Falhas do tipo CWE-669

88 resultados

Transferência incorreta de recursos entre contextos de segurança

Ocorre quando um recurso (arquivo, memória, conexão, credencial) é movido ou compartilhado entre contextos de segurança diferentes (ex: processo privilegiado para não-privilegiado, zona confiável para não-confiável) sem validação ou proteção adequada. O recurso fica acessível a quem não deveria, ou perde suas garantias de segurança na transição.

Exemplo

Um aplicativo web salva dados sensíveis do usuário em /tmp com permissões 0644 (legível por todos), e outro processo de menor privilégio consegue ler. Ou um serviço transmite um file descriptor aberto para um cliente não autenticado, que ganha acesso ao arquivo sem passar por controles de autorização.

Como mitigar

Valide e controle explicitamente cada transferência de recurso: revise quem pode acessar o quê após a transferência, use permissões restritivas (0600), criptografe dados sensíveis em trânsito, e aplique re-autenticação ou re-autorização quando recursos cruzam limites de segurança.

CVE-2026-110907HIGHBackdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] EPSS 0.3%CVE-2025-59363HIGHIn One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 (even though this secret should onlyEPSS 0.3%CVE-2026-73574LOWIn Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper vEPSS 0.3%CVE-2024-38519HIGHyt-dlp and youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitizationEPSS 0.3%CVE-2024-31573MEDIUMXMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transEPSS 0.3%CVE-2019-0042MEDIUMIncorrect messages from Juniper Identity Management Service (JIMS) can trigger Denial of Service or firewall bypass conditions for SRX series devicesEPSS 0.3%CVE-2026-44599LOWTor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.EPSS 0.3%CVE-2026-40552MEDIUMRemote Code Execution in multiple BinSoft productsEPSS 0.3%CVE-2026-75010MEDIUMIn Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authenticationEPSS 0.3%CVE-2026-44917MEDIUMOpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pEPSS 0.3%CVE-2026-25832LOWIn Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group.EPSS 0.3%CVE-2025-62775HIGHMercku M6a devices through 2.1.0 allow root TELNET logins via the web admin password.EPSS 0.3%CVE-2026-111445HIGHWheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). ForEPSS 0.3%CVE-2026-46448MEDIUMIn OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.EPSS 0.3%CVE-2025-46553LOW@misskey-dev/summaly Redirect Filter BypassEPSS 0.3%CVE-2026-12068HIGHAvira Password Manager credential disclosure via cross-origin autofill in FirefoxEPSS 0.3%CVE-2026-46447MEDIUMOpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_infoEPSS 0.3%CVE-2026-114722MEDIUMRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() dEPSS 0.3%CVE-2023-32803HIGHThe ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certEPSS 0.2%CVE-2026-111793MEDIUMOpenwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. TEPSS 0.2%