Weaknesses of type CWE-330

179 results

Uso de valores aleatórios insuficientemente randômicos

A aplicação usa geradores de números aleatórios fracos (como Math.random(), rand() ou seeds previsíveis) para criar tokens, chaves, IVs ou outros valores que precisam ser criptograficamente seguros. Um atacante consegue prever ou reproduzir esses valores, comprometendo a segurança de autenticação, sessão ou criptografia.

Example

Um sistema gera tokens de reset de senha usando Math.random() em JavaScript ou srand(time()) em C, permitindo que um atacante adivinhe o token de outro usuário em poucas tentativas. Outro caso: usar UUID v1 (baseado em timestamp) em vez de UUID v4 (randômico) para criar chaves criptográficas.

How to mitigate

Use geradores de números aleatórios criptograficamente seguros: crypto.getRandomValues() (JS), java.security.SecureRandom (Java), secrets.token_bytes() (Python), ou equivalentes nativos da plataforma. Nunca use time() ou valores previsíveis como seed; confie em /dev/urandom ou APIs de sistema operacional que coletam entropia real.

CVE-2024-47187HIGHSuricata datasets: missing hashtable random seed leads to potential DoSEPSS 0.3%CVE-2026-27490HIGHCombodo iTop: Weak secret generation for inline imageEPSS 0.3%CVE-2024-5868MEDIUMWooCommerce - Social Login <= 2.6.2 - Email Verification due to Insufficient RandomnessEPSS 0.3%CVE-2026-40975MEDIUMValues produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} shoEPSS 0.3%CVE-2026-19896MEDIUMmangroup dtale Flask Session Cookie app.py build_secret_key random valuesEPSS 0.3%CVE-2026-19748MEDIUMTenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropyEPSS 0.3%CVE-2026-81852LOWAshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypassEPSS 0.3%CVE-2026-42155CRITICALMagento LTS: Weak API Session ID — Predictable MD5 of Time-Derived InputsEPSS 0.3%CVE-2026-84606HIGHA privacy issue was addressed with improved handling of identifiers. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visiEPSS 0.3%CVE-2025-13470HIGHRNP 0.18.0 Vulnerable PKESK session keysEPSS 0.3%CVE-2025-66511MEDIUMNextcloud Calendar app used predictable proposal participant tokensEPSS 0.3%CVE-2024-47188HIGHSuricata http/byte-ranges: missing hashtable random seed leads to potential DoSEPSS 0.3%CVE-2026-56706MEDIUMAdminer before 5.4.3 CSRF Token Secret Recovery via XOR MaskingEPSS 0.3%CVE-2025-12787MEDIUMHydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash GenerationEPSS 0.3%CVE-2026-33710HIGHChamilo LMS has Weak REST API Key Generation (Predictable)EPSS 0.3%CVE-2026-44054MEDIUMPredictable afpd session tokenEPSS 0.3%CVE-2025-68704HIGHJervis has a Weak Random for Timing Attack MitigationEPSS 0.3%CVE-2026-41505HIGHRELATE: Predictable Token Generation in auth.py and exam.pyEPSS 0.3%CVE-2024-48928LOWPiwigo's secret key can be brute forcedEPSS 0.3%CVE-2026-3416MEDIUMPredictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event PayloadsEPSS 0.3%