CWE-669
Incorrect Resource Transfer Between Spheres
Description
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
Hierarchy (View 1000)
CVEs mapped to this weakness (101)
page 3 of 6| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-1020011 | Hig | 0.47 | 7.2 | 0.01 | Jul 29, 2019 | SmokeDetector intentionally does automatic deployments of updated copies of SmokeDetector without server operator authority. | ||
| CVE-2026-24708 | — | Hig | 0.46 | 8.2 | 0.00 | Feb 18, 2026 | An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format… | |
| CVE-2024-38519 | Hig | 0.44 | 7.8 | 0.00 | Jul 2, 2024 | `yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on… | ||
| CVE-2023-22950 | Med | 0.42 | 6.5 | 0.01 | Apr 13, 2023 | An issue was discovered in TigerGraph Enterprise Free Edition 3.x. Data loading jobs in gsql_server, created by any user with designer permissions, can read sensitive data from arbitrary locations. | ||
| CVE-2020-27268 | Med | 0.42 | 6.5 | 0.01 | Jan 19, 2021 | In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDana-i and AnyDana-A mobile applications allows physically proximate attackers to bypass checks for default PINs via Bluetooth Low Energy. | ||
| CVE-2020-5188 | Med | 0.42 | 6.5 | 0.02 | Feb 24, 2020 | DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions. | ||
| CVE-2026-33265 | Med | 0.41 | 6.3 | 0.00 | Mar 18, 2026 | In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API. | ||
| CVE-2022-31233 | Med | 0.41 | 6.3 | 0.00 | Aug 31, 2022 | Unisphere for PowerMax versions before 9.2.3.15 contain a privilege escalation vulnerability. An adjacent malicious user may potentially exploit this vulnerability to escalate their privileges and access functionalities they do not have access to. | ||
| CVE-2022-46173 | Hig | 0.40 | 7.2 | 0.01 | Dec 28, 2022 | Elrond-GO is a go implementation for the Elrond Network protocol. Versions prior to 1.3.50 are subject to a processing issue where nodes are affected when trying to process a cross-shard relayed transaction with a smart contract deploy transaction data. The problem was a bad… | ||
| CVE-2020-10778 | Med | 0.39 | 6.0 | 0.01 | Aug 11, 2020 | In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation. This business logic flaw violate the expected behavior. | ||
| CVE-2020-6862 | Med | 0.38 | 5.3 | 0.06 | Jan 17, 2020 | V6.0.10P2T2 and V6.0.10P2T5 of F6x2W product are impacted by Information leak vulnerability. Unauthorized users could log in directly to obtain page information without entering a verification code. | ||
| CVE-2019-10753 | Med | 0.38 | 5.9 | 0.01 | Sep 5, 2019 | In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version 9.4.4 for eclipse-cdt, and all versions prior to version 3.0.1 for eclipse-groovy, Spotless was resolving dependencies over an insecure channel (http). If the build occurred over an insecure… | ||
| CVE-2026-71194 | Med | 0.37 | 6.8 | 0.01 | Aug 12, 2026 | In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return… | ||
| CVE-2025-59378 | Med | 0.37 | 5.7 | 0.00 | Sep 15, 2025 | In guix-daemon in GNU Guix before 1618ca7, a content-addressed-mirrors file can be written to create a setuid program that allows a regular user to gain the privileges of the build user that runs it (even after the build has ended). | ||
| CVE-2017-14013 | Med | 0.36 | 5.6 | 0.01 | Oct 17, 2017 | A Client-Side Enforcement of Server-Side Security issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The log out function in the application removes the user's session only on the client side. This may allow an attacker to bypass protection mechanisms,… | ||
| CVE-2026-46448 | Med | 0.35 | 5.4 | 0.00 | Jun 16, 2026 | In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation. | ||
| CVE-2026-48846 | Med | 0.35 | 6.5 | 0.00 | May 25, 2026 | In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass. | ||
| CVE-2026-48845 | Med | 0.35 | 6.5 | 0.00 | May 25, 2026 | In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinations, which may lead to information disclosure or privilege escalation via a text/html email message. | ||
| CVE-2026-41525 | Med | 0.35 | 6.5 | 0.00 | Apr 28, 2026 | KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of the application sandbox without additional scrutiny. Dolphin's implementation of the FileManager1 protocol allows the path given to be any type of file,… | ||
| CVE-2026-40225 | Med | 0.35 | 6.4 | 0.00 | Apr 10, 2026 | In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output. |
- risk 0.47cvss 7.2epss 0.01
SmokeDetector intentionally does automatic deployments of updated copies of SmokeDetector without server operator authority.
- risk 0.46cvss 8.2epss 0.00
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format…
- risk 0.44cvss 7.8epss 0.00
`yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on…
- risk 0.42cvss 6.5epss 0.01
An issue was discovered in TigerGraph Enterprise Free Edition 3.x. Data loading jobs in gsql_server, created by any user with designer permissions, can read sensitive data from arbitrary locations.
- risk 0.42cvss 6.5epss 0.01
In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDana-i and AnyDana-A mobile applications allows physically proximate attackers to bypass checks for default PINs via Bluetooth Low Energy.
- risk 0.42cvss 6.5epss 0.02
DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions.
- risk 0.41cvss 6.3epss 0.00
In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.
- risk 0.41cvss 6.3epss 0.00
Unisphere for PowerMax versions before 9.2.3.15 contain a privilege escalation vulnerability. An adjacent malicious user may potentially exploit this vulnerability to escalate their privileges and access functionalities they do not have access to.
- risk 0.40cvss 7.2epss 0.01
Elrond-GO is a go implementation for the Elrond Network protocol. Versions prior to 1.3.50 are subject to a processing issue where nodes are affected when trying to process a cross-shard relayed transaction with a smart contract deploy transaction data. The problem was a bad…
- risk 0.39cvss 6.0epss 0.01
In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation. This business logic flaw violate the expected behavior.
- risk 0.38cvss 5.3epss 0.06
V6.0.10P2T2 and V6.0.10P2T5 of F6x2W product are impacted by Information leak vulnerability. Unauthorized users could log in directly to obtain page information without entering a verification code.
- risk 0.38cvss 5.9epss 0.01
In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version 9.4.4 for eclipse-cdt, and all versions prior to version 3.0.1 for eclipse-groovy, Spotless was resolving dependencies over an insecure channel (http). If the build occurred over an insecure…
- risk 0.37cvss 6.8epss 0.01
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return…
- risk 0.37cvss 5.7epss 0.00
In guix-daemon in GNU Guix before 1618ca7, a content-addressed-mirrors file can be written to create a setuid program that allows a regular user to gain the privileges of the build user that runs it (even after the build has ended).
- risk 0.36cvss 5.6epss 0.01
A Client-Side Enforcement of Server-Side Security issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The log out function in the application removes the user's session only on the client side. This may allow an attacker to bypass protection mechanisms,…
- risk 0.35cvss 5.4epss 0.00
In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.
- risk 0.35cvss 6.5epss 0.00
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass.
- risk 0.35cvss 6.5epss 0.00
In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinations, which may lead to information disclosure or privilege escalation via a text/html email message.
- risk 0.35cvss 6.5epss 0.00
KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of the application sandbox without additional scrutiny. Dolphin's implementation of the FileManager1 protocol allows the path given to be any type of file,…
- risk 0.35cvss 6.4epss 0.00
In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.