546 matches found
CVE-2021-46010: Use of Insufficiently Random Values
Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration. The SESSIONID is predictable. An attacker can hijack a valid session and conduct further malicious operations...
CVE-2021-36166: Use of Insufficiently Random Values
An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative account's authentication token by means of the observation of certain system's properties...
Schneider Electric Modicon Controllers Use of Insufficiently Random Values (CVE-2019-6821)
CWE-330: Use of Insufficiently Random Values vulnerability, which could cause the hijacking of the TCP connection when using Ethernet communication in Modicon M580 firmware versions prior to V2.30, and all firmware versions of Modicon M340, Modicon Premium, Modicon Quantum. This plugin only works...
CVE-2021-24998: Use of Insufficiently Random Values
The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the strshuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic...
CVE-2021-45487: Use of Insufficiently Random Values
In NetBSD through 9.2, the IPv4 ID generation algorithm does not use appropriate cryptographic measures...
The vulnerability of the VMware InstallBuilder development and automatic installer tool for Windows operating systems arises from the use of insufficiently random values. This allows a malicious individual to exploit their privileges.
The vulnerability of the VMware InstallBuilder tool for developing and automating installer installations on Windows operating systems is related to the use of insufficiently random values. Exploiting this vulnerability could allow a remote attacker to gain increased privileges...
CVE-2021-26322: Use of Insufficiently Random Values
Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”...
CVE-2021-28024: Use of Insufficiently Random Values
Unauthorized system access in the login form in ServiceTonic Helpdesk software version 9.0.35937 allows attacker to login without using a password...
CVE-2021-22038: Use of Insufficiently Random Values
On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed the originally called uninstaller exits, so it does not block the installation directory. This temporary location is not randomized and does not restrict access to Administrators only so a...
CVE-2021-41829: Use of Insufficiently Random Values
Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number to calculate a certain encryption key...
CVE-2021-37186: Use of Insufficiently Random Values
A vulnerability has been identified in LOGO! CMR2020 All versions V2.2, LOGO! CMR2040 All versions V2.2, SIMATIC RTU3010C All versions V4.0.9, SIMATIC RTU3030C All versions V4.0.9, SIMATIC RTU3031C All versions V4.0.9, SIMATIC RTU3041C All versions V4.0.9. The underlying TCP/IP stack does not...
Siemens LOGO! CMR and SIMATIC RTU 3000 (Update A)
1. EXECUTIVE SUMMARY CVSS v3 5.4 ATTENTION: Low attack complexity Vendor: Siemens Equipment: LOGO! CMR, SIMATIC RTU 3000 Vulnerability: Use of Insufficiently Random Values 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-21-257-13 Siemens LOGO! CMR...
The vulnerability of microprogrammed software in Schneider Electric’s programmable logic controllers Modicon M221, M100, and M200 lies in the small number of possible random values. This allows attackers to circumvent existing security restrictions by using brute-force attacks.
The vulnerability of the microprogrammed logic controllers from Schneider Electric, such as Modicon M221, M100, and M200, is related to the small number of possible random values. Exploiting this vulnerability can allow a malicious actor to bypass existing security restrictions by using brute-for...
The vulnerability of the communication interface for Smartlink modular equipment, the microprogrammed wireless energy sensor PowerTag, and Wiser controllers, related to the use of insufficiently random values, allows intruders to gain increased privileges.
The vulnerability of the communication interface for Smartlink module equipment, the microprogrammed wireless energy sensor PowerTag, and Wiser controllers is related to the use of insufficiently random values. Exploiting this vulnerability could allow a remote attacker to exploit the system...
CVE-2020-35685: Use of Insufficiently Random Values
An issue was discovered in HCC Nichestack 3.0. The code that generates Initial Sequence Numbers ISNs for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of current and future TCP connections and either hijack existing...
CVE-2021-31228: Use of Insufficiently Random Values
An issue was discovered in HCC embedded InterNiche 4.0.1. This vulnerability allows the attacker to predict a DNS query's source port in order to send forged DNS response packets that will be accepted as valid answers to the DNS client's requests without sniffing the specific request. Data is...
CVE-2021-38606: Use of Insufficiently Random Values
reNgine through 0.5 relies on a predictable directory name...
CVE-2021-26098
An instance of small space of random values in the RPC API of FortiSandbox before 4.0.0 may allow an attacker in possession of a few information pieces about the state of the device to possibly predict valid session IDs...
CVE-2021-26098: Use of Insufficiently Random Values
An instance of small space of random values in the RPC API of FortiSandbox before 4.0.0 may allow an attacker in possession of a few information pieces about the state of the device to possibly predict valid session IDs...
CVE-2021-28674: Use of Insufficiently Random Values
The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node outside of the attacker's perimeter via an account with write permissions. This occurs because node IDs are predictable with incrementing numbers and the access control on...