Fallos del tipo CWE-669

88 resultados

Transferência incorreta de recurso entre contextos de segurança

Ocorre quando um recurso (arquivo, conexão, memória, token) é movido ou compartilhado entre contextos de segurança diferentes sem validação ou isolamento adequado. Um código pode transferir um recurso de um contexto protegido para um contexto menos confiável, expondo-o a acesso não autorizado ou manipulação.

Ejemplo

Uma aplicação web recebe um arquivo de um usuário autenticado, valida-o como seguro, mas depois o armazena em um diretório acessível ao servidor web que roda com menos privilégios. Um outro processo ou usuário consegue acessar ou modificar esse arquivo porque o contexto de segurança original foi perdido durante a transferência.

Cómo mitigar

Mantenha a validação e as restrições de segurança do recurso durante toda sua transferência entre contextos. Use mecanismos como ACLs apropriadas, validação em cada fronteira de segurança, isolamento de processos, e evite confiar em estado de segurança anterior — revalide a cada transição.

CVE-2026-110907HIGHBackdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] EPSS 0.3%CVE-2025-59363HIGHIn One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 (even though this secret should onlyEPSS 0.3%CVE-2026-73574LOWIn Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper vEPSS 0.3%CVE-2024-38519HIGHyt-dlp and youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitizationEPSS 0.3%CVE-2024-31573MEDIUMXMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transEPSS 0.3%CVE-2019-0042MEDIUMIncorrect messages from Juniper Identity Management Service (JIMS) can trigger Denial of Service or firewall bypass conditions for SRX series devicesEPSS 0.3%CVE-2026-44599LOWTor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.EPSS 0.3%CVE-2026-40552MEDIUMRemote Code Execution in multiple BinSoft productsEPSS 0.3%CVE-2026-75010MEDIUMIn Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authenticationEPSS 0.3%CVE-2026-44917MEDIUMOpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pEPSS 0.3%CVE-2026-25832LOWIn Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group.EPSS 0.3%CVE-2025-62775HIGHMercku M6a devices through 2.1.0 allow root TELNET logins via the web admin password.EPSS 0.3%CVE-2026-111445HIGHWheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). ForEPSS 0.3%CVE-2026-46448MEDIUMIn OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.EPSS 0.3%CVE-2025-46553LOW@misskey-dev/summaly Redirect Filter BypassEPSS 0.3%CVE-2026-12068HIGHAvira Password Manager credential disclosure via cross-origin autofill in FirefoxEPSS 0.3%CVE-2026-46447MEDIUMOpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_infoEPSS 0.3%CVE-2026-114722MEDIUMRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() dEPSS 0.3%CVE-2023-32803HIGHThe ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certEPSS 0.2%CVE-2026-111793MEDIUMOpenwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. TEPSS 0.2%