Draft in the CWE catalog · 13 CVEs mapped
A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a denial of service vulnerability exists in CoreDNS's loop detection plugin that allows an attacker to crash the DNS server by sending specially crafted DNS queries. The vulnerability stems from the use of a predictable pseudo-random number generator (PRNG) for generating a secret query name, combined with a fatal error handler that terminates the entire process. This issue has been patched in version 1.14.2.
⚡ An attacker could guess verification tokens and potentially hijack election account requests with ease! This vulnerability in PEAR is a surprising oversight that needs your attention. 🔥 Think of it like a restaurant that gives every customer a unique number for their order, but the numbers are just sequential. If someone overhears or sees the sequence, they could easily place an unauthorized order claiming they're someone else! If exploited, an attacker could verify election account requests without proper authorization, undermining the integrity of the entire process. This could lead to unauthorized access, manipulation of election results, or other devastating consequences that shake public trust.
Sakai is a Collaboration and Learning Environment. Prior to versions 23.5 and 25.0, EncryptionUtilityServiceImpl initialized an AES256TextEncryptor password (serverSecretKey) using RandomStringUtils with the default java.util.Random. java.util.Random is a non‑cryptographic PRNG and can be predicted from limited state/seed information (e.g., start time window), substantially reducing the effective search space of the generated key. An attacker who can obtain ciphertexts (e.g., exported or at‑rest strings protected by this service) and approximate the PRNG seed can feasibly reconstruct the serverSecretKey and decrypt affected data. SAK-49866 is patched in Sakai 23.5, 25.0, and trunk.