Falhas do tipo CWE-330

196 resultados

Uso de valores aleatórios insuficientemente seguros

A aplicação gera números ou tokens que deveriam ser imprevisíveis (senhas, chaves de sessão, tokens CSRF) usando um gerador de aleatório fraco ou previsível. Um atacante consegue adivinhar ou reproduzir esses valores, comprometendo autenticação, autorização ou criptografia.

Exemplo

Um sistema gera token de sessão com `Math.random()` ou `java.util.Random()` sem seed aleatória, ou usa `rand()` do C. Um atacante observa alguns tokens, identifica o padrão e falsifica novas sessões de outros usuários.

Como mitigar

Use geradores criptograficamente seguros: `java.security.SecureRandom`, `secrets` do Python, `crypto.getRandomValues()` do JavaScript, ou `/dev/urandom` em Linux. Nunca use `Math.random()`, `rand()` ou `java.util.Random()` para segurança. Gere valores com entropia suficiente (mínimo 128 bits para tokens).

CVE-2026-106074MEDIUMA flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt(EPSS 0.3%CVE-2026-46346MEDIUMGoobi viewer: Predictable Password Reset Token Allows Unauthorized Password ResetEPSS 0.3%CVE-2023-1385HIGHImproper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to uEPSS 0.3%CVE-2025-13470HIGHRNP 0.18.0 Vulnerable PKESK session keysEPSS 0.3%CVE-2026-17274MEDIUMIBM i is Affected By Multiple Vulnerabilities in Debug ServerEPSS 0.3%CVE-2026-45673MEDIUMNetty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source PortEPSS 0.3%CVE-2024-47187HIGHSuricata datasets: missing hashtable random seed leads to potential DoSEPSS 0.3%CVE-2026-120223LOWOray Pugongying X5 Pro Session ID session.lua session_get random valuesEPSS 0.3%CVE-2025-66511MEDIUMNextcloud Calendar app used predictable proposal participant tokensEPSS 0.3%CVE-2024-5868MEDIUMWooCommerce - Social Login <= 2.6.2 - Email Verification due to Insufficient RandomnessEPSS 0.3%CVE-2025-12787MEDIUMHydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash GenerationEPSS 0.3%CVE-2026-40975MEDIUMValues produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} shoEPSS 0.3%CVE-2026-92912HIGHAVideo Cryptographically Weak PRNG via uniqid Stream KeyEPSS 0.3%CVE-2024-48928LOWPiwigo's secret key can be brute forcedEPSS 0.3%CVE-2024-47188HIGHSuricata http/byte-ranges: missing hashtable random seed leads to potential DoSEPSS 0.3%CVE-2026-33710HIGHChamilo LMS has Weak REST API Key Generation (Predictable)EPSS 0.3%CVE-2026-28415MEDIUMGradio has Open Redirect in OAuth FlowEPSS 0.3%CVE-2026-44054MEDIUMPredictable afpd session tokenEPSS 0.3%CVE-2025-68704HIGHJervis has a Weak Random for Timing Attack MitigationEPSS 0.3%CVE-2026-105674HIGHPredictable Media Stream Pre-Shared Key Vulnerability in TP-Link Tapo C325WBEPSS 0.3%