CVE-2021-4240

MEDIUM Year: 2021
CVSS v3 Score
5.3
Medium
Weakness Type
CWE-331
View all →

Vulnerability Description

A vulnerability, which was classified as problematic, was found in phpservermon. This affects the function generatePasswordResetToken of the file src/psm/Service/User.php. The manipulation leads to use of predictable algorithm in random number generator. The exploit has been disclosed to the public and may be used. The name of the patch is 3daa804d5f56c55b3ae13bfac368bb84ec632193. It is recommended to apply a patch to fix this issue. The identifier VDB-213717 was assigned to this vulnerability.

Related Vulnerabilities

CVE-2019-14317

MEDIUM
CVSS:5.3(Medium)

wolfSSL and wolfCrypt 4.1.0 and earlier (formerly known as CyaSSL) generate biased DSA nonces. This allows a remote attacker to compute the long term private key from several hundred DSA signatures vi...

CWE-3312019

CVE-2019-9555

MEDIUM
CVSS:5.3(Medium)

Sagemcom F@st 5260 routers using firmware version 0.4.39, in WPA mode, default to using a PSK that is generated from a 2-part wordlist of known values and a nonce with insufficient entropy. The number...

CWE-3312019

CVE-2021-4241

MEDIUM
CVSS:5.3(Medium)

A vulnerability, which was classified as problematic, was found in phpservermon. Affected is the function setUserLoggedIn of the file src/psm/Service/User.php. The manipulation leads to use of predict...

CWE-3312021

CVE-2022-33989

MEDIUM
CVSS:5.3(Medium)

dproxy-nexgen (aka dproxy nexgen) uses a static UDP source port (selected randomly only at boot time) in upstream queries sent to DNS resolvers. This allows DNS cache poisoning because there is not en...

CWE-3312022

CVE-2023-34973

MEDIUM
CVSS:5.3(Medium)

An insufficient entropy vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote users to predict secret via unspecified vectors. We hav...

CWE-3312023

CVE-2023-38357

MEDIUM
CVSS:5.3(Medium)

Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized access to user sessions.

CWE-3312023