Weaknesses of type CWE-330

178 results

Uso de valores aleatórios insuficientemente randômicos

A aplicação usa geradores de números aleatórios fracos (como Math.random(), rand() ou seeds previsíveis) para criar tokens, chaves, IVs ou outros valores que precisam ser criptograficamente seguros. Um atacante consegue prever ou reproduzir esses valores, comprometendo a segurança de autenticação, sessão ou criptografia.

Example

Um sistema gera tokens de reset de senha usando Math.random() em JavaScript ou srand(time()) em C, permitindo que um atacante adivinhe o token de outro usuário em poucas tentativas. Outro caso: usar UUID v1 (baseado em timestamp) em vez de UUID v4 (randômico) para criar chaves criptográficas.

How to mitigate

Use geradores de números aleatórios criptograficamente seguros: crypto.getRandomValues() (JS), java.security.SecureRandom (Java), secrets.token_bytes() (Python), ou equivalentes nativos da plataforma. Nunca use time() ou valores previsíveis como seed; confie em /dev/urandom ou APIs de sistema operacional que coletam entropia real.

CVE-2023-24478MEDIUMUse of insufficiently random values for some Intel Agilex(R) software included as part of Intel(R) Quartus(R) Prime Pro Edition for linux beEPSS 0.2%CVE-2021-26407MEDIUMA randomly generated Initialization Vector (IV) may lead to a collision of IVs with the same key potentially resulting in information discloEPSS 0.2%CVE-2025-15574MEDIUMInsecure Credential Generation for Solax Power Pocket WiFi models MQTT Cloud ConnectionEPSS 0.2%CVE-2023-32831MEDIUMIn wlan driver, there is a possible PIN crack due to use of insufficiently random values. This could lead to local information disclosure wiEPSS 0.2%CVE-2026-40306MEDIUMDNN has same HostGUID for all new installsEPSS 0.2%CVE-2026-41701MEDIUMIn Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queuesEPSS 0.2%CVE-2026-41838MEDIUMSpring Framework Predictable Session ID in WebSocket ModuleEPSS 0.2%CVE-2025-13353HIGHgokey allows secret recovery from a seed file without the master passwordEPSS 0.2%CVE-2026-14702LOWzcaceres markdownify-mcp webpage-to-markdown Markdownify.ts saveToTempFile random valuesEPSS 0.1%CVE-2026-50208CRITICALPermissive TrustAllCerts TLS VerificationEPSS 0.1%CVE-2026-23999LOWFleet: Device lock PIN can be predicted if lock time is knownEPSS 0.1%CVE-2024-51346HIGHAn issue in Eufy Homebase 2 version 3.3.4.1h allows a local attacker to obtain sensitive information via the cryptographic scheme.EPSS 0.1%CVE-2026-47703MEDIUMAdGuard Home: DoQ-to-UDP State Reduction and Source-Port OracleEPSS 0.1%CVE-2024-21460HIGHUse of Insufficiently Random Values in CoreEPSS 0.1%CVE-2026-21444MEDIUMlibtpms returns wrong initialization vector when certain symmetric ciphers are usedEPSS 0.1%CVE-2026-92930MEDIUMOpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-deviceEPSS —CVE-2026-94456CRITICALUnauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keysEPSS —CVE-2026-80154HIGHLantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation BypassEPSS —