Search Vulnerabilities

Jervis has Deterministic AES IV Derivation from Passphrase

RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability

Predictable Generation of Password Recovery Token

BIG-IP TMM vulnerability

Weak Session Token used in Automation Runtime SDM

The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a device's MAC address along with an MD5 hash of non-secret inf...

Starch versions 0.14 and earlier generate session ids insecurely

Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely

Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces

Catalyst::Plugin::Session before version 0.44 for Perl generates session ids insecurely

Authen::DigestMD5 versions 0.01 through 0.04 for Perl generate the cnonce insecurely

Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely

Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely

Weaknesses in the generation of TCP/UDP source ports and some other header values in Google's gVisor allowed them to be predicted by an external at...

pgAgent scheduled batch job scripts are created in a predictable temporary directory potentially allowing a denial of service

Advanced Google reCAPTCHA <= 1.25 - Brute Force Protection IP Unblock

The PDF viewer macro allows accessing any attachment without access right checks

Predictable Session ID

JUJU_CONTEXT_ID is a predictable authentication secret

Default client side session signing key is highly predictable