CVE-2024-52322 WebService::Xero 0.11 for Perl uses insecure rand() function for cryptographic functions

WebService::Xero 0.11 and earlier for Perl uses the rand function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically WebService::Xero uses the Data::Random library which specifically states that it is "Useful mostly for test programs...

CVE-2024-52322

WebService::Xero 0.11 and earlier for Perl uses the non-cryptographically secure rand() as entropy via the Data::Random library, which is described as intended for testing. The vulnerability stems from using a non-cryptographic RNG for cryptographic functions, potentially affecting secrecy of ent...

DEBIAN-CVE-2024-57868

Web::API 2.8 and earlier for Perl uses the rand function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Web::API uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random...

CVE-2024-57835 Amon2::Auth::Site::LINE versions through 0.04 for Perl uses insecure rand() function for cryptographic functions

Amon2::Auth::Site::LINE uses the String::Random module to generate nonce values. String::Random defaults to Perl's built-in predictable random number generator, the rand function, which is not cryptographically secure...

CVE-2024-57835 Amon2::Auth::Site::LINE versions through 0.04 for Perl uses insecure rand() function for cryptographic functions

Amon2::Auth::Site::LINE uses the String::Random module to generate nonce values. String::Random defaults to Perl's built-in predictable random number generator, the rand function, which is not cryptographically secure...

CVE-2024-58036

CVE-2024-58036 affects the Perl module stack Net::Dropbox::API 1.9 and earlier, where cryptographic functions default to using the non-cryptographically secure rand() entropy source. The issue is tied to the use of the Data::Random library by Net::Dropbox::API, which itself notes it is “Useful mo...

CVE-2024-57868 Web::API 2.8 and earlier for Perl uses insecure rand() function for cryptographic functions

Web::API 2.8 and earlier for Perl uses the rand function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Web::API uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random...

PT-2025-15068 · Unknown +1 · Data::Random +1

Name of the Vulnerable Software and Affected Versions: Net::Xero versions 0.044 and earlier Description: The issue concerns the use of the rand function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically, Net::Xero uses the...

PT-2025-15064

Name of the Vulnerable Software and Affected Versions Web::API versions 2.8 and earlier Description The issue concerns the use of a non-cryptographically secure source of entropy for cryptographic functions. Specifically, Web::API uses the Data::Random library, which relies on the rand function...

PT-2025-15065

Name of the Vulnerable Software and Affected Versions WebService::Xero versions 0.11 and earlier Description The issue concerns the use of a non-cryptographically secure source of entropy for cryptographic functions. Specifically, WebService::Xero uses the Data::Random library, which relies on th...

CVE-2025-1860

CVE-2025-1860 concerns Data::Entropy for Perl (versions 0.007 and earlier) which used Perl’s rand() as the default entropy source for cryptographic functions, not cryptographically secure. Connected advisories confirm vendor security updates across multiple distributions: Mageia reports a fix in ...

CVE-2025-1860 Data::Entropy for Perl uses insecure rand() function for cryptographic functions

Data::Entropy for Perl 0.007 and earlier use the rand function as the default source of entropy, which is not cryptographically secure, for cryptographic functions...

CVE-2025-1828

Crypt::Random Perl package 1.05 through 1.55 may use rand function, which is not cryptographically strong, for cryptographic functions. If the Provider is not specified and /dev/urandom or an Entropy Gathering Daemon egd service is not available Crypt::Random will default to use the...

CVE-2025-1828 Perl's Crypt::Random module after 1.05 and before 1.56 may use rand() function for cryptographic functions

Crypt::Random Perl package 1.05 through 1.55 may use rand function, which is not cryptographically strong, for cryptographic functions. If the Provider is not specified and /dev/urandom or an Entropy Gathering Daemon egd service is not available Crypt::Random will default to use the...

CVE-2025-1828

CVE-2025-1828 affects the Crypt::Random Perl package versions 1.05 through 1.55. The vulnerability arises because cryptographic functions may use the non-cryptographically strong rand() function when a provider is not specified and /dev/urandom or an Entropy Gathering Daemon is unavailable; Crypt...

PT-2025-30668

Name of the Vulnerable Software and Affected Versions libssh affected versions not specified Description A flaw exists in libssh, a library implementing the SSH protocol. During the key exchange KEX process, an allocation failure within cryptographic functions can result in a NULL pointer...

RHEL 7 : nss (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - Mozilla NSS: Errors in mpdiv and mpexptmod cryptographic functions CVE-2016-1938 - SSL/TLS: Birthday atta...

RHEL 5 : nss (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - Mozilla NSS: Errors in mpdiv and mpexptmod cryptographic functions CVE-2016-1938 - SSL/TLS: Birthday atta...

Improper Signature Validation

python-jose is vulnerable to Improper Signature Validation. This vulnerability is due to improper verification of OpenSSH ECDSA keys along with other key formats, allowing attackers to bypass security measures or manipulate cryptographic functions by submitting crafted signatures with a specific...

CVE-2024-0394: Rapid7 Minerva Armor Privilege Escalation (FIXED)

Rapid7 is disclosing CVE-2024-0394, a privilege escalation vulnerability in Rapid7 Minerva’s Armor product family. Minerva uses the open-source OpenSSL library for cryptographic functions and to support secure communications. The root cause of this vulnerability is Minerva’s implementation of...