CWE-331.

NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability

• NoMachine
• CWE-331

diem-project diem dmString.php random weak prng

• diem
• Weak cryptography or TLS
• CWE-331

Synology DiskStation Manager (DSM): An insufficient entropy vulnerability in login logic in Synology DiskStation Manager…

• Synology DiskStation Manager (DSM)
• CWE-331

LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key

• LangBot
• CWE-331

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Entropy in PRNG vulnerability.

• Dell Secure Connect Gateway 5.0 - Application
• Dell Secure Connect Gateway 5.0 - Appliance
• CWE-331

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70).

• Siemens Reyrolle 7SR5
• CWE-331

Combodo iTop: Weak secret generation for inline image

• Combodo iTop
• Weak cryptography or TLS
• CWE-331

Power System Insufficient Entropy

• IBM PowerVM Hypervisor
• CWE-331

Power System Insufficient Entropy

• IBM PowerVM Hypervisor
• CWE-331

pkp pkp-lib API Key Generation APIProfileForm.php setData entropy

• pkp-lib
• Weak cryptography or TLS
• CWE-331

Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropy

• Tenda CH7
• Tenda CH7G
• Weak cryptography or TLS
• CWE-331

crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

• Weak cryptography or TLS
• CWE-331

<4.0.0 · fixed in 4.0.0

Weak Session Key Generation in TP-Link Omada Adoption Protocol

• TP-Link Systems Inc. Omada Gateways
• TP-Link Systems Inc. Omada Switches
• CWE-331

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing.

• CWE-331

This Power System update is being released to address Insufficient Entropy

• IBM PowerVM Hypervisor
• CWE-331

Nexus Repository Manager - Insufficient Entropy in Format-Specific API Key Generation

• Sonatype Nexus Repository Manager
• CWE-331

Insufficient Entropy in Raspberry Pi 5 and Compute Module 5

• Raspberry Pi 5 and Compute Module 5
• CWE-331

DPA Countermeasures weakening on Series 3 devices

• silabs.com Simplicity SDK
• CWE-331

Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand

• TCHATZI Authen::TOTP
• CWE-331

Crypt::DSA versions before 1.20 for Perl generate seeds using rand

• TIMLEGGE Crypt::DSA
• CWE-331

Trog::TOTP versions before 1.006 for Perl generate secrets using rand

• TEODESIAN Trog::TOTP
• CWE-331

Insufficient DPA countermeasure reseeding

• silabs.com Simplicity SDK
• CWE-331

Insufficient Entropy vulnerability on Multiple Products

• Schneider Electric Easergy MiCOM C264
• Schneider Electric Easergy C5
• CWE-331

The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection

• Python Software Foundation CPython
• CWE-331

Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs

• Weak cryptography or TLS
• CWE-331

<20.18.0 · fixed in 20.18.0

Weak webstax_auth Cookie Authentication Allows Privilege Escalation

• Microchip IStaX
• CWE-331

libexpat: libexpat before 2.8.0 uses insufficient entropy…

• libexpat
• CWE-331

Auth0 Symfony SDK has Insufficient Entropy in Cookie Encryption

• CWE-331

>=5.0.0, <5.8.0 · fixed in 5.8.0

Auth0 WordPress Plugin has Insufficient Entropy in Cookie Encryption

• CWE-331

>=5.0.0-BETA0, <5.6.0 · fixed in 5.6.0

Auth0 laravel-auth0 SDK has Insufficient Entropy in Cookie Encryption

• CWE-331

>=7.0.0, <7.21.0 · fixed in 7.21.0

Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption

• CWE-331

>=8.0.0, <8.19.0 · fixed in 8.19.0

libcrux has All-Zero Key Generation Upon Catastrophic RNG Failure

• CWE-331
• CWE-392

<0.0.7 · fixed in 0.0.7

Insufficient Entropy Vulnerability in Telerik UI for ASP.NET AJAX

• Progress Software Telerik UI for ASP.NET AJAX
• CWE-331

Glibc: vdso getrandom acceleration may return predictable randomness

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-331

Micca KE700 Brute-force vulnerability due to low entropy

• Micca Auto Electronics Co., Ltd. Car Alarm System KE700
• CWE-331

DPA countermeasures not reseeded under certain conditions

• silabs.com Simplicity SDK
• CWE-331

Rapid7 Nexpose Insecure Java Keystore Password Generation

• Rapid7 InsightVM/Nexpose
• CWE-331

Insecure Encryption in Communication with the Web Interface on TP-Link VX800v

• TP-Link Systems Inc. VX800v v1.0
• CWE-331

SM2-PKE has 32-bit Biased Nonce Vulnerability

• CWE-331

>=0.14.0-pre.0, <=0.14.0-rc.4 · no fixed version yet

Arteco Web Client DVR/NVR Session ID Brute Force Authentication Bypass

• Arteco-Global Arteco Web Client DVR/NVR
• CWE-331

QNO Technology｜VPN Firewall - Insufficient Entropy

• QNO Technology VPN Firewall
• CWE-331

Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values in github.com/gofiber/utils

• Weak cryptography or TLS
• CWE-252

<1.2.0 · fixed in 1.2.0

WBCE CMS has Weak Random Number Generator in Password Generation Function

• WBCE_CMS
• Weak cryptography or TLS
• CWE-331

Lack of entropy allows registered low-privileged users of Litmus to crack valid JWT tokens and gain admin privileges

• litmus
• CWE-331

KDE Connect verification-code protocol: The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and…

• KDE Connect verification-code protocol
• CWE-331

Mercku M6a: On Mercku M6a devices through 2.1.0, the authentication system uses predictable session…

• Mercku M6a
• CWE-331

Crypt::RandomEncryption for Perl uses insecure rand() function during encryption

• QWER Crypt::RandomEncryption
• Weak cryptography or TLS
• CWE-331

TYPO3 CMS uses insufficient entropy when generating passwords

• CWE-331

>=12.0.0, <12.4.37 || >=13.0.0, <13.4.18 · fixed in 12.4.37, 13.4.18

The Thinbus Javascript Secure Remote Password (SRP) Client Generates Fewer Bits of Entropy Than Intended

• CWE-331

<2.0.1 · fixed in 2.0.1

A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generation algorithm is reverse engineered with access to installation or upgrade artif…

• Schneider Electric EcoStruxure™ IT Data Center Expert
• CWE-331

D-Link DCS-6517/DCS-7517 Root Password Generation httpd generate_pass_from_mac entropy

• D-Link DCS-6517
• D-Link DCS-7517
• Weak cryptography or TLS
• CWE-331

Meshtastic Repeated Public and Private Keypairs

• meshtastic firmware
• CWE-331

Rallly Insufficient Password Login Token Entropy Leads to Account Takeover

• lukevella rallly
• CWE-331

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default

• SRI Mojolicious
• Hard-coded credentials
• CWE-331

Crypt::CBC versions between 1.21 and 3.05 for Perl may use insecure rand() function for cryptographic functions

• LDS Crypt::CBC
• Weak cryptography or TLS
• CWE-329

Net::Xero 0.044 and earlier for Perl uses insecure rand() function for cryptographic functions

• ELLIOTT Net::Xero
• Weak cryptography or TLS
• CWE-331

WebService::Xero 0.11 for Perl uses insecure rand() function for cryptographic functions

• LOCALSHOP WebService::Xero
• Weak cryptography or TLS
• CWE-331

Net::Dropbox::API 1.9 and earlier for Perl uses insecure rand() function for cryptographic functions

• NORBU Net::Dropbox::API
• Weak cryptography or TLS
• CWE-331

Web::API 2.8 and earlier for Perl uses insecure rand() function for cryptographic functions

• LEV Web::API
• Weak cryptography or TLS
• CWE-331

Data::Entropy for Perl uses insecure rand() function for cryptographic functions

• ZEFRAM Data::Entropy
• Weak cryptography or TLS
• CWE-331