CWE-330: Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
CWE Reference
CWE in architecture and design requirements
Browse cwe in architecture and design requirements with official CWE context and Glexia analysis.
Release 4.20listing
Search And Filters
Browse CWE records
Showing 11 of 11 CWE records.
CWE-332: Insufficient Entropy in PRNG
The lack of entropy available for, or used by, a Pseudo-Random Number Generator (PRNG) can be a stability and security threat.
CWE-334: Small Space of Random Values
The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks.
CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG)
A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized.
CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)
A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
CWE-339: Small Seed Space in PRNG
A Pseudo-Random Number Generator (PRNG) uses a relatively small seed space, which makes it more susceptible to brute force attacks.
CWE-341: Predictable from Observable State
A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.
CWE-342: Predictable Exact Value from Previous Values
An exact value or random number can be precisely predicted by observing previous values.
CWE-343: Predictable Value Range from Previous Values
The product's random number generator produces a series of values which, when observed, can be used to infer a relatively small range of possibilities for the next value that could be generated.
CWE-474: Use of Function with Inconsistent Implementations
The code uses a function that has inconsistent implementations across operating systems and versions.
CWE-1342: Information Exposure through Microarchitectural State after Transient Execution
The processor does not properly clear microarchitectural state after incorrect microcode assists or speculative execution, resulting in transient execution.