CWE-669 · Incorrect Resource Transfer Between Spheres

104 CVEs classified under CWE-669 (Incorrect Resource Transfer Between Spheres). Browse by severity and year.

Top CVEs for CWE-669
CVESeverityScorePublishedSummary
CVE-2021-30120Critical9.92021-07-09Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side an…
CVE-2025-67895Critical9.82025-12-17Edge3 Worker RPC RCE on Airflow 2. This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if you installed and configured it on Airflow 2…
CVE-2022-4446Critical9.82022-12-13PHP Remote File Inclusion in GitHub repository tsolucio/corebos prior to 8.0.
CVE-2020-24683Critical9.82020-12-22The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (cl…
CVE-2020-5800Critical9.82020-12-07The Eat Spray Love mobile app for both iOS and Android contains logic that allows users to bypass authentication and retrieve or modify information that they w…
CVE-2020-15892Critical9.82020-07-22An issue was discovered in apply.cgi on D-Link DAP-1520 devices before 1.10b04Beta02. Whenever a user performs a login action from the web interface, the reque…
CVE-2019-13025Critical9.82019-10-02Compal CH7465LG CH7465LG-NCIP-6.12.18.24-5p8-NOSH devices have Incorrect Access Control because of Improper Input Validation. The attacker can send a malicious…
CVE-2016-5062Critical9.82016-09-29The web server in Aternity before 9.0.1 does not require authentication for getMBeansFromURL loading of Java MBeans, which allows remote attackers to execute a…
CVE-2022-20658Critical9.62022-01-14A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) and Cisco Unified Contact Center Domain…
CVE-2023-31114Critical9.12023-06-07An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. Incorrect resource transfer between spheres can cause unintended qu…
CVE-2025-41660High8.82026-03-24A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution.
CVE-2026-25253High8.82026-02-01OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without promp…
CVE-2021-45891High8.82022-04-05An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4., that allows attackers to escalate privileges within the application, since all permission checks…
CVE-2021-24602High8.82021-08-23The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile…
CVE-2020-25917High8.82020-12-26Stratodesk NoTouch Center before 4.4.68 is affected by: Incorrect Access Control. A low privileged user on the platform, for example a user with "helpdesk" pri…
CVE-2019-13266High8.82019-08-27TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the…
CVE-2019-13263High8.82019-08-27D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP R…
CVE-2019-11875High8.82019-05-24In AutomateAppCore.dll in Blue Prism Robotic Process Automation 6.4.0.8445, a vulnerability in access control can be exploited to escalate privileges. The vuln…
CVE-2025-41645High8.62025-05-13An unauthenticated remote attacker could use a demo account of the portal to hijack devices that were created in that account by mistake.
CVE-2025-34158High8.52025-08-21Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the…
All CVEs classified under CWE-669 — newest first (page 1 of 2)
CVESeverityScorePublishedSummary
CVE-2026-75010Medium6.42026-08-17In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-co…
CVE-2026-75003Medium5.82026-08-17In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote image blocking, whic…
CVE-2026-75000Medium5.82026-08-17In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking b…
CVE-2026-73574Low3.12026-08-13In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu…
CVE-2026-71194Medium6.82026-08-12In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the s…
CVE-2026-73281Low3.52026-08-11In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use ke…
CVE-2026-14151High8.32026-06-30Inappropriate implementation in AI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially pe…
CVE-2026-46448Medium5.42026-06-16In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.
CVE-2026-12068High7.42026-06-12Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to ob…
CVE-2026-44917Medium4.92026-06-04OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.
CVE-2026-46447Medium5.82026-06-03OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.
CVE-2026-48847Low3.72026-05-25Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass.
CVE-2026-48846Medium6.52026-05-25In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail m…
CVE-2026-48845Medium6.52026-05-25In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinati…
CVE-2026-488312026-05-24Wine ships a .desktop file that registers itself as a MIME handler for EXE files and several other Windows executable file types. In some configurations, handl…
CVE-2026-44599Low3.72026-05-07Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.
CVE-2026-42997High7.72026-05-05An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpo…
CVE-2026-405522026-04-28mpGabinet is vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve sy…
CVE-2026-41525Medium6.52026-04-28KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of the application sandbox without additiona…
CVE-2026-31431High7.82026-04-22In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b09…
CVE-2026-41030Medium6.22026-04-16In ONLYOFFICE DesktopEditors before 9.3.0, the update service allows attackers to perform actions on files with SYSTEM privileges.
CVE-2026-40228Low2.92026-04-10In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToW…
CVE-2026-40225Medium6.42026-04-10In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.
CVE-2026-35545Medium5.32026-04-03An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message…
CVE-2026-35544Medium5.32026-04-03An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead…
CVE-2026-35543Medium5.32026-04-03An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate attribut…
CVE-2026-35542Medium5.32026-04-03An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of…
CVE-2026-35540Medium5.42026-04-03An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SS…
CVE-2025-41660High8.82026-03-24A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution.
CVE-2026-33265Medium6.32026-03-18In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.
CVE-2026-32772Low3.42026-03-16telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.
CVE-2026-24708High8.22026-02-18An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk…
CVE-2026-25253High8.82026-02-01OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without promp…
CVE-2025-67895Critical9.82025-12-17Edge3 Worker RPC RCE on Airflow 2. This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if you installed and configured it on Airflow 2…
CVE-2025-62775High8.02025-10-22Mercku M6a devices through 2.1.0 allow root TELNET logins via the web admin password.
CVE-2025-62646Medium5.02025-10-17The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between ass…
CVE-2024-31573Medium4.02025-10-17XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because…
CVE-2025-62292Medium4.32025-10-10In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users can query the /api/v2/users-management/users endpoint and obt…
CVE-2025-56675Low3.52025-09-30The EKEN video doorbell T6 BT60PLUS_MAIN_V1.0_GC1084_20230531 periodically sends debug logs to the EKEN cloud servers with sensitive information such as the Wi…
CVE-2025-59692Low3.72025-09-18PureVPN client applications on Linux through September 2025 mishandle firewalling. They flush the system's existing iptables rules and apply default ACCEPT pol…
CVE-2025-59691Low3.72025-09-18PureVPN client applications on Linux through September 2025 allow IPv6 traffic to leak outside the VPN tunnel upon network events such as Wi-Fi reconnect or sy…
CVE-2025-59453Low3.22025-09-16Click Studios Passwordstate before 9.9 Build 9972 has a potential authentication bypass for Passwordstate emergency access. By using a crafted URL while on the…
CVE-2025-59378Medium5.72025-09-15In guix-daemon in GNU Guix before 1618ca7, a content-addressed-mirrors file can be written to create a setuid program that allows a regular user to gain the pr…
CVE-2025-59363High7.72025-09-14In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 (even though this secret should only be returned when a…
CVE-2025-34158High8.52025-08-21Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the…
CVE-2025-54956Low3.22025-08-03The gh package before 1.5.0 for R delivers an HTTP response in a data structure that includes the Authorization header from the corresponding HTTP request.
CVE-2025-54352Low3.72025-07-21WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not ch…
CVE-2025-54310Medium4.02025-07-18qBittorrent before 5.1.2 does not prevent access to a local file that is referenced in a link URL. This affects rsswidget.cpp and searchjobwidget.cpp.
CVE-2025-41645High8.62025-05-13An unauthenticated remote attacker could use a demo account of the portal to hijack devices that were created in that account by mistake.
CVE-2025-46553Medium6.12025-05-05@misskey-dev/summaly is a tool for getting a summary of a web page. Starting in version 3.0.1 and prior to version 5.2.1, a logic error in the main `summaly` f…
CVE-2025-26698Low2.72025-02-26Incorrect resource transfer between spheres issue exists in RevoWorks SCVX and RevoWorks Browser. If exploited, malicious files may be downloaded to the system…
CVE-2024-42158Medium4.12024-07-30In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings Replace memzero_explicit() an…
CVE-2024-38519High7.82024-07-02`yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the extensions of downl…
CVE-2024-37891Medium4.42024-06-17 urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only se…
CVE-2024-29018Medium5.92024-03-20Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes…
CVE-2023-41894Medium5.32023-10-20Home assistant is an open source home automation. The assessment verified that webhooks available in the webhook component are triggerable via the `*.ui.nabu.c…
CVE-2023-44104High7.52023-10-11Broadcast permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2023-44100High7.52023-10-11Broadcast permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2023-31115High7.52023-06-07An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. Incorrect resource transfer between spheres can cause changes to th…
CVE-2023-31114Critical9.12023-06-07An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. Incorrect resource transfer between spheres can cause unintended qu…
CVE-2023-22950Medium6.52023-04-13An issue was discovered in TigerGraph Enterprise Free Edition 3.x. Data loading jobs in gsql_server, created by any user with designer permissions, can read se…
CVE-2022-46173High7.22022-12-28Elrond-GO is a go implementation for the Elrond Network protocol. Versions prior to 1.3.50 are subject to a processing issue where nodes are affected when tryi…
CVE-2022-4446Critical9.82022-12-13PHP Remote File Inclusion in GitHub repository tsolucio/corebos prior to 8.0.
CVE-2022-39225Medium4.32022-09-23Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.15, or 5.0.0 and above prior…
CVE-2022-31233Medium6.32022-08-31Unisphere for PowerMax versions before 9.2.3.15 contain a privilege escalation vulnerability. An adjacent malicious user may potentially exploit this vulnerabi…
CVE-2022-35916Medium5.32022-08-01OpenZeppelin Contracts is a library for secure smart contract development. Contracts using the cross chain utilities for Arbitrum L2, `CrossChainEnabledArbitru…
CVE-2022-30236High8.22022-06-02A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could allow unauthorized access when an attacker uses cross-domain attacks. Af…
CVE-2021-45891High8.82022-04-05An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4., that allows attackers to escalate privileges within the application, since all permission checks…
CVE-2021-22806High7.52022-02-11A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could cause data exfiltration and unauthorized access when accessing a malicio…
CVE-2022-20658Critical9.62022-01-14A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) and Cisco Unified Contact Center Domain…
CVE-2021-25973Medium6.52021-11-02In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. “guest” role users can self-register even when the admin does not allow. This happen…
CVE-2021-24602High8.82021-08-23The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile…
CVE-2021-34574Medium4.32021-08-02In MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 an authenticated attacker can change the…
CVE-2021-30120Critical9.92021-07-09Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side an…
CVE-2021-29960Medium4.32021-06-24Firefox used to cache the last filename used for printing a file. When generating a filename for printing, Firefox usually suggests the web page title. The cac…
CVE-2021-22900High7.22021-05-27A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a fi…
CVE-2021-21531High8.12021-04-30Dell Unisphere for PowerMax versions prior to 9.2.1.6 contain an Authorization Bypass Vulnerability. A local authenticated malicious user with monitor role may…
CVE-2021-20411High8.12021-02-12IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user to impersonate another user on the system due to incorrectly updating the session iden…
CVE-2020-27268Medium6.52021-01-19In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDana-i and AnyDana-A m…
CVE-2020-25917High8.82020-12-26Stratodesk NoTouch Center before 4.4.68 is affected by: Incorrect Access Control. A low privileged user on the platform, for example a user with "helpdesk" pri…
CVE-2020-24683Critical9.82020-12-22The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (cl…
CVE-2020-26177Medium4.32020-12-18In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus are not intended to be edited by regular users. Ho…
CVE-2020-5800Critical9.82020-12-07The Eat Spray Love mobile app for both iOS and Android contains logic that allows users to bypass authentication and retrieve or modify information that they w…
CVE-2020-15257Medium5.22020-12-01containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the con…
CVE-2020-10778Medium6.02020-08-11In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is…
CVE-2020-15892Critical9.82020-07-22An issue was discovered in apply.cgi on D-Link DAP-1520 devices before 1.10b04Beta02. Whenever a user performs a login action from the web interface, the reque…
CVE-2020-1048High7.82020-05-21An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who s…
CVE-2020-5188Medium6.52020-02-24DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions.
CVE-2020-6862Medium5.32020-01-17V6.0.10P2T2 and V6.0.10P2T5 of F6x2W product are impacted by Information leak vulnerability. Unauthorized users could log in directly to obtain page informatio…
CVE-2012-2979High7.52019-11-01FreeBSD NSD before 3.2.13 allows remote attackers to crash a NSD child server process (SIGSEGV) and cause a denial of service in the NSD server.
CVE-2019-13025Critical9.82019-10-02Compal CH7465LG CH7465LG-NCIP-6.12.18.24-5p8-NOSH devices have Incorrect Access Control because of Improper Input Validation. The attacker can send a malicious…
CVE-2019-10753Medium5.92019-09-05In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version 9.4.4 for eclipse-cdt, and all versions prior to version 3.0.1 for eclips…
CVE-2019-13266High8.82019-08-27TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the…
CVE-2019-13263High8.82019-08-27D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP R…
CVE-2018-17791High7.52019-08-21Newgen OmniFlow Intelligent Business Process Suite (iBPS) 7.0 has an "improper server side validation" vulnerability where client-side validations are tampered…
CVE-2019-1020011High7.22019-07-29SmokeDetector intentionally does automatic deployments of updated copies of SmokeDetector without server operator authority.
CVE-2019-11770High8.12019-06-14In Eclipse Buildship versions prior to 3.1.1, the build files indicate that this project is resolving dependencies over HTTP instead of HTTPS. Any of these art…
CVE-2019-11875High8.82019-05-24In AutomateAppCore.dll in Blue Prism Robotic Process Automation 6.4.0.8445, a vulnerability in access control can be exploited to escalate privileges. The vuln…
CVE-2019-10248High8.12019-04-22Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. Any of these dependent artifacts could ha…
CVE-2019-0042Medium4.22019-04-10Juniper Identity Management Service (JIMS) for Windows versions prior to 1.1.4 may send an incorrect message to associated SRX services gateways. This may allo…