Fallos del tipo CWE-669

59 resultados

Transferência incorreta de recurso entre contextos de segurança

Ocorre quando um recurso (arquivo, conexão, memória, token) é movido ou compartilhado entre contextos de segurança diferentes sem validação ou isolamento adequado. Um código pode transferir um recurso de um contexto protegido para um contexto menos confiável, expondo-o a acesso não autorizado ou manipulação.

Ejemplo

Uma aplicação web recebe um arquivo de um usuário autenticado, valida-o como seguro, mas depois o armazena em um diretório acessível ao servidor web que roda com menos privilégios. Um outro processo ou usuário consegue acessar ou modificar esse arquivo porque o contexto de segurança original foi perdido durante a transferência.

Cómo mitigar

Mantenha a validação e as restrições de segurança do recurso durante toda sua transferência entre contextos. Use mecanismos como ACLs apropriadas, validação em cada fronteira de segurança, isolamento de processos, e evite confiar em estado de segurança anterior — revalide a cada transição.

CVE-2026-31431HIGHcrypto: algif_aead - Revert to operating out-of-placeEPSS 99.9%KEVCVE-2026-25253HIGHOpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket conneEPSS 8.0%CVE-2020-15257MEDIUMcontainerd-shim API Exposed to Host Network ContainersEPSS 3.2%CVE-2024-37891MEDIUMProxy-Authorization request header isn't stripped during cross-origin redirects in urllib3EPSS 1.1%CVE-2021-22806—A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could cause data exfiltration and unauthorized access when EPSS 1.0%CVE-2025-67895CRITICALApache Airflow Providers Edge3: Edge3 Worker RPC RCE on Airflow 2EPSS 0.8%CVE-2024-29018MEDIUMExternal DNS requests from 'internal' networks could lead to data exfiltrationEPSS 0.8%CVE-2022-30236HIGHA CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could allow unauthorized access when an attacker uses crossEPSS 0.7%CVE-2022-46173HIGHElrond go Processing: fallback search of SCRs when not found in the main cacheEPSS 0.7%CVE-2023-22950MEDIUMAn issue was discovered in TigerGraph Enterprise Free Edition 3.x. Data loading jobs in gsql_server, created by any user with designer permiEPSS 0.7%CVE-2021-34574MEDIUMPassword policy evasion in products of MB connect line and HelmholzEPSS 0.7%CVE-2023-31114CRITICALAn issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. Incorrect resource transfer between spheres can EPSS 0.6%CVE-2022-35916MEDIUMCross chain utilities for Arbitrum L2 see EOA calls as cross chain callsEPSS 0.6%CVE-2025-34158HIGHPlex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/aEPSS 0.5%CVE-2025-62646MEDIUMThe Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to review the stored audio of converEPSS 0.5%CVE-2023-31115HIGHAn issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. Incorrect resource transfer between spheres can EPSS 0.5%CVE-2026-42997HIGHAn issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be senEPSS 0.4%CVE-2026-48847LOWRoundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session pEPSS 0.4%CVE-2025-41660HIGHCODESYS Control Boot Application Replacement Enables Code ExecutionEPSS 0.4%CVE-2022-39225MEDIUMParse Server subject to Incorrect Resource Transfer Between SpheresEPSS 0.4%