270 matches found
CVE-2022-33738
OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal...
Design/Logic Flaw
OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal...
CVE-2022-33738
The CVE-2022-33738 entry concerns OpenVPN Access Server prior to version 2.11, where a weak random generator is used to create user session tokens for the web portal. This weak RNG could potentially compromise session tokens, impacting authentication for the portal. The connected sources corrobor...
CVE-2022-33738
OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal...
The vulnerability of Cisco Unified IP Phones’ microprogramming software lies in errors in the code for generating pseudo-random numbers. This allows attackers to impersonate another user’s phone.
The vulnerability of Cisco Unified IP Phones’ microprogrammed software is related to errors in the code of the pseudorandom number generator. Exploiting this vulnerability can allow an attacker to impersonate another user’s phone...
CVE-2022-31034 Insecure entropy in argo-cd
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v0.11.0 are vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or UI. The vulnerabilities are due to the use of insufficiently random values in...
CVE-2021-36171
The use of a cryptographically weak pseudo-random number generator in the password reset feature of FortiPortal before 6.0.6 may allow a remote unauthenticated attacker to predict parts of or the whole newly generated password within a given time frame...
CVE-2021-36171
The use of a cryptographically weak pseudo-random number generator in the password reset feature of FortiPortal before 6.0.6 may allow a remote unauthenticated attacker to predict parts of or the whole newly generated password within a given time frame...
Fortinet FortiPortal 安全特征问题漏洞
Fortinet FortiPortal is an advanced, feature-rich managed security analysis and management support tool for Fortinet's FortiGate, FortiWiFi, and FortiAP product lines, available as a virtual machine for use by MSPs. versions, a security feature issue vulnerability exists that stems from the use o...
Cryptographic Issues in ECK
Elastic Cloud on Kubernetes ECK versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK...
Mageia: Security Advisory (MGASA-2020-0469)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Mautic 安全特征问题特征问题漏洞
Mautic is an open source marketing automation software. The software monitors and manages websites, sends emails and manages customer resources. mautic versions prior to 3.3.4 and versions prior to 4.0.0 are vulnerable to a security feature issue that stems from the mtrand function in the softwar...
CVE-2021-3047
A cryptographically weak pseudo-random number generator PRNG is used during authentication to the Palo Alto Networks PAN-OS web interface. This enables an authenticated attacker, with the capability to observe their own authentication secrets over a long duration on the PAN-OS appliance, to...
CVE-2021-37553
In JetBrains YouTrack before 2021.2.16363, an insecure PRNG was used...
wolfssl
This repository is an implementation of the wolfSSL library, a cryptographic library for secure communication. The library is designed to be used with various platforms, including Arduino, and provides a range of cryptographic functions for secure data transmission. The repository contains a...
CVE-2020-26556
A flaw was found in the Linux kernel’s authentication protocol in the Bluetooth® Mesh Profile Specification. A vulnerability occurs if the AuthValue is identified during the provisioning procedure, even if the AuthValue is selected randomly. This flaw allows an attacker to identify the AuthValue...
PT-2021-24354 · Consensys · Consensys Discovery
Name of the Vulnerable Software and Affected Versions: Consensys Discovery versions less than 0.4.5 Description: The issue arises from Consensys Discovery using the same AES/GCM nonce for the entire session, which should ideally be unique for every message. This can lead to the leaking of the...
MGASA-2020-0469 Updated mbedtls packages fix security vulnerabilities
This update provides security bug fixes and minor enhancements. Limit the size of calculations performed by mbedtlsmpiexpmod to MBEDTLSMPIMAXSIZE to prevent a potential denial of service when generating Diffie-Hellman key pairs. A failure of the random generator was ignored in mbedtlsmpifillrando...
Updated mbedtls packages fix security vulnerabilities
This update provides security bug fixes and minor enhancements. Limit the size of calculations performed by mbedtlsmpiexpmod to MBEDTLSMPIMAXSIZE to prevent a potential denial of service when generating Diffie-Hellman key pairs. A failure of the random generator was ignored in mbedtlsmpifillrando...
kernel: information exposure in drivers/char/random.c and kernel/time/timer.c
A flaw was found in the Linux kernel. The generation of the device ID from the network RNG internal state is predictable. The highest threat from this vulnerability is to data confidentiality...