Weaknesses of type CWE-669

88 results

Transferência incorreta de recursos entre contextos de segurança

Ocorre quando um recurso (arquivo, memória, conexão, token) é transferido entre contextos de segurança distintos (ex: kernel para userspace, sandbox para sistema) sem validação ou isolamento adequado. O recurso herda ou perde restrições de segurança durante a transferência, permitindo que código em um contexto acesse ou controle dados que deveria estar vedado.

Example

Um driver passa um ponteiro de memória do kernel diretamente para uma aplicação userspace sem copiar os dados ou validar o acesso. A aplicação then modifica a memória kernel, causando privilege escalation. Outro caso: um sandbox retorna um file descriptor aberto para um arquivo fora da restrição, permitindo que o processo escape das limitações impostas.

How to mitigate

Implemente validação explícita ao transferir recursos entre contextos: copie dados em vez de compartilhar referências diretas, valide permissões no contexto de destino, e use abstrações que isolem os contextos (ex: system calls com verificação, APIs seguras). Documente claramente a posse e as restrições de cada recurso em cada esfera.

CVE-2023-37253LOWAn issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3. It leaks information about a suppressed user via the APEPSS 0.2%CVE-2023-37252LOWAn issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Special:CheckUserLog shows usernames that have been hidden.EPSS 0.2%CVE-2025-62292MEDIUMIn SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users can query the /api/v2/users-management/useEPSS 0.2%CVE-2026-33265MEDIUMIn LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.EPSS 0.2%CVE-2026-32772LOWtelnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.EPSS 0.2%CVE-2026-123010HIGH@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public sEPSS 0.2%CVE-2025-59691LOWPureVPN client applications on Linux through September 2025 allow IPv6 traffic to leak outside the VPN tunnel upon network events such as WiEPSS 0.2%CVE-2025-59692LOWPureVPN client applications on Linux through September 2025 mishandle firewalling. They flush the system's existing iptables rules and applyEPSS 0.2%CVE-2025-26698LOWIncorrect resource transfer between spheres issue exists in RevoWorks SCVX and RevoWorks Browser. If exploited, malicious files may be downlEPSS 0.2%CVE-2025-56675LOWThe EKEN video doorbell T6 BT60PLUS_MAIN_V1.0_GC1084_20230531 periodically sends debug logs to the EKEN cloud servers with sensitive informaEPSS 0.2%CVE-2026-86144MEDIUMIn xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevanceEPSS 0.2%CVE-2025-45480LOWFloodlight 71fe8a7 allows disruption of host communication via link spoofing. A port is misclassified as a non-boundary.EPSS 0.2%CVE-2026-40228LOWIn systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is execEPSS 0.2%CVE-2026-48831HIGHWine ships a .desktop file that registers itself as a MIME handler for EXE files and several other Windows executable file types. In some coEPSS 0.2%CVE-2025-54956LOWThe gh package before 1.5.0 for R delivers an HTTP response in a data structure that includes the Authorization header from the correspondinEPSS 0.2%CVE-2026-41030MEDIUMIn ONLYOFFICE DesktopEditors before 9.3.0, the update service allows attackers to perform actions on files with SYSTEM privileges.EPSS 0.2%CVE-2026-73281LOWIn ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that aEPSS 0.2%CVE-2026-38924LOWIn Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 wasEPSS 0.2%CVE-2026-89162LOWIn PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available EPSS 0.2%CVE-2025-59453LOWClick Studios Passwordstate before 9.9 Build 9972 has a potential authentication bypass for Passwordstate emergency access. By using a craftEPSS 0.2%