Bluetooth-Attacks-CVE-2025-27840

This paper discusses how an attacker can introduce a hidden list of vulnerabilities through module updates, which can lead to compromise of ESP32 devices and gaining unauthorized access to private keys, affecting billions of devices using this microcontroller. One of the key issues is the...

juniper-cve-2015-7755

Juniper CVE-2015-7755 & CVE-2015-7756 This repository contains notes, binaries, and related information from analysis of the CVE-2015-7755 & CVE-2015-7756 issues within Juniper ScreenOS. For more information about these issues, please see the URLs below:...

CVE-2017-3000

CVE-2017-3000 A full exploit of CVE-2017-3000 on Flash Player Constant Blinding PRNG Insert WANG and wang into dynamically generated code heap in the end...

vuke

vuke Herramienta de investigación para analizar y reproducir la generación vulnerable de claves de Bitcoin. Características Arquitectura modular : fuentes y transformaciones conectables Múltiples fuentes de entrada Rangos numéricos probar semillas débiles Listas de palabras análisis de brainwalle...

debian-ssh

PRNG predecible de OpenSSL de Debian Enlaces URL original: http://metasploit.com/users/hdm/tools/debian-openssl/ Espejo Exploit: https://www.exploit-db.com/exploits/5622/ Perl https://www.exploit-db.com/exploits/5720/ Python https://www.exploit-db.com/exploits/5632/ Ruby Herramienta recomendada:...

sslWeakness

sslWeakness Ejemplo de script que muestra un PRNG débil, CVE-2008-0166...

CVE-2024-29868

CVE-2024-29868: Use of Cryptographically Weak PRNG in Recovery Token Generation This repository contains the proof of concept related to CVE-2024-29868 that affects Apache StreamPipes from v0.69.0 through 0.93.0. Description : Use of Cryptographically Weak Pseudo-Random Number Generator PRNG...

CVE-2024-27632

CVE-2024-27632 Vulnerability Details Overview In Savane v3.12 and prior, the Unix timestamp is used as a seed in the Pseudo-Random Number Generator PRNG used to generate Cross-Site Request Forgery CSRF protection tokens formid. As a result, an attacker may be able to independently generate the sa...

CVE-2026-94456

Postiz generates security-sensitive credentials using Math.random instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8’s...

CVE-2026-94456 Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys

Postiz generates security-sensitive credentials using Math.random instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8’s...

CVE-2026-94456 Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys

Postiz generates security-sensitive credentials using Math.random instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8’s...

weakrng-sweep

weak-rng sweep CVE-2026-71851 class Research tool: enumerates PRNG schemes x uint32 seeds, derives BIP39 wallets, checks membership against a victim address set defensive research, illbloom-style. Schemes: 0-10 illbloom: MT19937/glibc/Java/LCG/xorshift, 11-13 glibc-31 LCG, 14-15 crypto-js 3.3.0...

Spring Boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure.

A flaw was found in Spring Boot. The $random.value property source utilizes a weak pseudo-random number generator PRNG, meaning the values it produces are not sufficiently random for use as cryptographic secrets. An attacker could potentially predict these values, which may lead to information...

OESA-2026-3974 rest security update

This library has been designed to make it easier to access web services that claim to be "RESTful". It comprises of two parts: the first aims to make it easier to make requests by providing a wrapper around libsoup, the second aids with XML parsing by wrapping libxml2. Security Fixes: A flaw was...

CVE-2026-93868 Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG

Cotonti through 1.0.0 derives password recovery validation tokens from md5microtime in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow...

CVE-2026-93868 Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG

Cotonti through 1.0.0 derives password recovery validation tokens from md5microtime in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow...

CVE-2026-93868 Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG

Cotonti through 1.0.0 derives password recovery validation tokens from md5microtime in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow...

CVE-2026-71851

A flaw was found in crypto-js. The CryptoJS.lib.WordArray.random function, used for generating cryptographic secrets, employs a weak pseudorandom number generator instead of a cryptographically secure source. This significantly reduces the randomness of generated values, such as those used for...

CVE-2026-93868: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Cotonti through 1.0.0 derives password recovery validation tokens from md5microtime in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow...

CVE-2026-92913

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairing codes. getRandomCode in objects/functions.php derives the code entirely from uniqid sprintf'%08x%05x', seconds, microseconds...