CWE-340.

Ivanti Connect Secure: Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and…

• Ivanti Connect Secure
• CWE-340

Bucket Squatting in Cloud Run MCP leads to Service Account Takeover

• Google Cloud Cloud Run MCP
• CWE-340

Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS

• zephyr
• CWE-340

Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset

• intranda goobi-viewer-core
• Weak cryptography or TLS
• CWE-340

Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset

• intranda goobi-viewer-core
• Weak cryptography or TLS
• CWE-340

Botslab G980H Dashcams Generation of Predictable Numbers or Identifiers

• Botslab G980H
• CWE-340

Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token

• concretecms-community-store community_store
• CWE-340

Generation of Predictable Email Confirmation Token in ATutor

• ATutor
• CWE-340

Weak File Name Generation in vsDesk

• vsDesk
• CWE-340
• CWE-377

OpnForm Editable Submission Secret Derivation via Empty Hashids Salt

• OpnForm
• CWE-340

Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable

• Weak cryptography or TLS
• CWE-340

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2.

• cyrusimap Cyrus IMAP
• CWE-340

CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources

• MARKSTOS CGI::Session::ID::md5
• Weak cryptography or TLS
• CWE-340

Setracker2 Children's Smartwatch Ecosystem Generation of Predictable Numbers or Identifiers

• Shenzhen i365-Tech Co. Ltd. Setracker2 Parental Control App (Android) package com.tgelec.setracker
• CWE-340

Account Takeover via Predictable SSO Ticket Generation

• zohocorp manageengine_adselfservice_plus
• zohocorp manageengine_recovery_manager_plus
• Authentication bypass
• Weak cryptography or TLS

Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter

• HAYAJO Mojolicious::Plugin::Web::Auth::OAuth2
• Weak cryptography or TLS
• CWE-340

Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely

• HAYAJO Mojolicious::Sessions::Storable
• Weak cryptography or TLS
• CWE-340

Naxclow IoT Platform Generation of Predictable Numbers or Identifiers

• Naxclow Smart Doorbell X3
• Naxclow X Smart Home
• CWE-340

Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port

• Weak cryptography or TLS
• CWE-340

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids

• GUIMARD Apache::Session::Generate::SHA256
• Weak cryptography or TLS
• CWE-340

WebDyne::Session versions before 3.003_704 for Perl generate the session id insecurely

• ASPEER WebDyne::Session
• Weak cryptography or TLS
• CWE-340

Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure

• CHORNY Apache::Session::Generate::ModUniqueId
• CWE-340
• CWE-341

Dancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurely

• BIGPRESH Dancer::Session::Abstract
• Weak cryptography or TLS
• CWE-340

FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force

• freescout
• Weak cryptography or TLS
• CWE-340

Solstice::Session versions through 1440 for Perl generates session ids insecurely

• MCRAWFOR Solstice::Session
• Weak cryptography or TLS
• CWE-340

Ado::Sessions versions through 0.935 for Perl generates insecure session ids

• BEROV Ado::Sessions
• Weak cryptography or TLS
• CWE-340

Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id

• TOKUHIROM Amon2::Plugin::Web::CSRFDefender
• Weak cryptography or TLS
• CWE-340

Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver

• Erlang OTP
• CWE-340

Multiple Vulnerabilities in IBM Concert Software

• IBM Concert
• CWE-340

HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids

• KTAT HTTP::Session
• Weak cryptography or TLS
• CWE-340

Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions

• TOKUHIROM Amon2
• Weak cryptography or TLS
• CWE-340

Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit

• CWE-283
• CWE-340

<0.1.13 · fixed in 0.1.13

Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id

• CHORNY Apache::Session::Generate::MD5
• Weak cryptography or TLS
• CWE-340

Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely

• KAZEBURO Plack::Middleware::Session::Simple
• Weak cryptography or TLS
• CWE-340

HTTP::Session2 versions before 1.12 for Perl may generate weak session ids using the rand() function

• TOKUHIROM HTTP::Session2
• Weak cryptography or TLS
• CWE-340

Apache::SessionX versions through 2.01 for Perl create insecure session id

• GRICHTER Apache::SessionX
• Weak cryptography or TLS
• CWE-340

Google Cloud Vertex AI has a a vulnerability involving predictable bucket naming

• CWE-340

>=1.21.0, <1.133.0 · fixed in 1.133.0

Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids

• BVA Concierge::Sessions
• Weak cryptography or TLS
• CWE-340

Jervis has Deterministic AES IV Derivation from Passphrase

• Weak cryptography or TLS
• CWE-340

<2.2 · fixed in 2.2

RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability

• infiniflow ragflow
• CWE-340

Predictable Generation of Password Recovery Token

• SOPlanning
• CWE-340

BIG-IP TMM vulnerability

• F5 BIG-IP
• CWE-340

Weak Session Token used in Automation Runtime SDM

• B&R Industrial Automation GmbH Automation Runtime
• CWE-340

YoSmart YoLink API: The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a…

• YoSmart YoLink API
• CWE-340

Starch versions 0.14 and earlier generate session ids insecurely

• BLUEFEET Starch
• Weak cryptography or TLS
• CWE-340

Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely

• KGOLDOV Apache::AuthAny
• Weak cryptography or TLS
• CWE-340

predictable WebSocket mask

• curl
• CWE-340

Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces

• ETHER Catalyst::Authentication::Credential::HTTP
• Weak cryptography or TLS
• CWE-340

Catalyst::Plugin::Session before version 0.44 for Perl generates session ids insecurely

• HAARG Catalyst::Plugin::Session
• Weak cryptography or TLS
• CWE-340

Authen::DigestMD5 versions 0.01 through 0.04 for Perl generate the cnonce insecurely

• SALVA Authen::DigestMD5
• Weak cryptography or TLS
• CWE-340

Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely

• EHUELS Authen::SASL::Perl::DIGEST_MD5
• Weak cryptography or TLS
• CWE-340

Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely

• MIYAGAWA Plack::Middleware::Session
• Weak cryptography or TLS
• CWE-340

Google gVisor: Weaknesses in the generation of TCP/UDP source ports and some other header values in…

• Google gVisor
• CWE-340

pgAgent scheduled batch job scripts are created in a predictable temporary directory potentially allowing a denial of service

• pgAgent
• CWE-340

Advanced Google reCAPTCHA <= 1.25 - Brute Force Protection IP Unblock

• webfactory Advanced Google reCAPTCHA
• CWE-340

Salt preflight script could be attacker controlled

• CWE-340

<3005.4 || >=3006.0rc1, <3006.4 · fixed in 3005.4, 3006.4

The PDF viewer macro allows accessing any attachment without access right checks

• xwikisas macro-pdfviewer
• CWE-340

Predictable Session ID

• RITTAL GmbH & Co. KG IoT Interface & CMC III Processing Unit
• CWE-340

JUJU_CONTEXT_ID is a predictable authentication secret in github.com/juju/juju

• Hard-coded credentials
• CWE-337

<0.0.0-20240826044107-ecd7e2d0e986 · fixed in 0.0.0-20240826044107-ecd7e2d0e986

Generation of predictable identifiers issue exists in Cente middleware TCP/IP Network Series.

• DMG MORI Digital Co., LTD. and NEXT Co., Ltd. Cente TCP/IPv4
• DMG MORI Digital Co., LTD. and NEXT Co., Ltd. Cente TCP/IPv4 SNMPv2
• CWE-340