CWE-340: Generation of Predictable Numbers or Identifiers

Class

The product uses a scheme that generates numbers or identifiers that are more predictable than required.

Consequences

Other: Varies by Context

Recent advisories

GHSA-4277-m35q-7c9w — Salt preflight script could be attacker controlled
GHSA-mh98-763h-m9v4 — JUJU_CONTEXT_ID is a predictable authentication secret
GHSA-mpmx-gm5v-q789 — Puppet uses predictable filenames, allowing arbitrary file overwrite
GHSA-pp74-39w2-v4w9 — Permissions bypass in pleaser

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor