Search
Total
11 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-49343 | 1 Ubuntubudgie | 1 Budgie Extras | 2023-12-20 | N/A | 7.8 HIGH |
| Temporary data passed between application components by Budgie Extras Dropby applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel. | |||||
| CVE-2021-27211 | 1 Steghide Project | 1 Steghide | 2022-07-12 | 5.0 MEDIUM | 7.5 HIGH |
| steghide 0.5.1 relies on a certain 32-bit seed value, which makes it easier for attackers to detect hidden data. | |||||
| CVE-2019-25061 | 1 Random Password Generator Project | 1 Random Password Generator | 2022-05-26 | 5.0 MEDIUM | 7.5 HIGH |
| The random_password_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due to its cyclic nature, can facilitate password prediction. | |||||
| CVE-2020-28597 | 1 Epignosishq | 1 Efront | 2022-04-28 | 5.0 MEDIUM | 7.5 HIGH |
| A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predicting the seed it is possible to generate the correct password reset 1-time token. An attacker can visit the password reset supplying the password reset token to reset the password of an account of their choice. | |||||
| CVE-2016-3735 | 1 Piwigo | 1 Piwigo | 2022-02-02 | 6.8 MEDIUM | 8.1 HIGH |
| Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmt_rand in order to generate password reset tokens. mt_rand output can be predicted after recovering the seed used to generate it. This low an unauthenticated attacker to take over an account providing they know an administrators email address in order to be able to request password reset. | |||||
| CVE-2021-42810 | 1 Thalesgroup | 1 Safenet Authentication Service Remote Desktop Gateway | 2022-01-25 | 7.2 HIGH | 7.8 HIGH |
| A flaw in the previous versions of the product may allow an authenticated attacker the ability to execute code as a privileged user on a system where the agent is installed. | |||||
| CVE-2020-13784 | 1 Dlink | 2 Dir-865l, Dir-865l Firmware | 2021-12-13 | 5.0 MEDIUM | 7.5 HIGH |
| D-Link DIR-865L Ax 1.20B01 Beta devices have a predictable seed in a Pseudo-Random Number Generator. | |||||
| CVE-2020-11616 | 2 Intel, Nvidia | 2 Bmc Firmware, Dgx-1 | 2021-07-21 | 5.0 MEDIUM | 7.5 HIGH |
| NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which the Pseudo-Random Number Generator (PRNG) algorithm used in the JSOL package that implements the IPMI protocol is not cryptographically strong, which may lead to information disclosure. | |||||
| CVE-2020-7010 | 1 Elastic | 1 Elastic Cloud On Kubernetes | 2020-06-05 | 5.0 MEDIUM | 7.5 HIGH |
| Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK. | |||||
| CVE-2017-5214 | 1 Codextrous | 1 B2j Contact | 2019-10-03 | 5.0 MEDIUM | 7.5 HIGH |
| The Codextrous B2J Contact (aka b2j_contact) extension before 2.1.13 for Joomla! allows prediction of a uniqid value based on knowledge of a time value. This makes it easier to read arbitrary uploaded files. | |||||
| CVE-2018-12520 | 1 Ntop | 1 Ntopng | 2019-10-03 | 6.8 MEDIUM | 8.1 HIGH |
| An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in deterministic session IDs being allocated for active user sessions. An attacker with foreknowledge of the operating system and standard library in use by the host running the service and the username of the user whose session they're targeting can abuse the deterministic random number generation in order to hijack the user's session, thus escalating their access. | |||||