Information Disclosure

DNS is vulnerable to information disclosure. The vulnerability exists due to the insecure random password generation in the Request function of Request.cs, allowing an attacker to guess the password and spoof the DNS responses...

Information Disclosure

passeo is vulnerable to information disclosure. The vulnerability exists due to the use of insecure random password generation library used in the generate function of init.py, allowing an attacker to guess the password...

Nextcloud: Insecure randomness for default password in file sharing when password policy app is disabled

The password generation function used for protecting shared links in Nextcloud was using an insecure random number generator, which could allow an attacker to access the shared files without knowledge of the password...

Ubuntu: Security Advisory (USN-59-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-29965

The Emerson DeltaV Distributed Control System DCS controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the maintenance port TELNET interface 23/TCP on M-series and SIS CSLS/LSNB/LSNG nodes is controlled by means of utility passwords. These passwords are...

CVE-2022-29965

The Emerson DeltaV Distributed Control System DCS controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the maintenance port TELNET interface 23/TCP on M-series and SIS CSLS/LSNB/LSNG nodes is controlled by means of utility passwords. These passwords are...

PT-2022-3163 · Emerson · Emerson Deltav Distributed Control System

Name of the Vulnerable Software and Affected Versions: Emerson DeltaV Distributed Control System DCS controllers and IO cards through 2022-04-29 Description: The issue concerns the misuse of passwords in the Emerson DeltaV Distributed Control System. Access to privileged operations on the...

CVE-2022-29729

Verizon 4G LTE Network Extender GA4.38 - V0.4.038.2131 utilizes a weak default admin password generation algorithm which generates passwords that are accessible to unauthenticated attackers via the webUI login page...

Apache Syncope uses a weak PNRG

Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack...

GHSA-4C72-MRHF-23CG Apache Syncope uses a weak PNRG

Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack...

MEPSAN USC Plus 安全漏洞

MEPSAN USC Plus is an automation system from MEPSAN Turkey. A security vulnerability exists in the USC+ functionality prior to MEPSAN USC Plus version 3.0. An attacker could generate passwords for highly privileged accounts...

The vulnerability in the web interface for managing server applications used in food industrial enterprises, AK-EM 800, allows a perpetrator to gain unauthorized access to the debugging service.

The vulnerability in the web-based management interface for the server application used to manage food manufacturing enterprises AK-EM 800 is related to errors in password generation. Exploiting this vulnerability can allow an attacker to gain unauthorized access to the debugging service...

Swift Sensors Gateway device password generation authentication bypass vulnerability

Summary An authentication bypass vulnerability exists in the device password generation functionality of Swift Sensors Gateway SG3-1010. A specially-crafted network request can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability. Tested Version...

Swift Sensors Gateway SG3-1010 信任管理问题漏洞

Swift Sensors Gateway SG3-1010 is a gateway for Swift Sensors. The Swift Sensors Gateway SG3-1010 is vulnerable to a trust management issue that stems from an authentication bypass vulnerability in the device password generation function. A specially crafted web request could lead to remote code...

Use of a Broken or Risky Cryptographic Algorithm in x360ce/x360ce

Description The password-generation algorithm used in the function NewPassword simply adds bias to the output password instead of making it easier to remember. Proof of Concept - Use the NewPassword function a large amount of times and store the output. - Look at the frequency of each character o...

WordPress plugin Simple JWT Login 安全特征问题漏洞

WordPress and others are products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language.WordPress plugin is an application plugin.PHP and others are products of.PHP is a scripting language that executes on the server side. A security feature issue...

PT-2021-16397 · WordPress · Simple Jwt Login

Name of the Vulnerable Software and Affected Versions: Simple JWT Login WordPress plugin versions prior to 3.3.0 Description: The issue allows creation of new WordPress user accounts with a randomly generated password. The password generation uses the str shuffle PHP function, which does not...

Use of a Broken or Risky Cryptographic Algorithm in idno/known

Description In the referenced code, known uses an insecure RNG to generate a password because, in its words; this should "mitigate security holes if cleanup fails" - unfortunately, if the cleanup fails - an attacker may be able to predict the password to the created account. Proof of Concept See...

CVE-2021-32033

Protectimus SLIM NFC 70 10.01 devices allow a Time Traveler attack in which attackers can predict TOTP passwords in certain situations. The time value used by the device can be set independently from the used seed value for generating time-based one-time passwords, without authentication. Thus, a...

GHSA-RMW5-XPG9-JR29 Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone

An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limi...