Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Every one of the 190 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Apache StreamPipes <= 0.93.0 - Use of Cryptographically Weak PRNG in Recovery Token GenerationCVE-2024-29868Apache Software Foundation · CVSS 9.1 · 6.0% likely

   Apache

2. CodiMD <2.5.4 - Insecure Filename RandomizationCVE-2024-38353hackmdio · CVSS 5.3 · 1.1% likely
3. OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remo…CVE-2008-0166Openssl · 71% likely

   OpenSSL

4. cgi-bin/makecgi-pro in Iomega StorCenter Pro generates predictable session IDs, which allows remote attackers to hijack active sessions and gain privileges via brute force guessin…CVE-2009-2367Iomega · 23% likely

   Iomega

5. In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signature…CVE-2024-31497Putty · CVSS 5.9 · 5.7% likely

   Putty

6. RabbitMQ exposes ports with weak default secrets in Zulip ServerCVE-2021-43799zulip · CVSS 8.6 · 5.4% likely

   Zulip

7. It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator (CVE-2008-0166). In…CVE-2008-3280Openid · 4.0% likely

   Openid

8. An issue was discovered in Open Source Social Network (OSSN) through 5.3. A user-controlled file path with a weak cryptographic rand() can be used to read any file with the permis…CVE-2020-10560Opensource-Socialnetwork · 3.8% likely

   Opensource-Socialnetwork

9. A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness (apache.commons.lang3 Random…CVE-2019-16303Jhipster · 3.7% likely

   Jhipster

10. The Bitcoin Proof-of-Work algorithm does not consider a certain attack methodology related to 80-byte block headers with a variety of initial 64-byte chunks followed by the same 1…CVE-2017-9230Bitcoin · CVSS 7.5 · 3.3% likely

    Bitcoin

11. wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers…CVE-2017-5493Wordpress · 2.9% likely

    WordPress

12. Apache Cloudstack insecure random number generation affects project email invitationCVE-2022-26779Apache Software Foundation · 2.9% likely

    Apache

13. In InfiniteWP Admin Panel before 3.1.12.3, resetPasswordSendMail generates a weak password-reset code, which makes it easier for remote attackers to conduct admin Account Takeover…CVE-2020-28642Infinitewp · 2.6% likely
14. It was discovered that QtPass before 1.2.1, when using the built-in password generator, generates possibly predictable and enumerable passwords. This only applies to the QtPass GU…CVE-2017-18021Qtpass · 2.4% likely
15. A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7daf2b8e1d60c45. Due to insecure randomn…CVE-2021-3538Satori · 2.3% likely
16. A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. The…CVE-2022-35255NodeJS · CVSS 9.1 · 2.1% likely

    Node.js2 bounty reports

17. The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predict…CVE-2019-19794Miekg-Dns Project · 2.1% likely
18. The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers.CVE-2015-9435Dash10 · 2.1% likely
19. Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing KeyCVE-2026-61500rejetto · CVSS 9.8 · 1.9% likelycovered by CyberSIXT

    Rejetto4 articles

20. The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use of an mt19937 Mersenne Twister PRNG re…CVE-2023-39910Libbitcoin · 1.8% likely
21. An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. Random number generation is mishandled, which makes it easier for attackers to predict a Sydent…CVE-2019-11842Matrix · 1.8% likely

    Matrix

22. Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due t…CVE-2019-10754Apereo · 1.8% likely

    Apereo

23. The maxRandom function of a smart contract implementation for All For One, an Ethereum gambling game, generates a random value with publicly readable variables because the _seed v…CVE-2018-12056All-For-One · 1.7% likely
24. A lottery smart contract implementation for Greedy 599, an Ethereum gambling game, generates a random value that is predictable via an external contract call. The developer used t…CVE-2018-17877Greedy599 · 1.6% likely
25. The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value,…CVE-2009-3238Linux · 1.6% likely

    Linux

26. An issue was discovered in Enigmail before 1.9.9. Improper Random Secret Generation occurs because Math.Random() is used by pretty Easy privacy (pEp), aka TBE-01-001.CVE-2017-17845Enigmail · 1.6% likely

    Enigmail

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.