MetaCPAN Perl Mojolicious::Plugin::CSRF 安全特征问题漏洞

MetaCPAN Perl Mojolicious::Plugin::CSRF is a CSRF defense plugin from the MetaCPAN Foundation. A security vulnerability exists in MetaCPAN Perl Mojolicious::Plugin::CSRF version 1.03 that stems from the use of a weak random number source to generate CSRF tokens...

WordPress plugin PSW Front-end Login & Registration 安全特征问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security feature issue vulnerabilit...

SUSE CVE-2024-58135

Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default. When creating a default app skeleton with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand...

Insecure Randomness

Formidable is vulnerable to Insecure Randomness. The vulnerability is due to weak randomness due to the use of the non-cryptographically secure hexoid module for generating temporary filenames for untrusted content...

CVE-2021-26091

A use of a cryptographically weak pseudo-random number generator vulnerability in the authenticator of the Identity Based Encryption service of FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to infer parts of users authentication tokens and reset thei...

PT-2025-9879

Name of the Vulnerable Software and Affected Versions Auracast versions prior to SMR Mar-2025 Release 1 Description The issue arises from the use of insufficiently random values in Auracast, allowing adjacent attackers to access Auracast broadcasting. Recommendations For versions prior to SMR...

CVE-2025-1953 vLLM AIBrix Prefix Caching hash.go random values

A vulnerability has been found in vLLM AIBrix 0.2.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file pkg/plugins/gateway/prefixcacheindexer/hash.go of the component Prefix Caching. The manipulation leads to insufficiently random values. The...

Security update for ovmf

This update for ovmf fixes the following issues: CVE-2023-45229: out-of-bounds read in edk2 when processing IANA/IATA options in DHCPv6 Advertise messages. bsc1218879 CVE-2023-45230: buffer overflow in the DHCPv6 client in edk2 via a long Server ID option. bsc1218880 CVE-2023-45231: out-of-bounds...

DEBIAN-CVE-2025-0218

When batch jobs are executed by pgAgent, a script is created in a temporary directory and then executed. In versions of pgAgent prior to 4.2.3, an insufficiently seeded random number generator is used when generating the directory name, leading to the possibility for a local attacker to pre-creat...

UBUNTU-CVE-2024-56830

The Net::EasyTCP package 0.15 through 0.26 for Perl uses Perl's builtin rand if no strong randomization module is present...

BIT-NODE-MIN-2022-35255

A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource in SecretKeyGenTraits::DoKeyGen in src/crypto/cryptokeygen.cc. There are two problems with this: 1 It does not check the return value, it assumes EntropySource always succeeds, but it can a...

php: Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP

A vulnerability was found in PHP where the weak randomness affects applications that use SOAP with HTTP Digest authentication against a possibly malicious server over HTTP allows a remote authenticated attackers to cause a stack information leak...

The vulnerability of the SSL VPN remote access function in Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) allows a attacker to cause a service failure.

The vulnerability of the SSL VPN remote access function in Cisco Adaptive Security Appliance ASA and Cisco Firepower Threat Defense FTD systems is related to the use of insufficiently random values. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

CVE-2024-7315

The Migration, Backup, Staging WordPress plugin before 0.9.106 does not use sufficient randomness in the filename that is created when generating a backup, which could be bruteforced by attackers to leak sensitive information about said backups...

PT-2024-38418 · Canonical +1 · Juju +1

Name of the Vulnerable Software and Affected Versions: juju versions prior to 2.9.51 juju versions prior to 3.1.10 juju versions prior to 3.3.7 juju versions prior to 3.4.6 juju versions prior to 3.5.4 Description: The JUJU CONTEXT ID is a predictable authentication secret. On a Juju machine or...

PT-2024-38261 · WordPress · Migration

Name of the Vulnerable Software and Affected Versions: Migration, Backup, Staging WordPress plugin versions prior to 0.9.106 Description: The issue concerns the insufficient randomness in filenames created during backup generation, which could be bruteforced by attackers to leak sensitive...

wolfSSL 安全漏洞

wolfSSL CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A security vulnerability exists in wolfSSL prior to version 5.7.2, which stems from the use of insufficiently randomized random numbers when generating...

PT-2024-29781 · Fiware · Fiware Keyrock

Name of the Vulnerable Software and Affected Versions: FIWARE Keyrock versions = 8.4 Description: The issue is related to insufficiently random values used for generating password reset tokens, allowing attackers to predict the token and disable two-factor authorization for any user. This makes i...

The vulnerability of the kernel of microprogramming software in embedded Qualcomm chips allows attackers to disclose protected information.

The vulnerability of the kernel of microprogramming software in embedded Qualcomm chips is related to the use of insufficiently random values. Exploiting this vulnerability can allow attackers to disclose protected information...

edk2: Use of a Weak PseudoRandom Number Generator

A security flaw has been identified in the cryptographic system of EDK2, the open-source reference implementation of the UEFI specification. This vulnerability enables an unauthorized remote attacker to potentially expose sensitive information...