Falhas do tipo CWE-330

178 resultados

Uso de valores aleatórios insuficientemente seguros

A aplicação gera números ou tokens que deveriam ser imprevisíveis (senhas, chaves de sessão, tokens CSRF) usando um gerador de aleatório fraco ou previsível. Um atacante consegue adivinhar ou reproduzir esses valores, comprometendo autenticação, autorização ou criptografia.

Exemplo

Um sistema gera token de sessão com `Math.random()` ou `java.util.Random()` sem seed aleatória, ou usa `rand()` do C. Um atacante observa alguns tokens, identifica o padrão e falsifica novas sessões de outros usuários.

Como mitigar

Use geradores criptograficamente seguros: `java.security.SecureRandom`, `secrets` do Python, `crypto.getRandomValues()` do JavaScript, ou `/dev/urandom` em Linux. Nunca use `Math.random()`, `rand()` ou `java.util.Random()` para segurança. Gere valores com entropia suficiente (mínimo 128 bits para tokens).

CVE-2023-24478MEDIUMUse of insufficiently random values for some Intel Agilex(R) software included as part of Intel(R) Quartus(R) Prime Pro Edition for linux beEPSS 0.2%CVE-2021-26407MEDIUMA randomly generated Initialization Vector (IV) may lead to a collision of IVs with the same key potentially resulting in information discloEPSS 0.2%CVE-2025-15574MEDIUMInsecure Credential Generation for Solax Power Pocket WiFi models MQTT Cloud ConnectionEPSS 0.2%CVE-2023-32831MEDIUMIn wlan driver, there is a possible PIN crack due to use of insufficiently random values. This could lead to local information disclosure wiEPSS 0.2%CVE-2026-40306MEDIUMDNN has same HostGUID for all new installsEPSS 0.2%CVE-2026-41701MEDIUMIn Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queuesEPSS 0.2%CVE-2026-41838MEDIUMSpring Framework Predictable Session ID in WebSocket ModuleEPSS 0.2%CVE-2025-13353HIGHgokey allows secret recovery from a seed file without the master passwordEPSS 0.2%CVE-2026-14702LOWzcaceres markdownify-mcp webpage-to-markdown Markdownify.ts saveToTempFile random valuesEPSS 0.1%CVE-2026-50208CRITICALPermissive TrustAllCerts TLS VerificationEPSS 0.1%CVE-2026-23999LOWFleet: Device lock PIN can be predicted if lock time is knownEPSS 0.1%CVE-2024-51346HIGHAn issue in Eufy Homebase 2 version 3.3.4.1h allows a local attacker to obtain sensitive information via the cryptographic scheme.EPSS 0.1%CVE-2026-47703MEDIUMAdGuard Home: DoQ-to-UDP State Reduction and Source-Port OracleEPSS 0.1%CVE-2024-21460HIGHUse of Insufficiently Random Values in CoreEPSS 0.1%CVE-2026-21444MEDIUMlibtpms returns wrong initialization vector when certain symmetric ciphers are usedEPSS 0.1%CVE-2026-92930MEDIUMOpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-deviceEPSS —CVE-2026-94456CRITICALUnauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keysEPSS —CVE-2026-80154HIGHLantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation BypassEPSS —