CWE-669
Allowed-with-ReviewIncorrect Resource Transfer Between Spheres
Abstraction: Class · Status: Draft
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
175 vulnerabilities reference this CWE, most recent first.
GHSA-GVXV-5FP2-358Q
Vulnerability from github – Published: 2019-09-11 23:08 – Updated: 2022-11-17 18:24In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version 9.4.4 for eclipse-cdt, and all versions prior to version 3.0.1 for eclipse-groovy, Spotless was resolving dependencies over an insecure channel (http). If the build occurred over an insecure connection, a malicious user could have perform a Man-in-the-Middle attack during the build and alter the build artifacts that were produced. In case that any of these artifacts were compromised, any developers using these could be altered. Note: In order to validate that this artifact was not compromised, the maintainer would need to confirm that none of the artifacts published to the registry were not altered with. Until this happens, we can not guarantee that this artifact was not compromised even though the probability that this happened is low.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.diffplug.spotless:spotless-eclipse-wtp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.diffplug.spotless:spotless-eclipse-cdt"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.4.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.diffplug.spotless:spotless-eclipse-groovy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-10753"
],
"database_specific": {
"cwe_ids": [
"CWE-669"
],
"github_reviewed": true,
"github_reviewed_at": "2019-09-11T22:56:33Z",
"nvd_published_at": "2019-09-05T20:15:00Z",
"severity": "MODERATE"
},
"details": "In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version 9.4.4 for eclipse-cdt, and all versions prior to version 3.0.1 for eclipse-groovy, Spotless was resolving dependencies over an insecure channel (http). If the build occurred over an insecure connection, a malicious user could have perform a Man-in-the-Middle attack during the build and alter the build artifacts that were produced. In case that any of these artifacts were compromised, any developers using these could be altered. **Note:** In order to validate that this artifact was not compromised, the maintainer would need to confirm that none of the artifacts published to the registry were not altered with. Until this happens, we can not guarantee that this artifact was not compromised even though the probability that this happened is low.",
"id": "GHSA-gvxv-5fp2-358q",
"modified": "2022-11-17T18:24:26Z",
"published": "2019-09-11T23:08:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10753"
},
{
"type": "WEB",
"url": "https://github.com/diffplug/spotless/issues/360"
},
{
"type": "PACKAGE",
"url": "https://github.com/diffplug/spotless"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-COMDIFFPLUGSPOTLESS-460377"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Incorrect Resource Transfer Between Spheres in eclipse-wtp"
}
GHSA-GX4X-GC82-V87Q
Vulnerability from github – Published: 2026-09-14 03:30 – Updated: 2026-09-14 03:30In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a sandboxed environment for running Serena."
{
"affected": [],
"aliases": [
"CVE-2026-38924"
],
"database_specific": {
"cwe_ids": [
"CWE-669"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-14T03:16:36Z",
"severity": "LOW"
},
"details": "In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a \"potential security hazard\" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended \"use a sandboxed environment for running Serena.\"",
"id": "GHSA-gx4x-gc82-v87q",
"modified": "2026-09-14T03:30:22Z",
"published": "2026-09-14T03:30:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oraios/serena/security/advisories/GHSA-m922-r24v-6wff"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-38924"
},
{
"type": "WEB",
"url": "https://github.com/oraios/serena/commit/a7af5c1f8a9ea27102eac9e72f64dd97dbfefff3"
},
{
"type": "WEB",
"url": "https://github.com/oraios/serena/commit/b00ae292ac2d49947506886f44eb1cad7b7d7cd1"
},
{
"type": "WEB",
"url": "https://dash.security/blog/cve-2026-38924-unauthenticated-rce-in-the-serena-mcp-server"
},
{
"type": "WEB",
"url": "https://github.com/oraios/serena/compare/v0.1.4...v1.0.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H53C-VV76-W4W5
Vulnerability from github – Published: 2026-06-13 00:34 – Updated: 2026-06-13 00:34Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection.
This issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux.
{
"affected": [],
"aliases": [
"CVE-2026-12068"
],
"database_specific": {
"cwe_ids": [
"CWE-669"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-12T23:16:33Z",
"severity": "HIGH"
},
"details": "Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection.\n\nThis issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux.",
"id": "GHSA-h53c-vv76-w4w5",
"modified": "2026-06-13T00:34:33Z",
"published": "2026-06-13T00:34:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12068"
},
{
"type": "WEB",
"url": "https://www.gendigital.com/us/en/contact-us/security-advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H568-MFP5-V835
Vulnerability from github – Published: 2025-07-18 21:30 – Updated: 2025-07-18 21:30qBittorrent before 5.1.2 does not prevent access to a local file that is referenced in a link URL. This affects rsswidget.cpp and searchjobwidget.cpp.
{
"affected": [],
"aliases": [
"CVE-2025-54310"
],
"database_specific": {
"cwe_ids": [
"CWE-669"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-18T20:15:24Z",
"severity": "MODERATE"
},
"details": "qBittorrent before 5.1.2 does not prevent access to a local file that is referenced in a link URL. This affects rsswidget.cpp and searchjobwidget.cpp.",
"id": "GHSA-h568-mfp5-v835",
"modified": "2025-07-18T21:30:30Z",
"published": "2025-07-18T21:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54310"
},
{
"type": "WEB",
"url": "https://github.com/qbittorrent/qBittorrent/commit/6ad073e0bc26c1f9d3530490ece611b49f5bfcab"
},
{
"type": "WEB",
"url": "https://github.com/qbittorrent/qBittorrent/commit/ad68813fe879ba245a4f41f105ed8d2114a92971"
},
{
"type": "WEB",
"url": "https://www.qbittorrent.org/news#wed-jul-02nd-2025---qbittorrent-v5.1.2-release"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H6W8-M27H-F268
Vulnerability from github – Published: 2026-09-05 06:32 – Updated: 2026-09-05 06:32In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
{
"affected": [],
"aliases": [
"CVE-2026-86144"
],
"database_specific": {
"cwe_ids": [
"CWE-669"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-05T05:17:13Z",
"severity": "MODERATE"
},
"details": "In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).",
"id": "GHSA-h6w8-m27h-f268",
"modified": "2026-09-05T06:32:37Z",
"published": "2026-09-05T06:32:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86144"
},
{
"type": "WEB",
"url": "https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61"
},
{
"type": "WEB",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-H8W5-58RH-75VR
Vulnerability from github – Published: 2026-05-26 13:30 – Updated: 2026-05-26 13:30Wine ships a .desktop file that registers itself as a MIME handler for EXE files and several other Windows executable file types. In some configurations, handling of an EXE file causes that file to be blindly executed with the permissions of the invoker. This allows escaping Flatpak and Snap sandboxes, because MIME handlers are not intended for use by code interpreters and loaders. NOTE: some parties feel that this is not a bug to be addressed in Wine, because there is no known solution that avoids a severe loss of usability (Wine could be a binfmt-misc handler, but binfmt-misc does not exist on all platforms supported by Wine).
{
"affected": [],
"aliases": [
"CVE-2026-48831"
],
"database_specific": {
"cwe_ids": [
"CWE-669"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-24T22:16:16Z",
"severity": "HIGH"
},
"details": "Wine ships a .desktop file that registers itself as a MIME handler for EXE files and several other Windows executable file types. In some configurations, handling of an EXE file causes that file to be blindly executed with the permissions of the invoker. This allows escaping Flatpak and Snap sandboxes, because MIME handlers are not intended for use by code interpreters and loaders. NOTE: some parties feel that this is not a bug to be addressed in Wine, because there is no known solution that avoids a severe loss of usability (Wine could be a binfmt-misc handler, but binfmt-misc does not exist on all platforms supported by Wine).",
"id": "GHSA-h8w5-58rh-75vr",
"modified": "2026-05-26T13:30:35Z",
"published": "2026-05-26T13:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48831"
},
{
"type": "WEB",
"url": "https://bugs.winehq.org/show_bug.cgi?id=59767"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2026/05/19/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/05/25/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:Clear",
"type": "CVSS_V4"
}
]
}
GHSA-HXWF-HGXF-GHJJ
Vulnerability from github – Published: 2022-04-29 02:58 – Updated: 2022-04-29 02:58Opera does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) in the same domain, which could allow remote attackers to steal cookies and conduct unauthorized activities, aka "Cross Security Boundary Cookie Injection."
{
"affected": [],
"aliases": [
"CVE-2004-0872"
],
"database_specific": {
"cwe_ids": [
"CWE-669"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2004-09-16T04:00:00Z",
"severity": "MODERATE"
},
"details": "Opera does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) in the same domain, which could allow remote attackers to steal cookies and conduct unauthorized activities, aka \"Cross Security Boundary Cookie Injection.\"",
"id": "GHSA-hxwf-hgxf-ghjj",
"modified": "2022-04-29T02:58:31Z",
"published": "2022-04-29T02:58:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0872"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17417"
},
{
"type": "WEB",
"url": "http://securityfocus.com/archive/1/375407"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1011329"
},
{
"type": "WEB",
"url": "http://www.westpoint.ltd.uk/advisories/wp-04-0001.txt"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-J2G6-8RVG-7MF6
Vulnerability from github – Published: 2026-04-03 06:31 – Updated: 2026-04-04 06:56An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate attributes) in an e-mail message. This may lead to information disclosure or access-control bypass.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "roundcube/roundcubemail"
},
"ranges": [
{
"events": [
{
"introduced": "1.7-beta"
},
{
"fixed": "1.7-rc5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-35543"
],
"database_specific": {
"cwe_ids": [
"CWE-669"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-04T06:56:48Z",
"nvd_published_at": "2026-04-03T05:16:22Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate attributes) in an e-mail message. This may lead to information disclosure or access-control bypass.",
"id": "GHSA-j2g6-8rvg-7mf6",
"modified": "2026-04-04T06:56:48Z",
"published": "2026-04-03T06:31:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35543"
},
{
"type": "WEB",
"url": "https://github.com/roundcube/roundcubemail/commit/1a63e01542bff42aaa71c00c4c279a09ef31f20c"
},
{
"type": "WEB",
"url": "https://github.com/roundcube/roundcubemail/commit/39471343ee081ce1d31696c456a2c163462daae3"
},
{
"type": "WEB",
"url": "https://github.com/roundcube/roundcubemail/commit/82ab5eca7b332fce7a174b2b987f0957a66377cd"
},
{
"type": "PACKAGE",
"url": "https://github.com/roundcube/roundcubemail"
},
{
"type": "WEB",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.14"
},
{
"type": "WEB",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.14"
},
{
"type": "WEB",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5"
},
{
"type": "WEB",
"url": "https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail message"
}
GHSA-J3HR-9JF2-7JHV
Vulnerability from github – Published: 2026-09-13 21:31 – Updated: 2026-09-13 21:31Floodlight 71fe8a7 allows disruption of host communication via link spoofing. A port is misclassified as a non-boundary.
{
"affected": [],
"aliases": [
"CVE-2025-45480"
],
"database_specific": {
"cwe_ids": [
"CWE-669"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-13T19:16:52Z",
"severity": "LOW"
},
"details": "Floodlight 71fe8a7 allows disruption of host communication via link spoofing. A port is misclassified as a non-boundary.",
"id": "GHSA-j3hr-9jf2-7jhv",
"modified": "2026-09-13T21:31:41Z",
"published": "2026-09-13T21:31:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-45480"
},
{
"type": "WEB",
"url": "https://github.com/floodlight/floodlight/issues/873"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J3W4-VVQ3-QPF6
Vulnerability from github – Published: 2025-10-17 21:31 – Updated: 2025-10-18 03:30The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers.
{
"affected": [],
"aliases": [
"CVE-2025-62646"
],
"database_specific": {
"cwe_ids": [
"CWE-669"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-17T21:15:37Z",
"severity": "MODERATE"
},
"details": "The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers.",
"id": "GHSA-j3w4-vvq3-qpf6",
"modified": "2025-10-18T03:30:24Z",
"published": "2025-10-17T21:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62646"
},
{
"type": "WEB",
"url": "https://archive.today/fMYQp"
},
{
"type": "WEB",
"url": "https://bobdahacker.com/blog/rbi-hacked-drive-thrus"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20250906134240/https:/bobdahacker.com/blog/rbi-hacked-drive-thrus"
},
{
"type": "WEB",
"url": "https://www.malwarebytes.com/blog/news/2025/09/popeyes-tim-hortons-burger-king-platforms-have-catastrophic-vulnerabilities-say-hackers"
},
{
"type": "WEB",
"url": "https://www.yahoo.com/news/articles/burger-king-hacked-attackers-impressed-124154038.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.