Threats Tagged 'cwe-337'

CVE-2026-25235 is a high-severity vulnerability in the PEAR pearweb PHP framework prior to version 1.33.0. It involves a predictable seed in the pseudo-random number generator used to create verification hashes, allowing attackers to guess verification tokens. This flaw can enable unauthorized verification of election account requests, potentially compromising account integrity. The vulnerability requires no user interaction and can be exploited remotely without authentication. It has a CVSS 4.0 score of 8.2, indicating a significant risk. Although no known exploits are currently in the wild, the issue has been patched in version 1.

HighVulnerabilityGermanyFranceNetherlands+4#cve#cve-2026-25235#cwe-337

Sakai is a Collaboration and Learning Environment. Prior to versions 23.5 and 25.0, EncryptionUtilityServiceImpl initialized an AES256TextEncryptor password (serverSecretKey) using RandomStringUtils with the default java.util.Random.java.util.Random is a non‑cryptographic PRNG and can be predicted from limited state/seed information (e.g., start time window), substantially reducing the effective search space of the generated key. An attacker who can obtain ciphertexts (e.g., exported or at‑rest strings protected by this service) and approximate the PRNG seed can feasibly reconstruct the serverSecretKey and decrypt affected data. SAK-49866 is patched in Sakai 23.5, 25.0, and trunk.

MediumVulnerabilityUnited KingdomGermanyFrance+7#cve#cve-2025-62710#cwe-337

A predictable seed in pseudo-random number generator vulnerability has been discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software implements a predictable seed for its pseudo-random number generator, which compromises the security of the generated private keys.

HighVulnerabilityGermanyFranceItaly+7#cve#cve-2025-55069#cwe-337

Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API. The session IDs are generated using a predictable method based on the current timestamp, allowing attackers to recreate valid session IDs. When combined with the ability to circumvent session ID requirements for certain commands, this enables unauthorized access to sensitive device functions on connected solar optimization systems.

HighVulnerabilityGermanySpainItaly+4#cve#cve-2025-7770#cwe-337

cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`.

LowVulnerabilityGermanyFranceNetherlands+3#cve#cve-2024-22194#cwe-215