Weaknesses of type CWE-338

169 results

Uso de gerador de números pseudoaleatórios criptograficamente fraco

A aplicação usa funções como Math.random(), rand() ou similar para gerar valores que precisam ser impredizíveis (tokens, chaves, nonces). Esses geradores não foram projetados para segurança criptográfica e são facilmente previsíveis, permitindo um atacante adivinhar ou reproduzir os valores gerados.

Example

Um servidor Java gera tokens de sessão usando Math.random() em vez de SecureRandom, ou uma API Node.js cria chaves de reset de senha com Math.random(). Um atacante consegue predizer os próximos tokens testando sequências ou analisando padrões.

How to mitigate

Use geradores criptograficamente seguros: SecureRandom em Java, secrets em Python, crypto.randomBytes() em Node.js, random_bytes() em PHP. Garanta que esses valores sejam usados exclusivamente para fins de segurança (tokens, chaves, IVs).

CVE-2026-40975MEDIUMValues produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} shoEPSS 0.3%CVE-2024-57868MEDIUMWeb::API 2.8 and earlier for Perl uses insecure rand() function for cryptographic functionsEPSS 0.3%CVE-2026-112041MEDIUMdiem-project diem dmString.php random weak prngEPSS 0.3%CVE-2021-26091MEDIUMA use of a cryptographically weak pseudo-random number generator vulnerability in the authenticator of the Identity Based Encryption serviceEPSS 0.3%CVE-2026-9638HIGHCrypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for saltsEPSS 0.3%CVE-2026-13082MEDIUMGD::SecurityImage versions through 1.75 for Perl use rand to generate secretsEPSS 0.3%CVE-2024-52322MEDIUMWebService::Xero 0.11 for Perl uses insecure rand() function for cryptographic functionsEPSS 0.3%CVE-2026-9205HIGHLangflow is affected by weaknesses in secret handling and sensitive configuration accessEPSS 0.3%CVE-2025-40919MEDIUMAuthen::DigestMD5 versions 0.01 through 0.04 for Perl generate the cnonce insecurelyEPSS 0.3%CVE-2025-40924MEDIUMCatalyst::Plugin::Session before version 0.44 for Perl generates session ids insecurelyEPSS 0.3%CVE-2026-74887MEDIUMopenssl_encrypt before 1.4.0 Insecure Random Import in PQC ModuleEPSS 0.3%CVE-2025-40905HIGHWWW::OAuth 1.000 and earlier for Perl uses insecure rand() function for cryptographic functionsEPSS 0.3%CVE-2024-58036MEDIUMNet::Dropbox::API 1.9 and earlier for Perl uses insecure rand() function for cryptographic functionsEPSS 0.3%CVE-2024-57835MEDIUMAmon2::Auth::Site::LINE versions through 0.04 for Perl uses insecure rand() function for cryptographic functionsEPSS 0.3%CVE-2025-40915HIGHMojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokensEPSS 0.3%CVE-2026-46493HIGHhaxtheweb/haxcms-php uses insecure method for generating saltEPSS 0.3%CVE-2026-7830HIGHUltraVNC MS-Logon II uses 64-bit Diffie-Hellman and seeded libc rand() enabling credential interceptionEPSS 0.3%CVE-2026-7874CRITICALWeak Cryptographic Key Derivation Exposed All Stored CredentialsEPSS 0.3%CVE-2026-79901CRITICALPredictable Active Directory service-account passwords in BoKS ManagerEPSS 0.3%CVE-2026-41505HIGHRELATE: Predictable Token Generation in auth.py and exam.pyEPSS 0.3%