Incorrect Resource Transfer Between Spheres
CWE-669
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
We track 31 vulnerabilities of this type. 97% are rated high or critical, and the average CVSS score is 8.0. 3 have been exploited in real attacks.
Latest Incorrect Resource Transfer Between Spheres vulnerabilities
- 7.2 High severity
netlify-okta-auth: Incorrect Resource Transfer Between Spheres
@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set.
- 4.3 Medium severity
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Exploited
Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience
- 8.1 High severity
Wheels: Incorrect Resource Transfer Between Spheres
Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For exists(key=), production with error information disabled returns true for an out-of-scope key instead of throwing. Appl
- 7.5 High severity
Backdrop: Incorrect Resource Transfer Between Spheres
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type.
- 7.8 High severity
Virtual GPU Manager: Incorrect Resource Transfer Between Spheres
NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability where an attacker could cause incorrect resource transfer between spheres. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges,
- 7.8 High severity
Infinity: Incorrect Resource Transfer Between Spheres
Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexip Infinity service that allows an attacker with local access to escalate privileges to root. Exploitation requires an attacker to be able to
- 9.1 Critical severity
Cisco Identity Services Engine Software: Incorrect Resource Transfer Between Spheres
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This review
- 7.5 High severity
ca-certificates: Incorrect Resource Transfer Between Spheres
The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the root store. NOTE: this issue exists because of an incorrect fix for CVE-2022-23491.
- 7.8 High severity
libxml2: Incorrect Resource Transfer Between Spheres
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers
- 9.8 Critical severity
Webmail: Incorrect Resource Transfer Between Spheres
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead to information disclosure or privilege escalation.
- 8.3 High severity
Chrome: Incorrect Resource Transfer Between Spheres
Inappropriate implementation in AI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
- 7.4 High severity
Avira Password Manager: Incorrect Resource Transfer Between Spheres
Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection. This issu
- 7.3 High severity
Wine: Incorrect Resource Transfer Between Spheres
Wine ships a .desktop file that registers itself as a MIME handler for EXE files and several other Windows executable file types. In some configurations, handling of an EXE file causes that file to be blindly executed with the permissions of the invoker. This
- 7.7 High severity
Ironic: Incorrect Resource Transfer Between Spheres
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStac
- 7.8 High severity
Linux Kernel Incorrect Resource Transfer Between Spheres Exploited
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_
- 8.2 High severity
Webmail: Incorrect Resource Transfer Between Spheres
An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosure or access-control bypass. This involves the animate element w
- 8.8 High severity
CODESYS Control RTE (SL): Incorrect Resource Transfer Between Spheres
A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution.
- 8.2 High severity
Nova: Incorrect Resource Transfer Between Spheres
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without
- 8.8 High severity
OpenClaw: Incorrect Resource Transfer Between Spheres
OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without prompting, sending a token value.
- 9.8 Critical severity
Apache Airflow Providers Edge3: Incorrect Resource Transfer Between Spheres
Edge3 Worker RPC RCE on Airflow 2. This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if you installed and configured it on Airflow 2. The Edge3 provider support in Airflow 2 has been always development-only and not officially released,
- 7.7 High severity
assistant platform: Incorrect Resource Transfer Between Spheres
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers.
- 7.7 High severity
OneLogin: Incorrect Resource Transfer Between Spheres
In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 (even though this secret should only be returned when an App is first created),
- 8.5 High severity
Media Server: Incorrect Resource Transfer Between Spheres
Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the server owner (and a /api/resources call reveals other servers accessible by that
- 7.8 High severity
yt-dlp: Incorrect Resource Transfer Between Spheres
`yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path t
- 7.5 High severity
moby: Incorrect Resource Transfer Between Spheres
Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking implementation allows for many networks, each with their own IP address range and g
- 7.5 High severity
Exynos 5123 Firmware: Incorrect Resource Transfer Between Spheres
An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. Incorrect resource transfer between spheres can cause changes to the activation mode of RCS via a crafted application.
- 9.1 Critical severity
Exynos 5123 Firmware: Incorrect Resource Transfer Between Spheres
An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. Incorrect resource transfer between spheres can cause unintended querying of the SIM status via a crafted application.
- 8.0 High severity
Unisphere for PowerMax: Incorrect Resource Transfer Between Spheres
Unisphere for PowerMax versions before 9.2.3.15 contain a privilege escalation vulnerability. An adjacent malicious user may potentially exploit this vulnerability to escalate their privileges and access functionalities they do not have access to.
- 8.2 High severity
Wiser Smart: Incorrect Resource Transfer Between Spheres
A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could allow unauthorized access when an attacker uses cross-domain attacks. Affected Products: Wiser Smart, EER21000 & EER21001 (V4.5 and prior)
- 9.6 Critical severity
Cisco Unified Contact Center Domain Manager: Incorrect Resource Transfer Between Spheres
A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) and Cisco Unified Contact Center Domain Manager (Unified CCDM) could allow an authenticated, remote attacker to elevate their privileges to A
- 7.2 High severity
Ivanti Pulse Connect Secure Unrestricted File Upload Exploited
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.