← Vulnerability feed

Vulnerability record · CVE-2013-2260 · published 4 November 2019

CVE-2013-2260: Cryptocat project cryptocat vulnerability

Cryptocat Project · Cryptocat

Cryptocat before 2.0.22: Cryptocat.random() Function Array Key has Entropy Weakness

9.8 CVSS 3.1 Critical EPSS 2.2% · top 18.5% CWE-331 · CWE-331
9.8CVSS 3.1 base score, v2 5.0
2.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
16 Jun 2026Last modified by NVD

Description

Cryptocat before 2.0.22: Cryptocat.random() Function Array Key has Entropy Weakness

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://tobtu.com/decryptocat.php Vendor Advisory
https://vuldb.com/?id.9435 Permissions RequiredThird Party Advisory
https://www.openwall.com/lists/oss-security/2013/07/10/15 Mailing ListThird Party Advisory
https://www.securityfocus.com/bid/61091/info Third Party AdvisoryVDB Entry
https://tobtu.com/decryptocat.php Vendor Advisory
https://vuldb.com/?id.9435 Permissions RequiredThird Party Advisory
https://www.openwall.com/lists/oss-security/2013/07/10/15 Mailing ListThird Party Advisory
https://www.securityfocus.com/bid/61091/info Third Party AdvisoryVDB Entry

Track CVE-2013-2260 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2013-4108Cryptocat project cryptocat vulnerabilityMultiple unspecified vulnerabilities in Cryptocat Project Cryptocat 2.0.18 have unknown impact and attack vectors.EPSS 1.5%9.8CVE-2013-2259Cryptocat project cryptocat improper input validation vulnerabilityCryptocat before 2.0.22 has Arbitrary Code Execution on Firefox Conversation OverviewEPSS 3.7%9.8CVE-2013-4103Cryptocat project cryptocat improper input validation vulnerabilityCryptocat before 2.0.22 has Remote Script Injection due to improperly sanitizing user inputEPSS 6.9%9.1CVE-2013-4102Cryptocat project cryptocat vulnerabilityCryptocat before 2.0.22 strophe.js Math.random() Random Number Generator WeaknessEPSS 2.0%7.5CVE-2013-4105Cryptocat project cryptocat information exposure vulnerabilityCryptocat before 2.0.22 has Multiparty Encryption Scheme Information DisclosureEPSS 1.1%7.5CVE-2013-2257Cryptocat project cryptocat improper restriction of authentication attempts vulnerabilityCryptocat before 2.0.42 has Group Chat ECC Private Key Generation Brute Force WeaknessEPSS 2.0%7.5CVE-2013-2261Cryptocat project cryptocat information exposure vulnerabilityCryptocat before 2.0.22 Chrome Extension 'img/keygen.gif' has Information DisclosureEPSS 12%7.5CVE-2013-2262Cryptocat project cryptocat information exposure vulnerabilityCryptocat strophe.js before 2.0.22 has information disclosureEPSS 1.9%

Source: NIST National Vulnerability Database (record CVE-2013-2260), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.