Weaknesses of type CWE-669

76 results

Transferência incorreta de recursos entre contextos de segurança

Ocorre quando um recurso (arquivo, memória, conexão, token) é transferido entre contextos de segurança distintos (ex: kernel para userspace, sandbox para sistema) sem validação ou isolamento adequado. O recurso herda ou perde restrições de segurança durante a transferência, permitindo que código em um contexto acesse ou controle dados que deveria estar vedado.

Example

Um driver passa um ponteiro de memória do kernel diretamente para uma aplicação userspace sem copiar os dados ou validar o acesso. A aplicação then modifica a memória kernel, causando privilege escalation. Outro caso: um sandbox retorna um file descriptor aberto para um arquivo fora da restrição, permitindo que o processo escape das limitações impostas.

How to mitigate

Implemente validação explícita ao transferir recursos entre contextos: copie dados em vez de compartilhar referências diretas, valide permissões no contexto de destino, e use abstrações que isolem os contextos (ex: system calls com verificação, APIs seguras). Documente claramente a posse e as restrições de cada recurso em cada esfera.

CVE-2026-35543MEDIUMAn issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (wiEPSS 0.5%CVE-2026-71194MEDIUMIn OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When tEPSS 0.5%CVE-2026-35544MEDIUMAn issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mailEPSS 0.5%CVE-2023-31115HIGHAn issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. Incorrect resource transfer between spheres can EPSS 0.5%CVE-2026-48846MEDIUMIn Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() vEPSS 0.5%CVE-2022-39225MEDIUMParse Server subject to Incorrect Resource Transfer Between SpheresEPSS 0.5%CVE-2026-44917MEDIUMOpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pEPSS 0.5%CVE-2026-75000MEDIUMIn Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remoEPSS 0.5%CVE-2026-40552MEDIUMRemote Code Execution in mpGabinetEPSS 0.5%CVE-2026-92952HIGHvm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering BypassEPSS 0.5%CVE-2026-46448MEDIUMIn OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.EPSS 0.5%CVE-2026-48845MEDIUMIn Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to locaEPSS 0.4%CVE-2026-20194CRITICALCisco Identity Services Engine Hardening Release - Incorrect Resource Transfer VulnerabilitiesEPSS 0.4%CVE-2026-46447MEDIUMOpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_infoEPSS 0.4%CVE-2026-87724MEDIUMTor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial EPSS 0.4%CVE-2025-41660HIGHCODESYS Control Boot Application Replacement Enables Code ExecutionEPSS 0.4%CVE-2026-35540MEDIUMAn issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messEPSS 0.4%CVE-2023-41894MEDIUMLocal-only webhooks externally accessible via SniTun in Home Assistant CoreEPSS 0.4%CVE-2025-54310MEDIUMqBittorrent before 5.1.2 does not prevent access to a local file that is referenced in a link URL. This affects rsswidget.cpp and searchjobwEPSS 0.4%CVE-2025-41645HIGHSMA: Sunny Portal demo system privilege escalationEPSS 0.4%