Falhas do tipo CWE-338

169 resultados

Uso de gerador de números pseudoaleatórios criptograficamente fraco

A aplicação utiliza um PRNG (gerador de números pseudoaleatórios) inadequado para contextos de segurança, como Math.random() ou similar, onde deveria usar funções criptograficamente seguras. Isso permite que um atacante previsibilidade ou reproduza sequências de números que deveriam ser imprevisíveis, comprometendo tokens, chaves de sessão, nonces ou outros valores críticos.

Exemplo

Um sistema gera tokens de redefinição de senha usando Math.random() em vez de uma função criptográfica. Um atacante consegue prever ou enumerar tokens válidos dentro de um tempo útil, permitindo hijacking de contas.

Como mitigar

Substitua PRNGs genéricos por funções criptograficamente seguras: em Java use java.security.SecureRandom, em Node.js use crypto.randomBytes(), em Python use secrets ou os.urandom(). Revise todo código que gera valores de segurança e aplique essas funções.

CVE-2026-107283LOWAsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random sourceEPSS 0.3%CVE-2026-19742LOWIPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret keyEPSS 0.2%CVE-2026-41858MEDIUMWeak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a neEPSS 0.2%CVE-2026-8503MEDIUMApache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session idsEPSS 0.2%CVE-2024-24554MEDIUMBludit - Insecure Token GenerationEPSS 0.2%CVE-2026-47882HIGHSpring Boot DevTools remote secret generated with a non-cryptographic PRNGEPSS 0.2%CVE-2024-47126HIGHUse of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in goTenna ProEPSS 0.2%CVE-2024-58040CRITICALCrypt::RandomEncryption for Perl uses insecure rand() function during encryptionEPSS 0.2%CVE-2026-57082MEDIUMNet::BitTorrent versions before 2.1.0 for Perl generate the MSE Diffie-Hellman private key with a non-cryptographic PRNGEPSS 0.2%CVE-2025-40932HIGHApache::SessionX versions through 2.01 for Perl create insecure session idEPSS 0.2%CVE-2026-8647MEDIUMCrypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is availableEPSS 0.2%CVE-2024-4772MEDIUMAn HTTP digest authentication nonce value was generated using `rand()` which could lead to predictable values. This vulnerability affects FiEPSS 0.2%CVE-2026-102719MEDIUMNetX Secure DTLS server issues predictable HelloVerifyRequest cookies, so a spoofed client can pass the return-routability checkEPSS 0.2%CVE-2025-2814MEDIUMCrypt::CBC versions between 1.21 and 3.05 for Perl may use insecure rand() function for cryptographic functionsEPSS 0.2%CVE-2026-34871MEDIUMAn issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a PseudEPSS 0.2%CVE-2026-102813MEDIUMAdministrator Password Reset Through the Verification-Code Interface in TP-Link RE305EPSS 0.2%CVE-2025-1860HIGHData::Entropy for Perl uses insecure rand() function for cryptographic functionsEPSS 0.2%CVE-2025-26379HIGHJohnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG use of Cryptographically Weak Pseudo-Random Number GeneratorEPSS 0.2%CVE-2026-6146MEDIUMAmazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keysEPSS 0.2%CVE-2026-40514HIGHSmarterTools SmarterMail < Build 9610 Cryptographic Weakness via Weak RNGEPSS 0.2%