CVE-2024-25389

RT-Thread through 5.0.2 generates random numbers with a weak algorithm of "seed = 214013L seed + 2531011L; return seed 16 & 0x7FFF;" in calcrandom in drivers/misc/rtrandom.c...

CVE-2023-31147 Insufficient randomness in generation of DNS query IDs in c-ares

c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom are unavailable, c-ares uses rand to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand so will generate predictable output. Input from the random number generator i...

GHSA-R4XG-4WRV-W72H Duplicate Advisory: Lemur subject to insecure random generation

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5fqv-mpj8-h7gm. This link is maintained to preserve external references. Original Description Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The...

CVE-2023-30797 Insecure Random Generation in Netflix Lemur

Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur...

Lemur subject to insecure random generation

Overview Lemur was using insecure random generation for its example configuration file, as well as for some utilities. Impact The potentially affected generated items include: | Configuration item | Config option name if applicable | Documentation link if applicable | Rotation option | Code...

PT-2023-14751

Name of the Vulnerable Software and Affected Versions dotCMS core versions 5.3.8.5 through 5.3.8.15 dotCMS core versions 21.03 through 22.10.1 Description An issue was discovered in dotCMS core where a cryptographically insecure random generation algorithm is used for password-reset token...

nonce always remains 0

Handle paulius.eth Vulnerability details Impact a nonce is not actually incremented: nonce.add1; the new value is not assigned to the variable so nonce always remains 0 and has no impact on random generation. Recommended Mitigation Steps Should be: nonce = nonce.add1; --- The text was updated...

randomIndex is not truly random - possibility of predictably minting a specific token Id

Handle @GalloDaSballo Vulnerability details Impact Detailed description of the impact of this finding. randomIndex: Is not random Any miner has access to these values uint index = uintkeccak256abi.encodePackednonce, msg.sender, block.difficulty, block.timestamp % totalSize; Non miner attackers...

Insecure Random Number Generation

cryptiles is vulnerable to insecure random number generation. The application uses the randomDigits method which does not have sufficient entropy to be securely random, allowing an attacker to gain access through a brute-force attack...

CVE-2017-17845

CVE-2017-17845 affects Enigmail (Thunderbird extension) before 1.9.9. The issue is improper random secret generation because Math.Random() is used by pretty Easy privacy (pEp). Impact: potential confidentiality/integrity/availability concerns as per CVSS metrics (base score 7.3–7.5, HIGH). Affect...

Insecure Random Number Generation

github.com/vmware/harbor uses math/rand to generate salt values. This is not cryptographically secure and makes it easier for attackers to brute force the value...

CVE-2016-1902

The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/randomcompat library and the opensslrandompseudobytes function fails, which makes it easier...

DEBIAN-CVE-2007-6755

The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation DualECDRBG algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection...