目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-330 使用不充分的随机数 类漏洞列表 126

CWE-330 使用不充分的随机数 类弱点 126 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-330属于密码学相关漏洞，指在依赖不可预测数值的安全场景中使用了随机性不足的数值。攻击者通常通过分析伪随机数生成器的弱点，预测或重现关键值，从而绕过身份验证或会话管理。开发者应避免使用标准库中的伪随机函数处理敏感数据，转而采用操作系统提供的加密安全随机数生成器，并确保种子来源具备足够的熵，以保障数值不可预测性。

MITRE CWE 官方描述
CWE：CWE-330 使用不足够随机的值 (Use of Insufficiently Random Values) 英文：产品在一个依赖于不可预测数字的安全上下文中使用了不足够随机的数字或值。
常见影响 (3)
Confidentiality, Other Other
When a protection mechanism relies on random values to restrict access to a sensitive resource, such as a session ID or a seed for generating a cryptographic key, then the resource being protected could be accessed by guessing the ID or key.
Access Control, Other Bypass Protection Mechanism, Other
If product relies on unique, unguessable IDs to identify a resource, an attacker might be able to guess an ID for a resource that is owned by another user. The attacker could then read the resource, or pre-create a resource with the same ID to prevent the legitimate program from properly sending the…
Access Control Bypass Protection Mechanism, Gain Privileges or Assume Identity
When an authorization or authentication mechanism relies on random values to restrict access to restricted functionality, such as a session ID or a seed for generating a cryptographic key, then an attacker may access the restricted functionality by guessing the ID or key.
缓解措施 (3)
Architecture and Design Use a well-vetted algorithm that is currently considered to be strong by experts in the field, and select well-tested implementations with adequate length seeds. In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in security-sensitive contexts. Pseudo-random number generators can produce…
Implementation Consider a PRNG that re-seeds itself as needed from high quality pseudo-random output sources, such as hardware devices.
Architecture and Design, Requirements Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
代码示例 (2)
This code attempts to generate a unique random identifier for a user's session.
function generateSessionID($userID){ srand($userID); return rand(); }
Bad · PHP
The following code uses a statistical PRNG to create a URL for a receipt that remains active for some period of time after a purchase.
String GenerateReceiptURL(String baseUrl) { Random ranGen = new Random(); ranGen.setSeed((new Date()).getTime()); return(baseUrl + ranGen.nextInt(400000000) + ".html"); }
Bad · Java
CVE ID 标题 CVSS 风险等级 Published
CVE-2025-64097 NervesHub 安全特征问题漏洞 — nerves_hub_web 8.1AI High AI 2026-01-22
CVE-2025-68704 Jervis 安全特征问题漏洞 — jervis 7.5AI High AI 2026-01-13
CVE-2025-11723 WordPress plugin Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin 安全特征问题漏洞 — Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin 6.5 Medium 2026-01-06
CVE-2025-11707 WordPress plugin Login Lockdown & Protection 安全特征问题漏洞 — Login Lockdown & Protection 5.3 Medium 2025-12-13
CVE-2025-13955 EZCast Pro II 安全漏洞 — EZCast Pro II 8.1AI High AI 2025-12-10
CVE-2025-66511 Nextcloud Calendar 安全特征问题漏洞 — security-advisories 4.8 Medium 2025-12-05
CVE-2025-13353 gokey 安全漏洞 — gokey 9.1AI Critical AI 2025-12-02
CVE-2025-59371 ASUS Router 安全漏洞 — Router 8.8AI High AI 2025-11-25
CVE-2025-13470 RNP 安全漏洞 — RNP 7.5 High 2025-11-21
CVE-2025-12787 WordPress plugin Hydra Booking — Appointment Scheduling & Booking Calendar 安全特征问题漏洞 — Hydra Booking — Appointment Scheduling & Booking Calendar 5.3 Medium 2025-11-11
CVE-2025-6515 oatpp-mcp 安全特征问题漏洞 — oatpp-mcp 6.8 Medium 2025-10-20
CVE-2025-10745 WordPress plugin Banhammer 安全特征问题漏洞 — Banhammer – Monitor Site Traffic, Block Bad Users and Bots 5.3 Medium 2025-09-26
CVE-2025-10671 e-learning 安全特征问题漏洞 — e-learning 3.7 Low 2025-09-18
CVE-2025-7783 form-data 安全漏洞 8.2 - 2025-07-18
CVE-2025-43866 vantage6 安全特征问题漏洞 — vantage6 6.5AI Medium AI 2025-06-12
CVE-2025-49198 SICK Field Analytics和SICK Media Server 安全漏洞 — SICK Media Server 3.1 Low 2025-06-12
CVE-2025-4607 WordPress plugin PSW Front-end Login & Registration 安全特征问题漏洞 — PSW Front-end Login & Registration 9.8 Critical 2025-05-31
CVE-2025-5136 Tmall_demo 安全特征问题漏洞 — Demo 3.7 Low 2025-05-24
CVE-2025-1953 AIBrix 安全特征问题漏洞 — AIBrix 2.6 Low 2025-03-04
CVE-2024-10604 Fuchsia 安全漏洞 — Fuchsia 7.5 - 2025-01-30
CVE-2025-22150 undici 安全特征问题漏洞 — undici 6.8 Medium 2025-01-21
CVE-2024-12432 WordPress plugin WPC Shop as a Customer for WooCommerce 安全特征问题漏洞 — WPC Shop as a Customer for WooCommerce 8.1 High 2024-12-18
CVE-2024-52615 Avahi 安全漏洞 5.3 Medium 2024-11-21
CVE-2024-20331 Cisco Firepower Threat Defense和Cisco Adaptive Security Appliance 安全漏洞 — Cisco Adaptive Security Appliance (ASA) Software 6.8 Medium 2024-10-23
CVE-2024-47188 Suricata 安全特征问题漏洞 — suricata 7.5 High 2024-10-16
CVE-2024-47187 Suricata 安全特征问题漏洞 — suricata 7.5 High 2024-10-16
CVE-2024-6348 Nissan Altima Blind Spot Detection Sensor ECU 安全漏洞 — Altima 6.1AI Medium AI 2024-08-19
CVE-2024-42475 oauth 安全漏洞 — oauth 6.5 Medium 2024-08-15
CVE-2024-42165 FIWARE Keyrock 安全漏洞 — FIWARE Keyrock 6.3 Medium 2024-08-12
CVE-2024-7659 ProjectSend 安全特征问题漏洞 — projectsend 3.7 Low 2024-08-11

CWE-330（使用不充分的随机数） 是常见的弱点类别，本平台收录该类弱点关联的 126 条 CVE 漏洞。