Falhas do tipo CWE-330

178 resultados

Uso de valores aleatórios insuficientemente seguros

A aplicação gera números ou tokens que deveriam ser imprevisíveis (senhas, chaves de sessão, tokens CSRF) usando um gerador de aleatório fraco ou previsível. Um atacante consegue adivinhar ou reproduzir esses valores, comprometendo autenticação, autorização ou criptografia.

Exemplo

Um sistema gera token de sessão com `Math.random()` ou `java.util.Random()` sem seed aleatória, ou usa `rand()` do C. Um atacante observa alguns tokens, identifica o padrão e falsifica novas sessões de outros usuários.

Como mitigar

Use geradores criptograficamente seguros: `java.security.SecureRandom`, `secrets` do Python, `crypto.getRandomValues()` do JavaScript, ou `/dev/urandom` em Linux. Nunca use `Math.random()`, `rand()` ou `java.util.Random()` para segurança. Gere valores com entropia suficiente (mínimo 128 bits para tokens).

CVE-2024-36389CRITICALMileSight DeviceHub - CWE-330 Use of Insufficiently Random ValuesEPSS 0.5%CVE-2026-92913CRITICALAVideo Weak PRNG Activation Code Authentication BypassEPSS 0.5%CVE-2026-14570HIGHCrypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recoveryEPSS 0.5%CVE-2026-62862CRITICALTypeBot: Account takeover via brute-forceable 6-digit magic-link codeEPSS 0.5%CVE-2026-25072HIGHXikeStor SKS8310-8X Predictable Session IdentifiersEPSS 0.5%CVE-2024-10082HIGHCodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication methoEPSS 0.5%CVE-2025-64097CRITICALNervesHub has Insufficient Token Entropy that Allows Authentication Bypass via Brute ForceEPSS 0.5%CVE-2022-43485MEDIUMInsecure random number used for generating keys for signing Jwt tokensEPSS 0.5%CVE-2026-46351HIGHBigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate themEPSS 0.5%CVE-2025-11707MEDIUMLogin Lockdown & Protection <= 2.14 - IP Block BypassEPSS 0.5%CVE-2020-10729—A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal vaEPSS 0.4%CVE-2023-46740MEDIUMInsecure random string generator used for sensitive dataEPSS 0.4%CVE-2024-28013MEDIUMUse of Insufficiently Random Values vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2,EPSS 0.4%CVE-2025-10671MEDIUMyouth-is-as-pale-as-poetry e-learning JWT Token JwtUtils.java encryptSecret random valuesEPSS 0.4%CVE-2026-82555MEDIUMTOTOLINK N600R Authentication cstecgi.cgi loginAuth random valuesEPSS 0.4%CVE-2024-41708HIGHAn issue was discovered in AdaCore ada_web_services 20.0 allows an attacker to escalate privileges and steal sessions via the Random_String(EPSS 0.4%CVE-2022-26080MEDIUMEasily guessable session ID's in NE843 Pulsar Plus ControllerEPSS 0.4%CVE-2024-6348MEDIUMPredictable seed generation after ECU resetEPSS 0.4%CVE-2026-66391MEDIUMApache Wicket: leaked and missing CSP headersEPSS 0.4%CVE-2026-40496HIGHFreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute ForceEPSS 0.4%