326 matches found
CVE-2024-27632
CVE-2024-27632 漏洞详情 概述 在 Savane v3.12 及更早版本中，Unix 时间戳被用作伪随机数生成器 PRNG 的种子，该生成器用于生成跨站请求伪造 CSRF 保护令牌 formid。因此，攻击者可能能够独立生成与被攻击用户分配的相同有效 CSRF 令牌，从而通过 CSRF 检查并导致成功的 CSRF 攻击。CSRF 攻击的影响包括权限提升和帐户接管。 CWE 分类： CWE-335：伪随机数生成器 PRNG 中种子的错误使用 报告者： Ally Petitt 受影响产品 ：Savane 受影响版本 ：3.12 及更早版本 技术细节 在生成 formid...
CVE-2026-22001-SPHINCS-WOTS-Weak-Randomness-Forgeable-Signature
CVE-2026-22001 – Falsificación de Firmas por Aleatoriedad Débil en WOTS+ de SPHINCS+ Resumen Una implementación del esquema de firmas post-cuánticas SPHINCS+ utiliza un generador de números aleatorios defectuoso durante la generación de firmas WOTS+. El mismo nonce k se reutiliza en múltiples...
CVE-2026-62646
A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an...
EUVD-2026-72661
A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an...
CVE-2026-62646
A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an...
CVE-2026-86187
WWBN AVideo generates passwords for external-login accounts using rand instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing...
CVE-2026-82555
A vulnerability has been found in TOTOLINK N600R 4.3.0cu.7866B20220506. This vulnerability affects the function loginAuth of the file /webcste/cgi-bin/cstecgi.cgi of the component Authentication Handler. Such manipulation leads to insufficiently random values. It is possible to launch the attack...
OPENSUSE-SU-2026:21694-1 Security update for librest
This update for librest fixes the following issue: - CVE-2026-16615: PKCE implementation for OAuth authorization uses a cryptographically insecure pseudo-random number generator bsc1272399...
Astra Linux – Vulnerability in node-form-data
The use of insufficiently random values in form-data allows for HTTP Parameter Pollution HPP. This vulnerability is associated with the program file lib/formdata.Js. This issue affects form-data versions: 2.5.4, 3.0.0 – 3.0.3, 4.0.0 – 4.0.3...
python-urwid security update
1.3.1-5 - Use secure random session identifiers in web display CVE-2026-9323 - Resolves: RHEL-212562...
CVE-2026-64964
ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functionality. Due to the use of predictable values related to user registration, an attacker who knows or can predict these values can guess valid account activation...
CVE-2026-19906
A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0. This vulnerability affects the function setData of the file classes/user/form/APIProfileForm.php of the component API Key Generation. Executing a manipulation of the argument apiKey can lead to insufficient entropy. The attack may b...
ejabberd -- Multiple security vulnerabilities
ejabberd team reports: It's possible to craft PLAIN auth request and authenticate as one user, but then open session for different one. modcaps persistent cache can be poisoned by using legacy version requests.This cache was only used to determine list of nodes that should trigger notifications i...
rest security update
An update is available for rest. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The rest packages provide a library for access to the RESTful web services...
RLSA-2026:47085 Important: rest security update
The rest packages provide a library for access to the RESTful web services. Security Fixes: librest: weak random number generation in PKCE implementation CVE-2026-16615 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information,...
RockyLinux 10 : rest (RLSA-2026:47085)
The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:47085 advisory. librest: weak random number generation in PKCE implementation CVE-2026-16615 Tenable has extracted the preceding description block directly from the RockyLinux...
Oracle Linux 10 : rest (ELSA-2026-47085)
The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-47085 advisory. 0.9.1-11.1 - Add patch for CVE-2026-16615 Weak random number generation in PKCE implementation Resolves: RHEL-213749 Tenable has extracted the preceding...
librest: weak random number generation in PKCE implementation
A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer...
Important: Red Hat Security Advisory: rest security update
An update for rest is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...