Fallos del tipo CWE-331

97 resultados

Entropia Insuficiente

A geração de números aleatórios ou valores criptográficos usa fonte de aleatoriedade fraca (como timestamp, PID ou função pseudoaleatória simples), permitindo que um atacante preveja ou reproduza os valores gerados. Isso compromete a segurança de tokens, chaves, nonces e IDs que deveriam ser imprevisíveis.

Ejemplo

Um sistema gera tokens de sessão usando apenas Math.random() ou concatenando a hora atual com um número sequencial. Um atacante consegue adivinhar tokens válidos de outros usuários porque a origem de aleatoriedade é reproduzível ou tem espaço de busca pequeno.

Cómo mitigar

Use geradores criptográficos recomendados pelo sistema operacional: os.urandom() (Python), crypto.getRandomBytes() (Node.js), SecureRandom (Java) ou /dev/urandom (Linux). Nunca use Math.random(), rand() ou funções baseadas em clock/PID para segurança.

CVE-2025-15629MEDIUMWeak Session Key Generation in TP-Link Omada Adoption ProtocolEPSS 0.2%CVE-2024-9055MEDIUMDPA Countermeasures need reseedingEPSS 0.2%CVE-2026-2878MEDIUMInsufficient Entropy Vulnerability in Telerik UI for ASP.NET AJAXEPSS 0.2%CVE-2026-13199MEDIUMInsufficient Entropy in Raspberry Pi 5 and Compute Module 5EPSS 0.2%CVE-2025-13399HIGHInsecure Encryption in Communication with the Web Interface on TP-Link VX800vEPSS 0.2%CVE-2026-1814MEDIUMRapid7 Nexpose Insecure Java Keystore Password GenerationEPSS 0.2%CVE-2025-32898MEDIUMThe KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KEPSS 0.1%CVE-2025-14972MEDIUMInsufficient DPA countermeasure reseedingEPSS 0.1%CVE-2025-7432LOWDPA countermeasures not reseeded under certain conditionsEPSS 0.1%CVE-2026-4930HIGHDPA Countermeasures weakening on Series 3 devicesEPSS 0.1%CVE-2023-49927MEDIUMAn issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2EPSS 0.1%CVE-2025-27552MEDIUMDBIx::Class::EncodedColumn until 0.00032 for Perl uses insecure rand() function for salting password hashes in Crypt/Eksblowfish/Bcrypt.pmEPSS 0.1%CVE-2025-27551MEDIUMDBIx::Class::EncodedColumn until 0.00032 for Perl uses insecure rand() function for salting password hashes in Digest.pmEPSS 0.1%CVE-2026-4937MEDIUMPower System Insufficient EntropyEPSS 0.1%CVE-2026-80171MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient EntrEPSS 0.1%CVE-2026-4932MEDIUMThis Power System update is being released to address Insufficient EntropyEPSS 0.1%CVE-2026-4936MEDIUMPower System Insufficient EntropyEPSS 0.1%