CWE-669 Incorrect Resource Transfer Between Spheres
Description
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-669 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-jf8q-945g-9q4c | CVE-2026-92952 | MODERATE |
vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks |
2026-10-01 | |
| GHSA-hmpr-c9rf-qcrf | - | HIGH |
Duplicate Advisory: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks |
2026-10-01 | |
| GHSA-mfg3-p6m3-gjgr | CVE-2026-46448 | MODERATE |
OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints |
2026-07-21 | |
| GHSA-jrh2-f5jc-xpgr | CVE-2026-46447 | MODERATE |
OpenStack Ironic allows Boot Script Injection |
2026-07-14 | |
| GHSA-m38g-vww2-mvgx | - | HIGH |
Talos Linux has a local privilege escalation from untrusted workloads |
2026-06-08 | |
| GHSA-66h8-3g48-6hx8 | CVE-2025-67895 | CRITICAL |
Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context |
2026-06-05 | |
| GHSA-54w4-233h-x86g | CVE-2026-42997 | HIGH |
OpenStack Ironic has an Incorrect Resource Transfer Between Spheres |
2026-05-08 | |
| GHSA-w846-74jr-76cv | CVE-2026-35545 | MODERATE | - |
Roundcube Webmail: Remote image blocking feature can be bypassed via SVG content in an e-mail message |
2026-04-04 |
| GHSA-xpqh-grpw-4xmg | CVE-2026-35544 | MODERATE | - |
Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages |
2026-04-04 |
| GHSA-j2g6-8rvg-7mf6 | CVE-2026-35543 | MODERATE | - |
Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail message |
2026-04-04 |
| GHSA-5hf6-crg4-fg59 | CVE-2026-35542 | MODERATE | - |
Roundcube: Bypass of remote image blocking via crafted BODY background attribute |
2026-04-04 |
| GHSA-vxg2-hhgr-37fx | CVE-2026-35540 | MODERATE | - |
Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages |
2026-04-04 |
| GHSA-m4f3-qp2w-gwh6 | CVE-2026-24708 | HIGH |
OpenStack Nova calls qemu-img without format restrictions for resize |
2026-02-21 | |
| GHSA-r2c6-8jc8-g32w | - | HIGH |
Duplicate Advisory: 1-Click RCE via Authentication Token Exfiltration From gatewayUrl |
2026-02-02 | |
| GHSA-34jh-p97f-mpxf | CVE-2024-37891 | MODERATE |
urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects |
2025-11-04 | |
| GHSA-22fp-mf44-f2mq | - | HIGH |
youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization |
2025-05-27 | |
| GHSA-7899-w6c4-vqc4 | CVE-2025-46553 | LOW |
@misskey-dev/summaly Redirect Filter Bypass |
2025-05-05 | |
| GHSA-79w7-vh3h-8g4j | CVE-2024-38519 | HIGH |
yt-dlp File system modification and RCE through improper file-extension sanitization |
2024-07-05 | |
| GHSA-mq39-4gv4-mvpx | CVE-2024-29018 | MODERATE |
Moby's external DNS requests from 'internal' networks could lead to data exfiltration |
2024-03-20 | |
| GHSA-36xw-fx78-c5r4 | CVE-2020-15257 | MODERATE |
containerd-shim API Exposed to Host Network Containers |
2023-10-02 | |
| GHSA-p228-4mrh-ww7r | CVE-2022-46173 | HIGH |
Elrond-GO processing: fallback search of SCRs when not found in the main cache |
2022-12-30 | |
| GHSA-fg2q-v428-2gph | CVE-2019-10248 | HIGH |
Eclipse Vorto resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS |
2022-11-22 | |
| GHSA-gvxv-5fp2-358q | CVE-2019-10753 | MODERATE |
Incorrect Resource Transfer Between Spheres in eclipse-wtp |
2022-11-17 | |
| GHSA-6w4q-23cf-j9jp | CVE-2022-39225 | MODERATE |
parse-server's session object properties can be updated by foreign user if object ID is known |
2022-09-21 | |
| GHSA-9j3m-g383-29qr | CVE-2022-35916 | MODERATE |
OpenZeppelin Contracts's Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls |
2022-08-14 |