Fallos del tipo CWE-330

179 resultados

Uso de valores insuficientemente aleatórios

A aplicação gera números ou sequências que deveriam ser impprevisíveis (tokens, IVs, salts, chaves) usando métodos fracos ou com baixa entropia. Um atacante consegue adivinhar ou reproduzir esses valores, comprometendo criptografia, autenticação ou geração de identificadores únicos.

Ejemplo

Um sistema gera tokens de sessão usando Math.random() em JavaScript ou rand() em C, que são determinísticos e preditíveis. Um atacante observa alguns tokens válidos e consegue calcular os próximos, sequestrar sessões de outros usuários.

Cómo mitigar

Use geradores criptograficamente seguros: java.security.SecureRandom em Java, secrets ou os.urandom() em Python, crypto.getRandomBytes() em Node.js. Gere valores com entropia adequada (no mínimo 128 bits para tokens) e nunca reutilize sementes.

CVE-2026-53939CRITICALOpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryptionEPSS 0.2%CVE-2026-41207MEDIUMnetty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failuresEPSS 0.2%CVE-2025-13955CRITICALPredictable Default Wi-Fi Password in EZCast Pro II DongleEPSS 0.2%CVE-2021-26407MEDIUMA randomly generated Initialization Vector (IV) may lead to a collision of IVs with the same key potentially resulting in information discloEPSS 0.2%CVE-2023-24478MEDIUMUse of insufficiently random values for some Intel Agilex(R) software included as part of Intel(R) Quartus(R) Prime Pro Edition for linux beEPSS 0.2%CVE-2025-15574MEDIUMInsecure Credential Generation for Solax Power Pocket WiFi models MQTT Cloud ConnectionEPSS 0.2%CVE-2023-32831MEDIUMIn wlan driver, there is a possible PIN crack due to use of insufficiently random values. This could lead to local information disclosure wiEPSS 0.2%CVE-2026-40306MEDIUMDNN has same HostGUID for all new installsEPSS 0.2%CVE-2026-41701MEDIUMIn Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queuesEPSS 0.2%CVE-2026-41838MEDIUMSpring Framework Predictable Session ID in WebSocket ModuleEPSS 0.2%CVE-2025-13353HIGHgokey allows secret recovery from a seed file without the master passwordEPSS 0.2%CVE-2026-14702LOWzcaceres markdownify-mcp webpage-to-markdown Markdownify.ts saveToTempFile random valuesEPSS 0.1%CVE-2026-50208CRITICALPermissive TrustAllCerts TLS VerificationEPSS 0.1%CVE-2026-23999LOWFleet: Device lock PIN can be predicted if lock time is knownEPSS 0.1%CVE-2024-51346HIGHAn issue in Eufy Homebase 2 version 3.3.4.1h allows a local attacker to obtain sensitive information via the cryptographic scheme.EPSS 0.1%CVE-2026-47703MEDIUMAdGuard Home: DoQ-to-UDP State Reduction and Source-Port OracleEPSS 0.1%CVE-2024-21460HIGHUse of Insufficiently Random Values in CoreEPSS 0.1%CVE-2026-21444MEDIUMlibtpms returns wrong initialization vector when certain symmetric ciphers are usedEPSS 0.1%CVE-2026-96599HIGHIsotope eCommerce through 2.9.10 Weak Order Identifier GenerationEPSS —