password suggestion functionality uses Math.random which does not provide cryptographically secure random numbers. We consider this vulnerability to be non-critical...
Google Chrome <= 6.0.472 'Math.Random()' Random Number Generation Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/36185/info Google Chrome is prone to security vulnerability that may allow the application to generate weak random numbers. Successfully exploiting this issue may allow attackers to obtain sensitive information or gain...
Scientific Linux Security Update : firefox on SL5.x i386/x86_64
Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2010-1121, CVE-2010-1200, CVE-2010-1202, CVE-2010-1203 A flaw was...
Apple Safari for Windows (4.0.2-4.0.5, 5.0-5.0.2) Math.random() predictability
Hi list Earlier this year, Trusteer discovered a vulnerability in Apple Safari for Windows versions 4.0.2-4.0.5 and 5.0-5.0.2. The issue is in the Javascript Math.random function, which is implemented in Safari via its WebKit core. Trusteer reported this vulnerability to Apple and to WebKit.org...