Weaknesses of type CWE-330

196 results

Uso de valores aleatórios insuficientemente randômicos

A aplicação usa geradores de números aleatórios fracos (como Math.random(), rand() ou seeds previsíveis) para criar tokens, chaves, IVs ou outros valores que precisam ser criptograficamente seguros. Um atacante consegue prever ou reproduzir esses valores, comprometendo a segurança de autenticação, sessão ou criptografia.

Example

Um sistema gera tokens de reset de senha usando Math.random() em JavaScript ou srand(time()) em C, permitindo que um atacante adivinhe o token de outro usuário em poucas tentativas. Outro caso: usar UUID v1 (baseado em timestamp) em vez de UUID v4 (randômico) para criar chaves criptográficas.

How to mitigate

Use geradores de números aleatórios criptograficamente seguros: crypto.getRandomValues() (JS), java.security.SecureRandom (Java), secrets.token_bytes() (Python), ou equivalentes nativos da plataforma. Nunca use time() ou valores previsíveis como seed; confie em /dev/urandom ou APIs de sistema operacional que coletam entropia real.

CVE-2026-25072HIGHXikeStor SKS8310-8X Predictable Session IdentifiersEPSS 0.6%CVE-2024-12432HIGHWPC Shop as a Customer for WooCommerce <= 1.2.8 - Authentication Bypass Due to Insufficiently Unique KeyEPSS 0.6%CVE-2020-27264—In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i and AEPSS 0.5%CVE-2026-92913CRITICALAVideo Weak PRNG Activation Code Authentication BypassEPSS 0.5%CVE-2026-62862CRITICALTypeBot: Account takeover via brute-forceable 6-digit magic-link codeEPSS 0.5%CVE-2026-81852LOWAshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypassEPSS 0.5%CVE-2022-1615—In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values.EPSS 0.5%CVE-2026-94456CRITICALUnauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keysEPSS 0.5%CVE-2024-36389CRITICALMileSight DeviceHub - CWE-330 Use of Insufficiently Random ValuesEPSS 0.5%CVE-2026-14570HIGHCrypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recoveryEPSS 0.5%CVE-2026-114576MEDIUMLinksys RE6250 Web Management strcmp random valuesEPSS 0.5%CVE-2026-19906MEDIUMpkp pkp-lib API Key Generation APIProfileForm.php setData entropyEPSS 0.5%CVE-2026-19748MEDIUMTenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropyEPSS 0.5%CVE-2026-19896MEDIUMmangroup dtale Flask Session Cookie app.py build_secret_key random valuesEPSS 0.5%CVE-2024-10082HIGHCodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication methoEPSS 0.5%CVE-2022-43485MEDIUMInsecure random number used for generating keys for signing Jwt tokensEPSS 0.5%CVE-2025-64097CRITICALNervesHub has Insufficient Token Entropy that Allows Authentication Bypass via Brute ForceEPSS 0.5%CVE-2026-46351HIGHBigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate themEPSS 0.5%CVE-2026-96599HIGHIsotope eCommerce through 2.9.10 Weak Order Identifier GenerationEPSS 0.5%CVE-2026-27755CRITICALSODOLA SL902-SWTGW124AS <= 200.1.20 Predictable Session IDEPSS 0.5%