Fallos del tipo CWE-331

97 resultados

Entropia Insuficiente

A geração de números aleatórios ou valores criptográficos usa fonte de aleatoriedade fraca (como timestamp, PID ou função pseudoaleatória simples), permitindo que um atacante preveja ou reproduza os valores gerados. Isso compromete a segurança de tokens, chaves, nonces e IDs que deveriam ser imprevisíveis.

Ejemplo

Um sistema gera tokens de sessão usando apenas Math.random() ou concatenando a hora atual com um número sequencial. Um atacante consegue adivinhar tokens válidos de outros usuários porque a origem de aleatoriedade é reproduzível ou tem espaço de busca pequeno.

Cómo mitigar

Use geradores criptográficos recomendados pelo sistema operacional: os.urandom() (Python), crypto.getRandomBytes() (Node.js), SecureRandom (Java) ou /dev/urandom (Linux). Nunca use Math.random(), rand() ou funções baseadas em clock/PID para segurança.

CVE-2026-42155CRITICALMagento LTS: Weak API Session ID — Predictable MD5 of Time-Derived InputsEPSS 0.3%CVE-2025-14261HIGHLack of entropy allows registered low-privileged users of Litmus to crack valid JWT tokens and gain admin privilegesEPSS 0.3%CVE-2024-57868MEDIUMWeb::API 2.8 and earlier for Perl uses insecure rand() function for cryptographic functionsEPSS 0.3%CVE-2024-52322MEDIUMWebService::Xero 0.11 for Perl uses insecure rand() function for cryptographic functionsEPSS 0.3%CVE-2024-58036MEDIUMNet::Dropbox::API 1.9 and earlier for Perl uses insecure rand() function for cryptographic functionsEPSS 0.3%CVE-2026-22698HIGHRustCrypto SM2-PKE has 32-bit Biased Nonce VulnerabilityEPSS 0.3%CVE-2024-26329MEDIUMChilkat before v9.5.0.98, allows attackers to obtain sensitive information via predictable PRNG in ChilkatRand::randomBytes function.EPSS 0.3%CVE-2025-0577MEDIUMGlibc: vdso getrandom acceleration may return predictable randomnessEPSS 0.3%CVE-2018-9426MEDIUMIn  RsaKeyPairGenerator::getNumberOfIterations of RSAKeyPairGenerator.java, an incorrect implementation could cause weak RSA key pairs beingEPSS 0.2%CVE-2026-2541MEDIUMMicca KE700 Brute-force vulnerability due to low entropyEPSS 0.2%CVE-2024-58040CRITICALCrypt::RandomEncryption for Perl uses insecure rand() function during encryptionEPSS 0.2%CVE-2026-2336HIGHWeak webstax_auth Cookie Authentication Allows Privilege EscalationEPSS 0.2%CVE-2023-37822HIGHThe Eufy Homebase 2 before firmware version 3.3.4.1h creates a dedicated wireless network for its ecosystem, which serves as a proxy to the EPSS 0.2%CVE-2026-34236HIGHAuth0 PHP SDK Insufficient Entropy in Cookie EncryptionEPSS 0.2%CVE-2024-38270MEDIUMAn insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens genEPSS 0.2%CVE-2025-50122HIGHA CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generation algorithm is reveEPSS 0.2%CVE-2025-2814MEDIUMCrypt::CBC versions between 1.21 and 3.05 for Perl may use insecure rand() function for cryptographic functionsEPSS 0.2%CVE-2025-1860HIGHData::Entropy for Perl uses insecure rand() function for cryptographic functionsEPSS 0.2%CVE-2025-59015MEDIUMInsufficient Entropy in Password GenerationEPSS 0.2%CVE-2025-15629MEDIUMWeak Session Key Generation in TP-Link Omada Adoption ProtocolEPSS 0.2%