396 matches found
CVE-2026-18611
The CVE-2026-18611 entry affects the Data Science Pipelines Operator. The root cause is the use of a cryptographically weak pseudo-random number generator to generate credentials (MariaDB root/user passwords and MinIO access/secret keys). An unauthenticated attacker who can access the MinIO Route...
CVE-2026-18611 Data-science-pipelines-operator: dspo: cryptographically weak secret generation (math/rand) for db and s3 credentials
A flaw was found in the Data Science Pipelines Operator. This vulnerability allows an unauthenticated attacker to derive sensitive credentials, such as MariaDB root/user passwords and MinIO access/secret keys, if they can access the MinIO Route or MariaDB Service. The flaw occurs because the...
EUVD-2026-45895
Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography...
CVE-2024-58357
SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time function that panics when unwrap is called on a None result from timestampopt. Authorized clients can repeatedly invoke rand::time to reliably trigger server panics and cause denial of service...
CVE-2024-58359
SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY rand clause. Authorized clients can execute queries with ORDER BY rand to trigger a panic in the sorting function, crashing the server...
EUVD-2024-55676
SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY rand clause. Authorized clients can execute queries with ORDER BY rand to trigger a panic in the sorting function, crashing the server...
CVE-2024-58359
SurrealDB prior to 2.1.0 contains a denial-of-service vulnerability in the sorting path when using ORDER BY rand(). Authorized clients can trigger a panic in the sorting function, crashing the server. The CVE covers SurrealDB versions before 2.1.0; exploitation details, affected versions beyond w...
CVE-2024-58359 SurrealDB before 2.1.0 Denial of Service via rand() Sorting
SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY rand clause. Authorized clients can execute queries with ORDER BY rand to trigger a panic in the sorting function, crashing the server...
CVE-2024-58359
SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY rand clause. Authorized clients can execute queries with ORDER BY rand to trigger a panic in the sorting function, crashing the server...
CVE-2024-58359 SurrealDB before 2.1.0 Denial of Service via rand() Sorting
SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY rand clause. Authorized clients can execute queries with ORDER BY rand to trigger a panic in the sorting function, crashing the server...
CVE-2024-58357 SurrealDB before 2.1.0 Denial of Service via rand::time()
SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time function that panics when unwrap is called on a None result from timestampopt. Authorized clients can repeatedly invoke rand::time to reliably trigger server panics and cause denial of service...
CVE-2024-58357 SurrealDB before 2.1.0 Denial of Service via rand::time()
SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time function that panics when unwrap is called on a None result from timestampopt. Authorized clients can repeatedly invoke rand::time to reliably trigger server panics and cause denial of service...
CVE-2024-58357
SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time function that panics when unwrap is called on a None result from timestampopt. Authorized clients can repeatedly invoke rand::time to reliably trigger server panics and cause denial of service...
CVE-2024-58357 SurrealDB before 2.1.0 Denial of Service via rand::time()
SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time function that panics when unwrap is called on a None result from timestampopt. Authorized clients can repeatedly invoke rand::time to reliably trigger server panics and cause denial of service...
CVE-2024-58357
CVE-2024-58357 affects SurrealDB versions before 2.1.0. The vulnerability is an uncaught exception in the Rust rand::time() function that panics when unwrap is called on a None result from timestamp_opt. Authorized clients can repeatedly invoke rand::time() to trigger server panics, causing denia...
PT-2026-60744
GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a by default six-character string. The built-in rand function is...
JLSEC-2026-689 In the OpenSSL compatibility layer implementation, the function `RAND_poll()` was not behaving as...
In the OpenSSL compatibility layer implementation, the function RANDpoll was not behaving as expected and leading to the potential for predictable values returned from RANDbytes after fork is called. This can lead to weak or predictable random numbers generated in applications that are both using...
CVE-2026-7830 UltraVNC MS-Logon II uses 64-bit Diffie-Hellman and seeded libc rand() enabling credential interception
UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon II authentication scheme rfbUltraVNCMsLogonIIAuth. In rfb/dh.cpp the Diffie-Hellman key exchange is performed with parameters that fit in an unsigned 64-bit integer DHMAXBITS controls the prime size. A 64-bit DH key can be brok...
