Weaknesses of type CWE-669

88 results

Transferência incorreta de recursos entre contextos de segurança

Ocorre quando um recurso (arquivo, memória, conexão, token) é transferido entre contextos de segurança distintos (ex: kernel para userspace, sandbox para sistema) sem validação ou isolamento adequado. O recurso herda ou perde restrições de segurança durante a transferência, permitindo que código em um contexto acesse ou controle dados que deveria estar vedado.

Example

Um driver passa um ponteiro de memória do kernel diretamente para uma aplicação userspace sem copiar os dados ou validar o acesso. A aplicação then modifica a memória kernel, causando privilege escalation. Outro caso: um sandbox retorna um file descriptor aberto para um arquivo fora da restrição, permitindo que o processo escape das limitações impostas.

How to mitigate

Implemente validação explícita ao transferir recursos entre contextos: copie dados em vez de compartilhar referências diretas, valide permissões no contexto de destino, e use abstrações que isolem os contextos (ex: system calls com verificação, APIs seguras). Documente claramente a posse e as restrições de cada recurso em cada esfera.

CVE-2023-31115HIGHAn issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. Incorrect resource transfer between spheres can EPSS 0.5%CVE-2026-20194CRITICALCisco Identity Services Engine Hardening Release - Incorrect Resource Transfer VulnerabilitiesEPSS 0.5%CVE-2025-54310MEDIUMqBittorrent before 5.1.2 does not prevent access to a local file that is referenced in a link URL. This affects rsswidget.cpp and searchjobwEPSS 0.5%CVE-2026-92952HIGHvm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering BypassEPSS 0.5%CVE-2025-41660HIGHCODESYS Control Boot Application Replacement Enables Code ExecutionEPSS 0.4%CVE-2026-42997HIGHAn issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be senEPSS 0.4%CVE-2026-87724MEDIUMTor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial EPSS 0.4%CVE-2025-41645HIGHSMA: Sunny Portal demo system privilege escalationEPSS 0.4%CVE-2026-35543MEDIUMAn issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (wiEPSS 0.4%CVE-2026-35542MEDIUMAn issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted backgEPSS 0.4%CVE-2026-24708HIGHAn issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a rooEPSS 0.4%CVE-2026-35545MEDIUMAn issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in EPSS 0.4%CVE-2026-48846MEDIUMIn Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() vEPSS 0.4%CVE-2026-75003MEDIUMIn Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote iEPSS 0.4%CVE-2025-54352LOWWordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: theEPSS 0.4%CVE-2026-35540MEDIUMAn issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messEPSS 0.4%CVE-2026-35544MEDIUMAn issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mailEPSS 0.4%CVE-2026-48845MEDIUMIn Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to locaEPSS 0.4%CVE-2026-93856MEDIUMIn OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scEPSS 0.4%CVE-2026-75000MEDIUMIn Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remoEPSS 0.3%