CWE-669 · Incorrect Resource Transfer Between Spheres
98 CVEs classified under CWE-669 (Incorrect Resource Transfer Between Spheres). Browse by severity and year.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-30120 | Critical | 9.9 | 2021-07-09 | Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side an… |
CVE-2025-67895 | Critical | 9.8 | 2025-12-17 | Edge3 Worker RPC RCE on Airflow 2. This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if you installed and configured it on Airflow 2… |
CVE-2022-4446 | Critical | 9.8 | 2022-12-13 | PHP Remote File Inclusion in GitHub repository tsolucio/corebos prior to 8.0. |
CVE-2020-24683 | Critical | 9.8 | 2020-12-22 | The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (cl… |
CVE-2020-5800 | Critical | 9.8 | 2020-12-07 | The Eat Spray Love mobile app for both iOS and Android contains logic that allows users to bypass authentication and retrieve or modify information that they w… |
CVE-2020-15892 | Critical | 9.8 | 2020-07-22 | An issue was discovered in apply.cgi on D-Link DAP-1520 devices before 1.10b04Beta02. Whenever a user performs a login action from the web interface, the reque… |
CVE-2019-13025 | Critical | 9.8 | 2019-10-02 | Compal CH7465LG CH7465LG-NCIP-6.12.18.24-5p8-NOSH devices have Incorrect Access Control because of Improper Input Validation. The attacker can send a malicious… |
CVE-2016-5062 | Critical | 9.8 | 2016-09-29 | The web server in Aternity before 9.0.1 does not require authentication for getMBeansFromURL loading of Java MBeans, which allows remote attackers to execute a… |
CVE-2022-20658 | Critical | 9.6 | 2022-01-14 | A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) and Cisco Unified Contact Center Domain… |
CVE-2023-31114 | Critical | 9.1 | 2023-06-07 | An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. Incorrect resource transfer between spheres can cause unintended qu… |
CVE-2025-41660 | High | 8.8 | 2026-03-24 | A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution. |
CVE-2026-25253 | High | 8.8 | 2026-02-01 | OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without promp… |
CVE-2021-45891 | High | 8.8 | 2022-04-05 | An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4., that allows attackers to escalate privileges within the application, since all permission checks… |
CVE-2021-24602 | High | 8.8 | 2021-08-23 | The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile… |
CVE-2020-25917 | High | 8.8 | 2020-12-26 | Stratodesk NoTouch Center before 4.4.68 is affected by: Incorrect Access Control. A low privileged user on the platform, for example a user with "helpdesk" pri… |
CVE-2019-13266 | High | 8.8 | 2019-08-27 | TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the… |
CVE-2019-13263 | High | 8.8 | 2019-08-27 | D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP R… |
CVE-2019-11875 | High | 8.8 | 2019-05-24 | In AutomateAppCore.dll in Blue Prism Robotic Process Automation 6.4.0.8445, a vulnerability in access control can be exploited to escalate privileges. The vuln… |
CVE-2025-41645 | High | 8.6 | 2025-05-13 | An unauthenticated remote attacker could use a demo account of the portal to hijack devices that were created in that account by mistake. |
CVE-2025-34158 | High | 8.5 | 2025-08-21 | Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the… |