270 matches found
SonicWALL SonicOS 安全漏洞
SonicWALL SonicOS is an operating system designed for SonicWall firewall appliances from SonicWALL Inc. in the United States. A security vulnerability exists in SonicWALL SonicOS that stems from the use of a cryptographically weak pseudo-random number generator PRNG in the authentication token...
PT-2025-3788 · Pgagent +1 · Pgagent +1
Name of the Vulnerable Software and Affected Versions: pgAgent versions prior to 4.2.3 Description: The issue arises when pgAgent executes batch jobs, creating a script in a temporary directory before execution. In affected versions, an insufficiently seeded random number generator is used to...
CVE-2002-20002
The Net::EasyTCP package before 0.15 for Perl always uses Perl's builtin rand, which is not a strong random number generator, for cryptographic keys...
Vulnerabilities fixed in SonicWall SMA100 SSLVPN
SonicWall has fixed vulnerabilities in the SMA100 SSLVPN Specifically for firmware versions 10.2.1.13-72sv and earlier. The vulnerabilities in the SonicWall SMA100 SSLVPN include a heap-based buffer overflow, a stack-based buffer overflow, and a problem with the certificate requirement during...
CVE-2024-53702
Use of cryptographically weak pseudo-random number generator PRNG vulnerability in the SonicWall SMA100 SSLVPN backup code generator that, in certain cases, can be predicted by an attacker, potentially exposing the generated secret...
PT-2024-9234 · Sonicwall · Sonicwall Sma100
Name of the Vulnerable Software and Affected Versions: SonicWall SMA100 series affected versions not specified Description: The issue is related to the use of a cryptographically weak pseudo-random number generator PRNG in the SonicWall SMA100 SSLVPN backup code generator. This weakness can be...
SUSE CVE-2024-53085
In the Linux kernel, the following vulnerability has been resolved: tpm: Lock TPM chip in tpmpmsuspend first Setting TPMCHIPFLAGSUSPENDED in the end of tpmpmsuspend can be racy according, as this leaves window for tpmhwrngread to be called while the operation is in progress. The recent bug report...
kernel: x86/coco: Require seeding RNG with RDRAND on CoCo systems
CVE-2024-35875 addresses a security concern in the Linux kernel's handling of confidential computing CoCo environments. In these setups, the virtual machine VM host is untrusted and may attempt to compromise guest VMs. A critical component for maintaining security in such environments is a reliab...
GO-2024-2431 Insecure random string generator used for sensitive data in github.com/cubefs/cubefs
Insecure random string generator used for sensitive data in github.com/cubefs/cubefs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners...
PT-2024-23092 · Apache · Apache Streampipes
Name of the Vulnerable Software and Affected Versions: Apache StreamPipes versions 0.69.0 through 0.93.0 Description: The issue is related to the use of a cryptographically weak pseudo-random number generator PRNG in the user self-registration and password recovery mechanism. This allows an...
Qt 安全漏洞
Qt is a cross-platform C++ application development framework from the Norwegian company Qt. It is widely used to develop GUI programs, in which case it is also known as the widget toolkit. It can also be used to develop non-GUI programs, such as console tools and servers. A security vulnerability...
USN-6774-1 linux, linux-aws, linux-aws-6.5, linux-azure, linux-azure-6.5, linux-gcp, linux-gcp-6.5, linux-hwe-6.5, linux-laptop, linux-lowlatency, linux-lowlatency-hwe-6.5, linux-nvidia-6.5, linux-oem-6.5, linux-oracle, linux-oracle-6.5, linux-raspi, linux-signed, linux-signed-aws, linux-signed-aws-6.5, linux-starfive, linux-starfive-6.5 vulnerabilities
Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service system crash. CVE-2023-47233 Sander...
USN-6765-1 linux-oem-6.5 vulnerabilities
Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly validate H2C PDU data, leading to a null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service system crash. CVE-2023-6356, CVE-2023-6535, CVE-2023-6536 Sander...
PuTTY 安全漏洞
PuTTY is a suite of free Telnet, Rlogin, and SSH client software from the individual developer Simon Tatham. The software is primarily used for remote administration of Linux systems. A security vulnerability exists in PuTTY versions 0.68 through 0.80, which stems from the presence of biased rand...
PT-2024-21352 · Chilkat · Chilkat
Name of the Vulnerable Software and Affected Versions: Chilkat versions prior to 9.5.0.98 Description: The issue allows attackers to obtain sensitive information via a predictable PRNG in the ChilkatRand::randomBytes function. Recommendations: For versions prior to 9.5.0.98, update to version...
PT-2024-13199 · Objectplanet · Objectplanet Opinio
Name of the Vulnerable Software and Affected Versions: Objectplanet Opinio versions 7.22 and prior Description: The issue is related to the use of a cryptographically weak pseudo-random number generator PRNG coupled to a predictable seed, which could lead to an unauthenticated account takeover of...
The vulnerability of the NetRandomInitSeed() function in the Tianocore edk2 library, which allows a hacker to gain unauthorized access to protected information or cause service failures.
The vulnerability of the NetRandomInitSeed function in the Tianocore edk2 library is related to errors in the code of the pseudo-random number generator when processing the Seed parameter. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or...
CubeFS Security Feature Issue Vulnerability
CubeFS is a cloud-native file storage for CubeFS individual developers. A security signature issue vulnerability exists in versions prior to CubeFS 3.3.1 that stems from the use of an insecure random string generator to generate user-specific sensitive keys. An attacker can escalate privileges by...
Fides Security Vulnerabilities
Fides is an open source privacy engineering platform for managing the implementation of data privacy requests in the runtime environment and the enforcement of privacy regulations in code. A security vulnerability exists in versions of Fides prior to 2.24.0 that stems from the use of a weakly...
