Common Weakness Enumeration
CWE-669
Allowed-with-ReviewIncorrect Resource Transfer Between Spheres
Abstraction: Class · Status: Draft
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
157 vulnerabilities reference this CWE, most recent first.
GHSA-3G4P-C74P-MH7X
Vulnerability from github – Published: 2026-06-04 06:30 – Updated: 2026-06-04 09:30
VLAI
Details
OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.
Severity
4.9 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-44917"
],
"database_specific": {
"cwe_ids": [
"CWE-669"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-04T04:17:14Z",
"severity": "MODERATE"
},
"details": "OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.",
"id": "GHSA-3g4p-c74p-mh7x",
"modified": "2026-06-04T09:30:34Z",
"published": "2026-06-04T06:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44917"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/ironic/+bug/2148319"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2026/06/03/13"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/06/03/13"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4649-47V5-9MQG
Vulnerability from github – Published: 2026-08-17 15:30 – Updated: 2026-08-17 15:30
VLAI
Details
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation.
Severity
5.8 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-75000"
],
"database_specific": {
"cwe_ids": [
"CWE-669"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-17T13:16:54Z",
"severity": "MODERATE"
},
"details": "In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate \"by\" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation.",
"id": "GHSA-4649-47v5-9mqg",
"modified": "2026-08-17T15:30:39Z",
"published": "2026-08-17T15:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75000"
},
{
"type": "WEB",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.18"
},
{
"type": "WEB",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.3"
},
{
"type": "WEB",
"url": "https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-53J4-26MM-GCR3
Vulnerability from github – Published: 2026-04-28 09:34 – Updated: 2026-05-19 09:31
VLAI
Details
KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of the application sandbox without additional scrutiny. Dolphin's implementation of the FileManager1 protocol allows the path given to be any type of file, including scripts or executables. (By default, Dolphin will then prompt the user to determine if they want to launch a script or executable; however, the intended behavior is to block the attempted action, not present a consent prompt.)
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-41525"
],
"database_specific": {
"cwe_ids": [
"CWE-669"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-28T08:16:01Z",
"severity": "MODERATE"
},
"details": "KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of the application sandbox without additional scrutiny. Dolphin\u0027s implementation of the FileManager1 protocol allows the path given to be any type of file, including scripts or executables. (By default, Dolphin will then prompt the user to determine if they want to launch a script or executable; however, the intended behavior is to block the attempted action, not present a consent prompt.)",
"id": "GHSA-53j4-26mm-gcr3",
"modified": "2026-05-19T09:31:19Z",
"published": "2026-04-28T09:34:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41525"
},
{
"type": "WEB",
"url": "https://github.com/KDE/dolphin/releases/tag/v25.12.3"
},
{
"type": "WEB",
"url": "https://invent.kde.org/system/dolphin"
},
{
"type": "WEB",
"url": "https://kde.org/info/security/advisory-20260427-2.txt"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/05/19/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-54W4-233H-X86G
Vulnerability from github – Published: 2026-05-05 21:31 – Updated: 2026-05-08 23:07
VLAI
Summary
OpenStack Ironic has an Incorrect Resource Transfer Between Spheres
Details
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.
Severity
7.7 (High)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ironic-python-agent"
},
"ranges": [
{
"events": [
{
"introduced": "33.0.0"
},
{
"fixed": "35.0.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "ironic-python-agent"
},
"ranges": [
{
"events": [
{
"introduced": "30.0.0"
},
{
"fixed": "32.0.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "ironic-python-agent"
},
"ranges": [
{
"events": [
{
"introduced": "27.0.0"
},
{
"fixed": "29.0.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "ironic-python-agent"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "26.1.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-42997"
],
"database_specific": {
"cwe_ids": [
"CWE-669"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-08T23:07:56Z",
"nvd_published_at": "2026-05-05T19:16:22Z",
"severity": "HIGH"
},
"details": "An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.",
"id": "GHSA-54w4-233h-x86g",
"modified": "2026-05-08T23:07:56Z",
"published": "2026-05-05T21:31:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42997"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/ironic-python-agent"
},
{
"type": "WEB",
"url": "https://security.openstack.org/ossa/OSSA-2026-010.html"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2026/05/05/10"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/05/05/10"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "OpenStack Ironic has an Incorrect Resource Transfer Between Spheres"
}
GHSA-565Q-5JQQ-H2WG
Vulnerability from github – Published: 2022-02-12 00:00 – Updated: 2022-02-23 00:01
VLAI
Details
A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could cause data exfiltration and unauthorized access when accessing a malicious website. Affected Product: spaceLYnk (V2.6.1 and prior), Wiser for KNX (V2.6.1 and prior), fellerLYnk (V2.6.1 and prior)
{
"affected": [],
"aliases": [
"CVE-2021-22806"
],
"database_specific": {
"cwe_ids": [
"CWE-669"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-11T18:15:00Z",
"severity": "HIGH"
},
"details": "A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could cause data exfiltration and unauthorized access when accessing a malicious website. Affected Product: spaceLYnk (V2.6.1 and prior), Wiser for KNX (V2.6.1 and prior), fellerLYnk (V2.6.1 and prior)",
"id": "GHSA-565q-5jqq-h2wg",
"modified": "2022-02-23T00:01:29Z",
"published": "2022-02-12T00:00:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22806"
},
{
"type": "WEB",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-285-01"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-585C-5QCQ-7FGC
Vulnerability from github – Published: 2025-07-21 06:31 – Updated: 2025-07-21 06:31
VLAI
Details
WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-54352"
],
"database_specific": {
"cwe_ids": [
"CWE-669"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-21T05:15:38Z",
"severity": "LOW"
},
"details": "WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior.",
"id": "GHSA-585c-5qcq-7fgc",
"modified": "2025-07-21T06:31:19Z",
"published": "2025-07-21T06:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54352"
},
{
"type": "WEB",
"url": "https://www.imperva.com/blog/beware-a-threat-actor-could-steal-the-titles-of-your-private-and-draft-wordpress-posts"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-59WR-FJJ3-MR2W
Vulnerability from github – Published: 2026-03-18 12:31 – Updated: 2026-03-18 12:31
VLAI
Details
In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.
Severity
6.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-33265"
],
"database_specific": {
"cwe_ids": [
"CWE-669"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-18T12:16:19Z",
"severity": "MODERATE"
},
"details": "In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.",
"id": "GHSA-59wr-fjj3-mr2w",
"modified": "2026-03-18T12:31:52Z",
"published": "2026-03-18T12:31:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33265"
},
{
"type": "WEB",
"url": "https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251205-01_LibreChat_RAG_API_Authentication_Bypass"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2026/03/18/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-5HF6-CRG4-FG59
Vulnerability from github – Published: 2026-04-03 06:31 – Updated: 2026-04-04 06:55
VLAI
Summary
Roundcube: Bypass of remote image blocking via crafted BODY background attribute
Details
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. This may lead to information disclosure or access-control bypass.
Severity
5.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "roundcube/roundcubemail"
},
"ranges": [
{
"events": [
{
"introduced": "1.7-beta"
},
{
"fixed": "1.7-rc5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-35542"
],
"database_specific": {
"cwe_ids": [
"CWE-669"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-04T06:55:40Z",
"nvd_published_at": "2026-04-03T05:16:22Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. This may lead to information disclosure or access-control bypass.",
"id": "GHSA-5hf6-crg4-fg59",
"modified": "2026-04-04T06:55:40Z",
"published": "2026-04-03T06:31:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35542"
},
{
"type": "WEB",
"url": "https://github.com/roundcube/roundcubemail/commit/e052328e3dc75f13adc2e314eaa4096ac21084ad"
},
{
"type": "WEB",
"url": "https://github.com/roundcube/roundcubemail/commit/fd0e98178db5c73eaa93d005b561874923f9b0f0"
},
{
"type": "WEB",
"url": "https://github.com/roundcube/roundcubemail/commit/fde14d01adc9f37893cd82b635883e516ed453f8"
},
{
"type": "PACKAGE",
"url": "https://github.com/roundcube/roundcubemail"
},
{
"type": "WEB",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.14"
},
{
"type": "WEB",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.14"
},
{
"type": "WEB",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5"
},
{
"type": "WEB",
"url": "https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Roundcube: Bypass of remote image blocking via crafted BODY background attribute"
}
GHSA-5P6R-4C7P-96FH
Vulnerability from github – Published: 2026-03-16 15:30 – Updated: 2026-03-16 15:30
VLAI
Details
telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-32772"
],
"database_specific": {
"cwe_ids": [
"CWE-669"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-16T14:19:44Z",
"severity": "LOW"
},
"details": "telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.",
"id": "GHSA-5p6r-4c7p-96fh",
"modified": "2026-03-16T15:30:43Z",
"published": "2026-03-16T15:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32772"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2026/03/13/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5W8J-MJV3-J7GW
Vulnerability from github – Published: 2023-10-11 12:30 – Updated: 2024-04-04 08:33
VLAI
Details
Broadcast permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may affect service confidentiality.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2023-44100"
],
"database_specific": {
"cwe_ids": [
"CWE-669"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-11T12:15:11Z",
"severity": "HIGH"
},
"details": "Broadcast permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may affect service confidentiality.",
"id": "GHSA-5w8j-mjv3-j7gw",
"modified": "2024-04-04T08:33:39Z",
"published": "2023-10-11T12:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44100"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2023/10"
},
{
"type": "WEB",
"url": "https://https://device.harmonyos.com/en/docs/security/update/security-bulletins-202310-0000001663676540"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.