Total
128 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-9055 | 2026-06-17 | N/A | 4.2 MEDIUM | ||
| The DPA countermeasures on Silicon Labs' Series 2 devices are not reseeded periodically as they should be. This may allow an attacker to eventually extract secret keys through a DPA attack. | |||||
| CVE-2024-8796 | 1 Tinfoilsecurity | 1 Devise-two-factor | 2026-06-17 | N/A | 5.3 MEDIUM |
| Under the default configuration, Devise-Two-Factor versions >= 2.2.0 & < 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum defined by RFC 4226. Using a shared secret shorter than the minimum to generate a multi-factor authentication code could make it easier for an attacker to guess the shared secret and generate valid TOTP codes. | |||||
| CVE-2024-6508 | 2026-06-17 | N/A | 8.0 HIGH | ||
| An insufficient entropy vulnerability was found in the Openshift Console. In the authorization code type and implicit grant type, the OAuth2 protocol is vulnerable to a Cross-Site Request Forgery (CSRF) attack if the state parameter is used inefficiently. This flaw allows logging into the victim’s current application account using a third-party account without any restrictions. | |||||
| CVE-2024-58134 | 1 Mojolicious | 1 Mojolicious | 2026-06-17 | N/A | 8.1 HIGH |
| Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session. | |||||
| CVE-2024-58040 | 1 Qwer | 1 Crypt\ | 2026-06-17 | N/A | 9.1 CRITICAL |
| Crypt::RandomEncryption for Perl version 0.01 uses insecure rand() function during encryption. | |||||
| CVE-2024-58036 | 1 Norbu09 | 1 Net\ | 2026-06-17 | N/A | 5.5 MEDIUM |
| Net::Dropbox::API 1.9 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Net::Dropbox::API uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function. | |||||
| CVE-2024-57868 | 1 Lev | 1 Web\ | 2026-06-17 | N/A | 5.5 MEDIUM |
| Web::API 2.8 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Web::API uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function. | |||||
| CVE-2024-56370 | 2026-06-17 | N/A | 6.5 MEDIUM | ||
| Net::Xero 0.044 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Net::Xero uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function. | |||||
| CVE-2024-52322 | 1 Localshop | 1 Webservice\ | 2026-06-17 | N/A | 5.5 MEDIUM |
| WebService::Xero 0.11 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically WebService::Xero uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function. | |||||
| CVE-2024-47945 | 1 Rittal | 4 Cmc Iii Processing Units, Cmc Iii Processing Units Firmware, Iot Interface and 1 more | 2026-06-17 | N/A | 9.8 CRITICAL |
| The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm. The session IDs are predictable, with only 32,768 possible values per user, which allows attackers to pre-generate valid session IDs, leading to unauthorized access to user sessions. This is not only due to the use of an (insecure) rand() function call but also because of missing initialization via srand(). As a result only the PIDs are effectively used as seed. | |||||
| CVE-2024-3411 | 2026-06-17 | N/A | 9.1 CRITICAL | ||
| Implementations of IPMI Authenticated sessions does not provide enough randomness to protect from session hijacking, allowing an attacker to use either predictable IPMI Session ID or weak BMC Random Number to bypass security controls using spoofed IPMI packets to manage BMC device. | |||||
| CVE-2024-38270 | 1 Zyxel | 20 Gs1900-10hp, Gs1900-10hp Firmware, Gs1900-16 and 17 more | 2026-06-17 | N/A | 5.3 MEDIUM |
| An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens generation exists in the Zyxel GS1900-10HP firmware version V2.80(AAZI.0)C0. This vulnerability could allow a LAN-based attacker a slight chance to gain a valid session token if multiple authenticated sessions are alive. | |||||
| CVE-2024-36400 | 1 Viz | 1 Nano Id | 2026-06-17 | N/A | 9.4 CRITICAL |
| nano-id is a unique string ID generator for Rust. Affected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the `nano_id::base62` and `nano_id::base58` functions. Specifically, the `base62` function used a character set of 32 symbols instead of the intended 62 symbols, and the `base58` function used a character set of 16 symbols instead of the intended 58 symbols. Additionally, the `nano_id::gen` macro is also affected when a custom character set that is not a power of 2 in size is specified. It should be noted that `nano_id::base64` is not affected by this vulnerability. This can result in a significant reduction in entropy, making the generated IDs predictable and vulnerable to brute-force attacks when the IDs are used in security-sensitive contexts such as session tokens or unique identifiers. The vulnerability is fixed in 0.4.0. | |||||
| CVE-2024-26329 | 2026-06-17 | N/A | 6.2 MEDIUM | ||
| Chilkat before v9.5.0.98, allows attackers to obtain sensitive information via predictable PRNG in ChilkatRand::randomBytes function. | |||||
| CVE-2024-25730 | 1 Hitrontech | 4 Coda-4582u, Coda-4582u Firmware, Coda-4589 and 1 more | 2026-06-17 | N/A | 9.8 CRITICAL |
| Hitron CODA-4582 and CODA-4589 devices have default PSKs that are generated from 5-digit hex values concatenated with a "Hitron" substring, resulting in insufficient entropy (only about one million possibilities). | |||||
| CVE-2024-25407 | 1 Steve-community | 1 Steve | 2026-06-17 | N/A | 7.5 HIGH |
| SteVe v3.6.0 was discovered to use predictable transaction ID's when receiving a StartTransaction request. This vulnerability can allow attackers to cause a Denial of Service (DoS) by using the predicted transaction ID's to terminate other transactions. | |||||
| CVE-2024-22473 | 1 Silabs | 1 Gecko Software Development Kit | 2026-06-17 | N/A | 6.8 MEDIUM |
| TRNG is used before initialization by ECDSA signing driver when exiting EM2/EM3 on Virtual Secure Vault (VSE) devices. This defect may allow Signature Spoofing by Key Recreation.This issue affects Gecko SDK through v4.4.0. | |||||
| CVE-2024-20331 | 1 Cisco | 2 Adaptive Security Appliance Software, Firepower Threat Defense Software | 2026-06-17 | N/A | 6.8 MEDIUM |
| A vulnerability in the session authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to prevent users from authenticating. This vulnerability is due to insufficient entropy in the authentication process. An attacker could exploit this vulnerability by determining the handle of an authenticating user and using it to terminate their authentication session. A successful exploit could allow the attacker to force a user to restart the authentication process, preventing a legitimate user from establishing remote access VPN sessions. | |||||
| CVE-2023-4344 | 1 Broadcom | 1 Raid Controller Web Interface | 2026-06-17 | N/A | 9.8 CRITICAL |
| Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection | |||||
| CVE-2023-49927 | 1 Samsung | 26 Exynos 1080, Exynos 1080 Firmware, Exynos 1280 and 23 more | 2026-06-17 | N/A | 5.3 MEDIUM |
| An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 9110, Exynos W920, Exynos Modem 5123, Exynos Modem 5300. The baseband software does not properly check format types specified by the RRC. This can lead to a lack of encryption. | |||||