CWE-341.

Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys

• GitroomHQ postiz-app
• Weak cryptography or TLS
• CWE-341

Missing S3 bucket ownership verification in the AWS Security Agent MCP server

• AWS Security Agent MCP server
• CWE-283
• CWE-341

Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops

• AWS Security Agent plugin
• CWE-283
• CWE-341

Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey

• CWE-341

Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc client

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.6
• CWE-341

ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking.

• CWE-341

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests from the same source IP.

• Weak cryptography or TLS
• CWE-341

Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure

• CHORNY Apache::Session::Generate::ModUniqueId
• CWE-340
• CWE-341

GeoVision LPC2011/LPC2211 Web Interface guessable session cookie vulnerability

• GeoVision Inc. GV-LPC2011/LPC2211
• CWE-341

jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed

• jq
• Weak cryptography or TLS
• Denial of service

Cache poisoning due to weak PRNG

• ISC BIND 9
• CWE-341

Predictable Object Identifier vulnerability in SAP NetWeaver AS Java (IIOP Service)

• SAP_SE SAP NetWeaver AS Java (IIOP Service)
• CWE-341

Weak Session Cookie Entropy

• Advantech Wireless Sensing and Equipment (WISE)
• CWE-341

jsbroks COCO Annotator Session predictable state

• jsbroks COCO Annotator
• CWE-341

Bruteforcing authentication cookie for a given user

• Hongdian H8951-4G-ESP
• CWE-341

fredsmith utils Filename screenshot_sync predictable state

• fredsmith utils
• CWE-341

Dell EMC Isilon versions 8.2.2 and earlier contain a remotesupport vulnerability.

• Dell Isilon OneFS
• CWE-341

Predictable password in Keycloak

• Weak cryptography or TLS
• CWE-341

<8.0.2 · fixed in 8.0.2

Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the administrator's password, which could lead to a full compromise of the device.

• ICS-CERT Moxa IKS, EDS
• CWE-341

Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server: All versions of Hangzhou Xiongmai Technology Co…

• Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server
• CWE-341