CVE-2024-8796

MEDIUM Year: 2024
CVSS v3 Score
5.3
Medium
Weakness Type
CWE-331
View all →

Vulnerability Description

Under the default configuration, Devise-Two-Factor versions >= 2.2.0 & < 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum defined by RFC 4226. Using a shared secret shorter than the minimum to generate a multi-factor authentication code could make it easier for an attacker to guess the shared secret and generate valid TOTP codes.

Related Vulnerabilities

CVE-2019-14317

MEDIUM
CVSS:5.3(Medium)

wolfSSL and wolfCrypt 4.1.0 and earlier (formerly known as CyaSSL) generate biased DSA nonces. This allows a remote attacker to compute the long term private key from several hundred DSA signatures vi...

CWE-3312019

CVE-2019-9555

MEDIUM
CVSS:5.3(Medium)

Sagemcom F@st 5260 routers using firmware version 0.4.39, in WPA mode, default to using a PSK that is generated from a 2-part wordlist of known values and a nonce with insufficient entropy. The number...

CWE-3312019

CVE-2021-4240

MEDIUM
CVSS:5.3(Medium)

A vulnerability, which was classified as problematic, was found in phpservermon. This affects the function generatePasswordResetToken of the file src/psm/Service/User.php. The manipulation leads to us...

CWE-3312021

CVE-2021-4241

MEDIUM
CVSS:5.3(Medium)

A vulnerability, which was classified as problematic, was found in phpservermon. Affected is the function setUserLoggedIn of the file src/psm/Service/User.php. The manipulation leads to use of predict...

CWE-3312021

CVE-2022-33989

MEDIUM
CVSS:5.3(Medium)

dproxy-nexgen (aka dproxy nexgen) uses a static UDP source port (selected randomly only at boot time) in upstream queries sent to DNS resolvers. This allows DNS cache poisoning because there is not en...

CWE-3312022

CVE-2023-34973

MEDIUM
CVSS:5.3(Medium)

An insufficient entropy vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote users to predict secret via unspecified vectors. We hav...

CWE-3312023