CWE-331 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-331/ Sun, 26 Feb 2023 09:09:21 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-331 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-331/ 32 32 CVE-2008-2108 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-2108/ Sun, 26 Feb 2023 09:09:21 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-2108/ The GENERATE_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during conversion due to insufficient precision, which produces 24 bits of entropy and simplifies brute force attacks against protection mechanisms that use the rand and mt_rand functions.

The post CVE-2008-2108 appeared first on CVE Vulnerability.

]]> The GENERATE_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during conversion due to insufficient precision, which produces 24 bits of entropy and simplifies brute force attacks against protection mechanisms that use the rand and mt_rand functions.

The post CVE-2008-2108 appeared first on CVE Vulnerability.

]]> CVE-2008-1447 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-1447/ Sun, 26 Feb 2023 09:09:01 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-1447/ The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning […]

The post CVE-2008-1447 appeared first on CVE Vulnerability.

]]> The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka “DNS Insufficient Socket Entropy Vulnerability” or “the Kaminsky bug.”

The post CVE-2008-1447 appeared first on CVE Vulnerability.

]]> CVE-2018-8435 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-8435/ Sun, 26 Feb 2023 06:51:27 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-8435/ A security feature bypass vulnerability exists when Windows Hyper-V BIOS loader fails to provide a high-entropy source, aka “Windows Hyper-V Security Feature Bypass Vulnerability.” This affects Windows Server 2016, Windows 10, Windows 10 Servers.

The post CVE-2018-8435 appeared first on CVE Vulnerability.

]]> A security feature bypass vulnerability exists when Windows Hyper-V BIOS loader fails to provide a high-entropy source, aka “Windows Hyper-V Security Feature Bypass Vulnerability.” This affects Windows Server 2016, Windows 10, Windows 10 Servers.

The post CVE-2018-8435 appeared first on CVE Vulnerability.

]]> CVE-2018-18326 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-18326/ Sun, 26 Feb 2023 06:47:44 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-18326/ DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplete fix for CVE-2018-15812.

The post CVE-2018-18326 appeared first on CVE Vulnerability.

]]> DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplete fix for CVE-2018-15812.

The post CVE-2018-18326 appeared first on CVE Vulnerability.

]]> CVE-2018-15812 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-15812/ Sun, 26 Feb 2023 06:46:47 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-15812/ DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.

The post CVE-2018-15812 appeared first on CVE Vulnerability.

]]> DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.

The post CVE-2018-15812 appeared first on CVE Vulnerability.

]]> CVE-2018-10240 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-10240/ Sun, 26 Feb 2023 06:44:48 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-10240/ SolarWinds Serv-U MFT before 15.1.6 HFv1 assigns authenticated users a low-entropy session token that can be included in requests to the application as a URL parameter in lieu of a session cookie. This session token’s value can be brute-forced by an attacker to obtain the corresponding session cookie and hijack the user’s session.

The post CVE-2018-10240 appeared first on CVE Vulnerability.

]]> SolarWinds Serv-U MFT before 15.1.6 HFv1 assigns authenticated users a low-entropy session token that can be included in requests to the application as a URL parameter in lieu of a session cookie. This session token’s value can be brute-forced by an attacker to obtain the corresponding session cookie and hijack the user’s session.

The post CVE-2018-10240 appeared first on CVE Vulnerability.

]]> CVE-2018-1000620 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-1000620/ Sun, 26 Feb 2023 06:44:38 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-1000620/ Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been […]

The post CVE-2018-1000620 appeared first on CVE Vulnerability.

]]> Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.

The post CVE-2018-1000620 appeared first on CVE Vulnerability.

]]> CVE-2020-29505 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-29505/ Sun, 26 Feb 2023 06:40:57 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-29505/ Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain a Key Management Error Vulnerability.

The post CVE-2020-29505 appeared first on CVE Vulnerability.

]]> Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain a Key Management Error Vulnerability.

The post CVE-2020-29505 appeared first on CVE Vulnerability.

]]> CVE-2020-28924 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-28924/ Sun, 26 Feb 2023 06:40:47 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-28924/ An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limits the entropy of the passwords enormously. These passwords […]

The post CVE-2020-28924 appeared first on CVE Vulnerability.

]]> An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limits the entropy of the passwords enormously. These passwords are often used in the crypt backend for encryption of data. It would be possible to make a dictionary of all possible passwords with about 38 million entries per password length. This would make decryption of secret material possible with a plausible amount of effort. NOTE: all passwords generated by affected versions should be changed.

The post CVE-2020-28924 appeared first on CVE Vulnerability.

]]> CVE-2020-25926 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-25926/ Sun, 26 Feb 2023 06:39:53 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-25926/ The DNS client in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Insufficient entropy in the DNS transaction id. The impact is: DNS cache poisoning (remote). The component is: dns_query_type(). The attack vector is: a specific DNS response packet.

The post CVE-2020-25926 appeared first on CVE Vulnerability.

]]> The DNS client in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Insufficient entropy in the DNS transaction id. The impact is: DNS cache poisoning (remote). The component is: dns_query_type(). The attack vector is: a specific DNS response packet.

The post CVE-2020-25926 appeared first on CVE Vulnerability.

]]>