CWE-334

W Moxa MXsecurity w wersjach wcześniejszych niż 1.0.1 istnieje krytyczna podatność umożliwiająca ominięcie mechanizmu uwierzytelnienia. Zdalny atakujący może uzyskać dostęp do systemu bez posiadania prawidłowych poświadczeń.

Oprogramowanie MegaBIP generuje tokeny resetowania hasła w oparciu o zbyt małą przestrzeń losowych wartości połączoną z wartością możliwą do odpytania. Podatność umożliwia nieuwierzytelnionemu atakującemu przejęcie dowolnego konta, w tym kont administratorów.

Biblioteka crypto-js w wersjach przed 4.0.0 generuje losowość przy użyciu kryptograficznie niebezpiecznego generatora pseudolosowego opartego na Math.random(), co drastycznie redukuje przestrzeń możliwych wartości. Atakujący może w praktyce wyliczyć wszystkie możliwe wyniki i odtworzyć klucze prywatne portfeli kryptowalutowych opartych na tej bibliotece.

Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password.

The TETRA TEA1 keystream generator implements a key register initialization function that compresses the 80-bit key to only 32 bits for usage during the keystream generation phase, which is insufficient to safeguard against exhaustive search attacks.

An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets. This results in the communication channel to be closed.

An authentication bypass vulnerability exists in the get_aes_key_info_by_packetid() function of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. Generic network sniffing can lead to password recovery. An attacker can sniff network traffic to trigger this vulnerability.

A CWE-334: Small Space of Random Values vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption keys when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller.

Podatność dotyczy licznych urządzeń serii SIPROTEC 5 w określonych wersjach. Zagrożone urządzenia nie generują session identifiers z wystarczającą randomizacją, co umożliwia niezalogowanemu atakującemu brute force'owanie identyfikatorów sesji i uzyskanie nieautoryzowanego dostępu do ograniczonych informacji z serwera webowego.

A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive the WPA2 PSK key and authenticate without permission to the drone’s Wi- Fi network. This, in turn, allows the attacker to perform unauthorized interaction with the network services exposed by the drone and to potentially decrypt the Wi-Fi traffic exchanged between the drone and the Android/IOS device of the legitimate user during QuickTransfer mode. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620.

A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.

A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to access sensitive information. This vulnerability is due to missing authorization for certain resources in the web-based management interface together with insufficient entropy in these resource names. An attacker could exploit this vulnerability by sending a series of HTTPS requests to an affected device to enumerate resources on the device. A successful exploit could allow the attacker to retrieve sensitive information from the device.

Improper identifier creation logic in Find My Mobile prior to version 7.2.24.12 allows attacker to identify the device.

An insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially enroll an attacker-controlled device to the victim’s account and telephone number.