Use of Cryptographically Weak Pseudo-Random Number Generator in yiisoft/yii2-dev

Description

References

• nvd.nist.gov/vuln/detail/CVE-2021-3692 · ADVISORY
• yiisoft/yii2 commit 13f27e4 · WEB
• yiisoft/yii2 · PACKAGE
• huntr.dev/bounties/55517f19-5c28-4db2-8b00-f78f841e8aba · WEB

Weitere Schwachstellen in yiisoft/yii2-dev

• CVE-2025-2689KRITISCH 9.8A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45. Affected by this issue is the function getIt…
• CVE-2021-3689HOCH 7.5yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator
• CVE-2018-8074HOCH 8.1Yii 2.x before 2.0.15 allows remote attackers to inject unintended search conditions via a variant of the CVE-2018-7269 attack in conjunctio…
• CVE-2018-7269KRITISCH 9.8The findByCondition function in framework/db/ActiveRecord.php in Yii 2.x before 2.0.15 allows remote attackers to conduct SQL injection atta…
• CVE-2018-6009HOCH 8.8In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.