https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 17:12:09 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-57639 EUVD-2026-57639 https://cve.radiocsirt.org/vuln/euvd-2026-57639 https://cve.radiocsirt.org/vuln/fkie_cve-2019-16303 <p>A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness (apache.commons.lang3 RandomStringUtils). This allows an attacker (if able to obtain their own password reset URL) to compute the value for all other password resets for other accounts, thus allowing privilege escalation or account takeover.</p> <p>A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness (apache.commons.lang3 RandomStringUtils). This allows an attacker (if able to obtain their own password reset URL) to compute the value for all other password resets for other accounts, thus allowing privilege escalation or account takeover.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-16303 https://cve.radiocsirt.org/vuln/ghsa-j3rh-8vwq-wh84 <p><strong>Affected:</strong> npm: generator-jhipster-kotlin</p> <p>JHipster Kotlin is using an insecure source of randomness to generate all of its random values. JHipster Kotlin relies upon apache commons lang3 `RandomStringUtils`.</p> <p>From the documentation:</p> <p>&gt; Caveat: Instances of Random, upon which the implementation of this class relies, are not cryptographically secure. &gt; \- https://commons.apache.org/proper/commons-lang/javadocs/api-3.9/org/apache/commons/lang3/RandomStringUtils.html</p> <p>Here are the examples of JHipster Kotlin&#39;s use of an insecure PRNG:</p> <p>https://github.com/jhipster/jhipster-kotlin/blob/193ae8f13c0be686f9687e78bacfedb144c47d8c/generators/server/templates/src/main/kotlin/package/service/util/RandomUtil.kt.ejs#L32</p> <p>## Proof Of Concepts Already Exist</p> <p>There has been a POC of taking one RNG value generated `RandomStringUtils` and reversing it to generate all of the past/future RNG values public since March 3rd, 2018.</p> <p>https://medium.com/@alex91ar/the-java-soothsayer-a-practical-application-for-insecure-randomness-c67b0cd148cd</p> <p>POC Repository: https://github.com/alex91ar/randomstringutils</p> <p>## Potential Impact Technical</p> <p>All that is required is to get one password reset token from a JHipster Kotlin generated service and using the POC above, you can reverse what all future password reset tokens to be generated by this server. This allows an attacker to pick and choose what account they would like to takeover by sending account password reset requests for targeted accounts.</p> <p>## Potential Impact Scale</p> <p>Not as large as for the orig…</p> <p><strong>Affected:</strong> npm: generator-jhipster-kotlin</p> <p>JHipster Kotlin is using an insecure source of randomness to generate all of its random values. JHipster Kotlin relies upon apache commons lang3 `RandomStringUtils`.</p> <p>From the documentation:</p> <p>&gt; Caveat: Instances of Random, upon which the implementation of this class relies, are not cryptographically secure. &gt; \- https://commons.apache.org/proper/commons-lang/javadocs/api-3.9/org/apache/commons/lang3/RandomStringUtils.html</p> <p>Here are the examples of JHipster Kotlin&#39;s use of an insecure PRNG:</p> <p>https://github.com/jhipster/jhipster-kotlin/blob/193ae8f13c0be686f9687e78bacfedb144c47d8c/generators/server/templates/src/main/kotlin/package/service/util/RandomUtil.kt.ejs#L32</p> <p>## Proof Of Concepts Already Exist</p> <p>There has been a POC of taking one RNG value generated `RandomStringUtils` and reversing it to generate all of the past/future RNG values public since March 3rd, 2018.</p> <p>https://medium.com/@alex91ar/the-java-soothsayer-a-practical-application-for-insecure-randomness-c67b0cd148cd</p> <p>POC Repository: https://github.com/alex91ar/randomstringutils</p> <p>## Potential Impact Technical</p> <p>All that is required is to get one password reset token from a JHipster Kotlin generated service and using the POC above, you can reverse what all future password reset tokens to be generated by this server. This allows an attacker to pick and choose what account they would like to takeover by sending account password reset requests for targeted accounts.</p> <p>## Potential Impact Scale</p> <p>Not as large as for the orig…</p> https://cve.radiocsirt.org/vuln/ghsa-j3rh-8vwq-wh84 https://cve.radiocsirt.org/vuln/gsd-2019-16303 gsd-2019-16303 https://cve.radiocsirt.org/vuln/gsd-2019-16303