Fallos del tipo CWE-331

101 resultados

Entropia Insuficiente

A geração de números aleatórios ou valores criptográficos usa fonte de aleatoriedade fraca (como timestamp, PID ou função pseudoaleatória simples), permitindo que um atacante preveja ou reproduza os valores gerados. Isso compromete a segurança de tokens, chaves, nonces e IDs que deveriam ser imprevisíveis.

Ejemplo

Um sistema gera tokens de sessão usando apenas Math.random() ou concatenando a hora atual com um número sequencial. Um atacante consegue adivinhar tokens válidos de outros usuários porque a origem de aleatoriedade é reproduzível ou tem espaço de busca pequeno.

Cómo mitigar

Use geradores criptográficos recomendados pelo sistema operacional: os.urandom() (Python), crypto.getRandomBytes() (Node.js), SecureRandom (Java) ou /dev/urandom (Linux). Nunca use Math.random(), rand() ou funções baseadas em clock/PID para segurança.

CVE-2025-15629MEDIUMWeak Session Key Generation in TP-Link Omada Adoption ProtocolEPSS 0.3%CVE-2026-46474HIGHTrog::TOTP versions before 1.006 for Perl generate secrets using randEPSS 0.3%CVE-2026-4827HIGHInsufficient Entropy vulnerability on Multiple ProductsEPSS 0.3%CVE-2024-57868MEDIUMWeb::API 2.8 and earlier for Perl uses insecure rand() function for cryptographic functionsEPSS 0.3%CVE-2026-112041MEDIUMdiem-project diem dmString.php random weak prngEPSS 0.3%CVE-2024-52322MEDIUMWebService::Xero 0.11 for Perl uses insecure rand() function for cryptographic functionsEPSS 0.3%CVE-2025-14261HIGHLack of entropy allows registered low-privileged users of Litmus to crack valid JWT tokens and gain admin privilegesEPSS 0.3%CVE-2024-58036MEDIUMNet::Dropbox::API 1.9 and earlier for Perl uses insecure rand() function for cryptographic functionsEPSS 0.3%CVE-2026-19877HIGHBrute-forceable image-share link password in INFINITT ULiteEPSS 0.3%CVE-2026-22698HIGHRustCrypto SM2-PKE has 32-bit Biased Nonce VulnerabilityEPSS 0.3%CVE-2024-26329MEDIUMChilkat before v9.5.0.98, allows attackers to obtain sensitive information via predictable PRNG in ChilkatRand::randomBytes function.EPSS 0.3%CVE-2026-2541MEDIUMMicca KE700 Brute-force vulnerability due to low entropyEPSS 0.3%CVE-2025-0577MEDIUMGlibc: vdso getrandom acceleration may return predictable randomnessEPSS 0.2%CVE-2018-9426MEDIUMIn  RsaKeyPairGenerator::getNumberOfIterations of RSAKeyPairGenerator.java, an incorrect implementation could cause weak RSA key pairs beingEPSS 0.2%CVE-2026-92209HIGHNoMachine Redis Improper Authentication Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2024-58040CRITICALCrypt::RandomEncryption for Perl uses insecure rand() function during encryptionEPSS 0.2%CVE-2026-2336HIGHWeak webstax_auth Cookie Authentication Allows Privilege EscalationEPSS 0.2%CVE-2025-50122HIGHA CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generation algorithm is reveEPSS 0.2%CVE-2023-37822HIGHThe Eufy Homebase 2 before firmware version 3.3.4.1h creates a dedicated wireless network for its ecosystem, which serves as a proxy to the EPSS 0.2%CVE-2026-34236HIGHAuth0 PHP SDK Insufficient Entropy in Cookie EncryptionEPSS 0.2%