Falhas do tipo CWE-669

59 resultados

Transferência incorreta de recursos entre contextos de segurança

Ocorre quando um recurso (arquivo, memória, conexão, credencial) é movido ou compartilhado entre contextos de segurança diferentes (ex: processo privilegiado para não-privilegiado, zona confiável para não-confiável) sem validação ou proteção adequada. O recurso fica acessível a quem não deveria, ou perde suas garantias de segurança na transição.

Exemplo

Um aplicativo web salva dados sensíveis do usuário em /tmp com permissões 0644 (legível por todos), e outro processo de menor privilégio consegue ler. Ou um serviço transmite um file descriptor aberto para um cliente não autenticado, que ganha acesso ao arquivo sem passar por controles de autorização.

Como mitigar

Valide e controle explicitamente cada transferência de recurso: revise quem pode acessar o quê após a transferência, use permissões restritivas (0600), criptografe dados sensíveis em trânsito, e aplique re-autenticação ou re-autorização quando recursos cruzam limites de segurança.

CVE-2026-31431HIGHcrypto: algif_aead - Revert to operating out-of-placeEPSS 99.9%KEVCVE-2026-25253HIGHOpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket conneEPSS 8.0%CVE-2020-15257MEDIUMcontainerd-shim API Exposed to Host Network ContainersEPSS 3.2%CVE-2024-37891MEDIUMProxy-Authorization request header isn't stripped during cross-origin redirects in urllib3EPSS 1.1%CVE-2021-22806—A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could cause data exfiltration and unauthorized access when EPSS 1.0%CVE-2025-67895CRITICALApache Airflow Providers Edge3: Edge3 Worker RPC RCE on Airflow 2EPSS 0.8%CVE-2024-29018MEDIUMExternal DNS requests from 'internal' networks could lead to data exfiltrationEPSS 0.8%CVE-2022-30236HIGHA CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could allow unauthorized access when an attacker uses crossEPSS 0.7%CVE-2022-46173HIGHElrond go Processing: fallback search of SCRs when not found in the main cacheEPSS 0.7%CVE-2023-22950MEDIUMAn issue was discovered in TigerGraph Enterprise Free Edition 3.x. Data loading jobs in gsql_server, created by any user with designer permiEPSS 0.7%CVE-2021-34574MEDIUMPassword policy evasion in products of MB connect line and HelmholzEPSS 0.7%CVE-2023-31114CRITICALAn issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. Incorrect resource transfer between spheres can EPSS 0.6%CVE-2022-35916MEDIUMCross chain utilities for Arbitrum L2 see EOA calls as cross chain callsEPSS 0.6%CVE-2025-34158HIGHPlex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/aEPSS 0.5%CVE-2025-62646MEDIUMThe Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to review the stored audio of converEPSS 0.5%CVE-2023-31115HIGHAn issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. Incorrect resource transfer between spheres can EPSS 0.5%CVE-2026-42997HIGHAn issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be senEPSS 0.4%CVE-2026-48847LOWRoundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session pEPSS 0.4%CVE-2025-41660HIGHCODESYS Control Boot Application Replacement Enables Code ExecutionEPSS 0.4%CVE-2022-39225MEDIUMParse Server subject to Incorrect Resource Transfer Between SpheresEPSS 0.4%