Weakness (CWE)
CWE-669: Incorrect Resource Transfer Between Spheres
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
Source: MITRE CWE-669
94 results · Feed
-
High 7.2
@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request t…
-
Medium 6.1
On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credential…
-
Medium 6.5
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_util…
-
Medium 4.3
In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin use…
-
Medium 4.3
Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-typ…
-
High 8.1
Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() …
-
High 7.5
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder strin…
-
Low 2.2
In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentic…
-
Low 2.2
In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authenticat…
-
High 7.8
NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability where an attacker could cause incorrect resource tra…
-
High 7.8
Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexi…
-
Medium 6.8
vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass
vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The extraction filters in lib/setup-sandbox.js and the cross-realm symbol checks and write traps in lib/bridge.js use a fixed list of known…
-
Critical 9.1
Cisco Identity Services Engine Hardening Release - Incorrect Resource Transfer Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This revie…
-
High 7.5
The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certa…
-
Low 3.1
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Special:CheckUserLog shows usernames t…
-
Low 3.1
An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3. It leaks information about a suppr…
-
Low 2.9
In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier obse…
-
Low 3.7
In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadve…
-
Low 3.0
Floodlight 71fe8a7 allows disruption of host communication via link spoofing. A port is misclassified as a non-boundary.
-
Low 2.9
In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where …
-
Medium 6.5
Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attacke…
-
Medium 5.6
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This h…
-
Medium 6.4
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modob…
-
Medium 5.8
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image cou…
-
Medium 5.8
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attri…
-
Low 3.1
In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Cli…
-
Medium 6.8
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NO…
-
Low 3.5
In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, includ…
-
Medium 5.4
OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints
In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.
-
High 7.4
Avira Password Manager credential disclosure via cross-origin autofill in Firefox
Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection. This iss…
-
Medium 4.9
OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Iro…
-
Medium 5.8
OpenStack Ironic allows Boot Script Injection
OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.
-
Low 3.7
Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via red…
-
Medium 6.5
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via …
-
Medium 6.5
In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for …
-
High 7.3
Wine ships a .desktop file that registers itself as a MIME handler for EXE files and several other Windows executable f…
-
High 7.5
Talos Linux has a local privilege escalation from untrusted workloads
### Summary A vulnerability in the Linux kernel's algif_aead subsystem (CVE-2026-31431, "copy.fail") allows an unprivileged container workload to corrupt arbitrary file page-cache pages via the AF_ALG crypto interface and splice(). On Talos Linux, this vulner…
-
Low 3.7
Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.
-
High 7.7
OpenStack Ironic has an Incorrect Resource Transfer Between Spheres
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenSta…
-
Medium 4.7
Remote Code Execution in multiple BinSoft products
Multiple BinSoft products are vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve system command execution by uploading an attachment and modifying its storage path in…