CWE-669: Incorrect Resource Transfer Between Spheres, page 2
Filter
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
What the weakness is: CWE-669 at MITRE
Ask an AI about CWE-669
Show the prompt
Explain CWE-669: Incorrect Resource Transfer Between Spheres and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/669.html and https://cve.bz/cve/cwe/669?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 8.8CVE-2025-41660EPSS 0.4%
A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution.
- 9.0CVE-2026-33265EPSS 0.2%
In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.
- 4.7CVE-2026-32772EPSS 0.2%
telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.
- 8.2CVE-2026-24708EPSS 0.4%
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to …
- 8.8CVE-2026-25253EPSS 32%
OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without prompting, sending a token value.
- 4.3CVE-2025-63387ExploitEPSS 19%
Dify 1.9.1 and 1.17.0 exposes the /console/api/system-features endpoint to unauthenticated HTTP GET requests that return system feature and configuration information. NOTE: The maintainer states that the endpoint is unauthenticated by desi…
- 9.8CVE-2025-67895EPSS 1.2%
Edge3 Worker RPC RCE on Airflow 2. This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if you installed and configured it on Airflow 2. The Edge3 provider support in Airflow 2 has been always development-only and…
- 8.0CVE-2025-62775EPSS 0.3%
Mercku M6a devices through 2.1.0 allow root TELNET logins via the web admin password.
- 7.7CVE-2025-62646EPSS 0.5%
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers.
- 4.0CVE-2024-31573EPSS 0.3%
XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.
- 4.3CVE-2025-62292EPSS 0.2%
In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users can query the /api/v2/users-management/users endpoint and obtain user fields intended for administrators only, including the email addresses …
- 3.5CVE-2025-56675EPSS 0.2%
The EKEN video doorbell T6 BT60PLUS_MAIN_V1.0_GC1084_20230531 periodically sends debug logs to the EKEN cloud servers with sensitive information such as the Wi-Fi SSID and password.
- 3.7CVE-2025-59692EPSS 0.2%
PureVPN client applications on Linux through September 2025 mishandle firewalling. They flush the system's existing iptables rules and apply default ACCEPT policies when connecting to a VPN server. This removes firewall rules that may have…
- 3.7CVE-2025-59691EPSS 0.2%
PureVPN client applications on Linux through September 2025 allow IPv6 traffic to leak outside the VPN tunnel upon network events such as Wi-Fi reconnect or system resume. In the CLI client, the VPN auto-reconnects and claims to be connect…
- 3.2CVE-2025-59453EPSS 0.2%
Click Studios Passwordstate before 9.9 Build 9972 has a potential authentication bypass for Passwordstate emergency access. By using a crafted URL while on the Emergency Access web page, an unauthorized person can gain access to the Passwo…
- 5.7CVE-2025-59378EPSS 0.1%
In guix-daemon in GNU Guix before 1618ca7, a content-addressed-mirrors file can be written to create a setuid program that allows a regular user to gain the privileges of the build user that runs it (even after the build has ended).
- 7.7CVE-2025-59363EPSS 0.3%
In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 (even though this secret should only be returned when an App is first created),
- 8.5CVE-2025-34158EPSS 0.6%
Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the server owner (and a /api/resources call reveals other server…
- 3.2CVE-2025-54956EPSS 0.2%
The gh package before 1.5.0 for R delivers an HTTP response in a data structure that includes the Authorization header from the corresponding HTTP request.
- 3.7CVE-2025-54352EPSS 0.4%
WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior.
- 5.3CVE-2025-54310EPSS 0.5%
qBittorrent before 5.1.2 does not prevent access to a local file that is referenced in a link URL. This affects rsswidget.cpp and searchjobwidget.cpp.
- 8.6CVE-2025-41645EPSS 0.4%
An unauthenticated remote attacker could use a demo account of the portal to hijack devices that were created in that account by mistake.
- 2.1CVE-2025-46553EPSS 0.3%
@misskey-dev/summaly is a tool for getting a summary of a web page. Starting in version 3.0.1 and prior to version 5.2.1, a logic error in the main `summaly` function causes the `allowRedirects` option to never be passed to any plugins, an…
- 2.7CVE-2025-26698EPSS 0.2%
Incorrect resource transfer between spheres issue exists in RevoWorks SCVX and RevoWorks Browser. If exploited, malicious files may be downloaded to the system where using the product.
- 4.1CVE-2024-42158EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings Replace memzero_explicit() and kfree() with kfree_sensitive() to fix warnings reported by Coccinelle: WARNIN…
- 7.8CVE-2024-38519EPSS 0.3%
`yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the downlo…
- 6.5CVE-2024-37891EPSS 1.1%
urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *wit…
- 7.5CVE-2024-29018EPSS 0.7%
Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking implementation allows for many networks, each with their own I…
- 5.3CVE-2023-41894EPSS 0.5%
Home assistant is an open source home automation. The assessment verified that webhooks available in the webhook component are triggerable via the `*.ui.nabu.casa` URL without authentication, even when the webhook is marked as Only accessi…
- 7.5CVE-2023-44104EPSS 0.4%
Broadcast permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5CVE-2023-44100EPSS 0.4%
Broadcast permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5CVE-2023-31115EPSS 0.5%
An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. Incorrect resource transfer between spheres can cause changes to the activation mode of RCS via a crafted application.
- 9.1CVE-2023-31114EPSS 0.6%
An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. Incorrect resource transfer between spheres can cause unintended querying of the SIM status via a crafted application.
- 6.5CVE-2023-22950EPSS 0.7%
An issue was discovered in TigerGraph Enterprise Free Edition 3.x. Data loading jobs in gsql_server, created by any user with designer permissions, can read sensitive data from arbitrary locations.
- 6.5CVE-2022-46173EPSS 0.8%
Elrond-GO is a go implementation for the Elrond Network protocol. Versions prior to 1.3.50 are subject to a processing issue where nodes are affected when trying to process a cross-shard relayed transaction with a smart contract deploy tra…
- 9.8CVE-2022-4446EPSS 1.4%
PHP Remote File Inclusion in GitHub repository tsolucio/corebos prior to 8.0.
- 3.1CVE-2022-39225EPSS 0.5%
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.15, or 5.0.0 and above prior to 5.2.6, a user can write to the session object of another user if the session …
- 8.0CVE-2022-31233EPSS 0.3%
Unisphere for PowerMax versions before 9.2.3.15 contain a privilege escalation vulnerability. An adjacent malicious user may potentially exploit this vulnerability to escalate their privileges and access functionalities they do not have ac…
- 5.3CVE-2022-35916EPSS 0.6%
OpenZeppelin Contracts is a library for secure smart contract development. Contracts using the cross chain utilities for Arbitrum L2, `CrossChainEnabledArbitrumL2` or `LibArbitrumL2`, will classify direct interactions of externally owned a…
- 8.2CVE-2022-30236EPSS 0.8%
A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could allow unauthorized access when an attacker uses cross-domain attacks. Affected Products: Wiser Smart, EER21000 & EER21001 (V4.5 and prior)
- 8.8CVE-2021-45891EPSS 1.4%
An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4., that allows attackers to escalate privileges within the application, since all permission checks are done client-side, not server-side.
- 7.5CVE-2021-22806EPSS 1.0%
A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could cause data exfiltration and unauthorized access when accessing a malicious website. Affected Product: spaceLYnk (V2.6.1 and prior), Wiser for KNX (V2.6.…
- 9.6CVE-2022-20658EPSS 1.4%
A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) and Cisco Unified Contact Center Domain Manager (Unified CCDM) could allow an authenticated, remote attacker to elevate …
- 6.5CVE-2021-25973EPSS 0.8%
In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. “guest” role users can self-register even when the admin does not allow. This happens due to front-end restriction only.
- 8.8CVE-2021-24602EPSS 1.5%
The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile page
- 4.3CVE-2021-34574EPSS 0.7%
In MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 an authenticated attacker can change the password of his account into a new password that violates the password policy b…
- 7.5CVE-2021-30120EPSS 5.7%
Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed desc…
- 4.3CVE-2021-29960EPSS 0.8%
Firefox used to cache the last filename used for printing a file. When generating a filename for printing, Firefox usually suggests the web page title. The caching and suggestion techniques combined may have lead to the title of a website …
- 7.2CVE-2021-22900KEVEPSS 14%
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web inter…
- 7.8CVE-2021-21531EPSS 0.7%
Dell Unisphere for PowerMax versions prior to 9.2.1.6 contain an Authorization Bypass Vulnerability. A local authenticated malicious user with monitor role may exploit this vulnerability to perform unauthorized actions.