CVE-2025-47781

Rallly is an open-source scheduling and collaboration tool. Versions up to and including 3.22.1 of the application features token based authentication. When a user attempts to login to the application, they insert their email and a 6 digit code is sent to their email address to complete the...

PT-2025-21179 · Rallly · Rallly

Name of the Vulnerable Software and Affected Versions: Rallly versions up to and including 3.22.1 Description: The issue concerns the token-based authentication mechanism in Rallly, an open-source scheduling and collaboration tool. When a user attempts to log in, a 6-digit code is sent to their...

SUSE CVE-2024-58036

Net::Dropbox::API 1.9 and earlier for Perl uses the rand function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Net::Dropbox::API uses the Data::Random library which specifically states that it is "Useful mostly for test...

Linux Distros Unpatched Vulnerability : CVE-2017-2625

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys. On a multi-user system using xdmcp, a local attacker could...

Linux Distros Unpatched Vulnerability : CVE-2017-2626

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using...

Rittal IoT Interface & CMC III Processing Unit 安全漏洞

The Rittal IoT Interface & CMC III Processing Unit is a key component of Rittal Germany's Smart Networking of Sensors for monitoring physical environmental conditions. A security vulnerability exists in Rittal IoT Interface & CMC III Processing Unit versions prior to 6.21.00.2, which stems from a...

CVE-2024-20509

A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to hijack an AnyConnect VPN session or cause a denial of service DoS condition for individual users of the AnyConnect VPN...

Cisco AnyConnect VPN 安全漏洞

Cisco AnyConnect VPN is a virtual private network VPN client from Cisco that supports remote users connecting to corporate networks via SSL VPN and IPSec VPN. Cisco AnyConnect VPN suffers from a security vulnerability that stems from a weak entropy value of the handler used in the VPN...

Cisco AnyConnect VPN 资源管理错误漏洞

Cisco AnyConnect VPN is a virtual private network VPN client from Cisco that supports remote users connecting to corporate networks via SSL VPN and IPSec VPN. Cisco AnyConnect VPN suffers from a Resource Management Error vulnerability that stems from a weak entropy value of the handler used in th...

Cisco AnyConnect VPN 竞争条件问题漏洞

Cisco AnyConnect VPN is a virtual private network VPN client from Cisco that supports remote users connecting to corporate networks via SSL VPN and IPSec VPN. Cisco AnyConnect VPN suffers from a Competitive Condition Issue vulnerability that stems from a weak entropy value of the handler used in...

Cisco Meraki Z和Cisco Meraki MX 缓冲区错误漏洞

The Cisco Meraki Z and Cisco Meraki MX are both products of Cisco, Inc.The Cisco Meraki Z is an enterprise-class firewall, VPN gateway, and router.The Cisco Meraki MX is a multifunction security and SD-WAN enterprise appliance. A buffer error vulnerability exists in the Cisco Meraki Z and Cisco...

Cisco AnyConnect VPN 缓冲区错误漏洞

Cisco AnyConnect VPN is a virtual private network VPN client from Cisco that supports remote users connecting to corporate networks via SSL VPN and IPSec VPN. Cisco AnyConnect VPN suffers from a buffer error vulnerability that stems from a weak entropy value of the handler used in the VPN...

Cisco AnyConnect VPN 资源管理错误漏洞

Cisco AnyConnect VPN is a virtual private network VPN client from Cisco that supports remote users connecting to corporate networks via SSL VPN and IPSec VPN. Cisco AnyConnect VPN suffers from a Resource Management Error vulnerability that stems from a weak entropy value of the handler used in th...

Cisco Meraki Z和Cisco Meraki MX 资源管理错误漏洞

The Cisco Meraki Z and Cisco Meraki MX are both products of Cisco, Inc.The Cisco Meraki Z is an enterprise-class firewall, VPN gateway, and router.The Cisco Meraki MX is a multifunction security and SD-WAN enterprise appliance. A resource management error vulnerability exists in the Cisco Meraki ...

RHEL 5 : libxdmcp (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - libXdmcp: weak entropy usage for session keys CVE-2017-2625 Note that Nessus has not tested for this issue but has...

RHEL 6 : libxdmcp (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - libXdmcp: weak entropy usage for session keys CVE-2017-2625 Note that Nessus has not tested for this issue but has...

Weak Entropy In Token Generation

friendsofsymfony/user-bundle is vulnerable to Weak Entropy in Token Generation. The vulnerability is due to the imprecise nature of the baseconvert function used in FOSUserBundle, which allows attackers to exploit the weakened randomness of tokens generated for email confirmation and password...

jose4j: Insecure iteration count setting

A flaw was found in Jose4J which allows a malicious user or internal person to erroneously set a low iteration count of 1000 or less to secure the Json Web Token. This could apply to lack of entropy and leave the system less secure...

CVE-2023-39910

The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use of an mt19937 Mersenne Twister PRNG restricts the internal entropy to 32 bits regardless of settings. This allows remote attackers to recover any wallet...

CVE-2023-39910

The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use of an mt19937 Mersenne Twister PRNG restricts the internal entropy to 32 bits regardless of settings. This allows remote attackers to recover any wallet...