# CWE-669.

Every Advisory and CVE whose sources give the weakness CWE-669, newest first.

## Records, newest first (an older page)

- [Restaurant Brands International assistant platform: The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows…](https://agentprime.io/advisories/CVE-2025-62646.md)
  `CVE-2025-62646` · CVE record: Restaurant Brands International assistant platform · CVSS 5.0 Medium · Not analysed yet · Published 17 Oct 2025 · Tags: CWE-669
- [SonarSource SonarQube: In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA…](https://agentprime.io/advisories/CVE-2025-62292.md)
  `CVE-2025-62292` · CVE record: SonarSource SonarQube · CVSS 4.3 Medium · Not analysed yet · Published 10 Oct 2025 · Tags: CWE-669
- [EKEN video doorbell T6: The EKEN video doorbell T6 BT60PLUS_MAIN_V1.0_GC1084_20230531 periodically sends debug…](https://agentprime.io/advisories/CVE-2025-56675.md)
  `CVE-2025-56675` · CVE record: EKEN video doorbell T6 · CVSS 3.5 Low · Not analysed yet · Published 30 Sept 2025 · Tags: CWE-669
- [PureVPN client applications on Linux through September 2025 mishandle firewalling.](https://agentprime.io/advisories/CVE-2025-59692.md)
  `CVE-2025-59692` · CVE record: PureVPN PureVPN · CVSS 3.7 Low · Not analysed yet · Published 18 Sept 2025 · Tags: CWE-669
- [PureVPN: PureVPN client applications on Linux through September 2025 allow IPv6 traffic to leak…](https://agentprime.io/advisories/CVE-2025-59691.md)
  `CVE-2025-59691` · CVE record: PureVPN PureVPN · CVSS 3.7 Low · Not analysed yet · Published 18 Sept 2025 · Tags: CWE-669
- [clickstudios Passwordstate: Click Studios Passwordstate before 9.9 Build 9972 has a potential authentication bypass…](https://agentprime.io/advisories/CVE-2025-59453.md)
  `CVE-2025-59453` · CVE record: clickstudios Passwordstate · CVSS 3.2 Low · Not analysed yet · Published 16 Sept 2025 · Tags: CWE-669
- [GNU Guix: In guix-daemon in GNU Guix before 1618ca7…](https://agentprime.io/advisories/CVE-2025-59378.md)
  `CVE-2025-59378` · CVE record: GNU Guix · CVSS 5.7 Medium · Not analysed yet · Published 15 Sept 2025 · Tags: CWE-669
- [One Identity OneLogin: In One Identity OneLogin before 2025.3.0…](https://agentprime.io/advisories/CVE-2025-59363.md)
  `CVE-2025-59363` · CVE record: One Identity OneLogin · CVSS 7.7 High · Not analysed yet · Published 14 Sept 2025 · Tags: CWE-669
- [Plex Media Server: Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect…](https://agentprime.io/advisories/CVE-2025-34158.md)
  `CVE-2025-34158` · CVE record: Plex Media Server · CVSS 8.5 High · Not analysed yet · Published 21 Aug 2025 · Tags: CWE-669
- [r-lib gh: The gh package before 1.5.0 for R delivers an HTTP response in a data structure that…](https://agentprime.io/advisories/CVE-2025-54956.md)
  `CVE-2025-54956` · CVE record: r-lib gh · CVSS 3.2 Low · Not analysed yet · Published 3 Aug 2025 · Tags: CWE-669
- [WordPress: WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft…](https://agentprime.io/advisories/CVE-2025-54352.md)
  `CVE-2025-54352` · CVE record: WordPress WordPress · CVSS 3.7 Low · Not analysed yet · Published 21 Jul 2025 · Tags: CWE-669
- [qBittorrent before 5.1.2 does not prevent access to a local file that is referenced in a link URL.](https://agentprime.io/advisories/CVE-2025-54310.md)
  `CVE-2025-54310` · CVE record: qBittorrent qBittorrent · CVSS 4.0 Medium · Not analysed yet · Published 18 Jul 2025 · Tags: CWE-669
- [SMA: Sunny Portal demo system privilege escalation](https://agentprime.io/advisories/CVE-2025-41645.md)
  `CVE-2025-41645` · CVE record: SMA www\.sunnyportal.com · CVSS 8.6 High · Not analysed yet · Published 13 May 2025 · Tags: CWE-669
- [@misskey-dev/summaly Redirect Filter Bypass](https://agentprime.io/advisories/GHSA-7899-w6c4-vqc4.md)
  `GHSA-7899-w6c4-vqc4`, `CVE-2025-46553` · npm `@misskey-dev/summaly`: affected `>=3.0.1, <5.2.1`, fixed in `5.2.1` · CVSS 2.1 Low · Not analysed yet · Published 5 May 2025 · Tags: Open redirect, CWE-665, CWE-669, CWE-693
- [youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization](https://agentprime.io/advisories/GHSA-22fp-mf44-f2mq.md)
  `GHSA-22fp-mf44-f2mq` · PyPI `youtube-dl`: affected `>=2015.01.25, <=2021.12.17`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 18 Apr 2025 · Tags: Unrestricted file upload, CWE-669
- [Incorrect resource transfer between spheres issue exists in RevoWorks SCVX and RevoWorks Browser.](https://agentprime.io/advisories/CVE-2025-26698.md)
  `CVE-2025-26698` · CVE record: J’s Communication Co., Ltd. RevoWorks SCVX and 1 more · CVSS 2.7 Low · Not analysed yet · Published 26 Feb 2025 · Tags: CWE-669
- [Elrond-GO processing: fallback search of SCRs when not found in the main cache in github.com/ElrondNetwork/elrond-go](https://agentprime.io/advisories/GHSA-p228-4mrh-ww7r.md)
  `GHSA-p228-4mrh-ww7r`, `CVE-2022-46173`, `GO-2022-1200` · Go `github.com/ElrondNetwork/elrond-go`: affected `<1.3.50`, fixed in `1.3.50` · CVSS 7.2 High · Not analysed yet · Published 21 Aug 2024 · Tags: CWE-669
- [yt-dlp File system modification and RCE through improper file-extension sanitization](https://agentprime.io/advisories/GHSA-79w7-vh3h-8g4j.md)
  `GHSA-79w7-vh3h-8g4j`, `CVE-2024-38519`, `PYSEC-2026-2065` · PyPI `yt-dlp`: affected `<2024.07.01`, fixed in `2024.07.01` · CVSS 7.8 High · Not analysed yet · Published 2 Jul 2024 · Tags: Unrestricted file upload, CWE-669
- [urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects](https://agentprime.io/advisories/GHSA-34jh-p97f-mpxf.md)
  `GHSA-34jh-p97f-mpxf`, `CVE-2024-37891`, `PYSEC-2026-1995` · PyPI `urllib3`: affected `<1.26.19 || >=2.0.0, <2.2.2`, fixed in `1.26.19`, `2.2.2` · CVSS 4.4 Medium · Not analysed yet · Published 17 Jun 2024 · Tags: CWE-669
- [XMLUnit for Java has Insecure Defaults when Processing XSLT Stylesheets](https://agentprime.io/advisories/GHSA-chfm-68vv-pvw5.md)
  `GHSA-chfm-68vv-pvw5`, `CVE-2024-31573` · Maven `org.xmlunit:xmlunit-core`: affected `<2.10.0`, fixed in `2.10.0` · CVSS 4.0 Medium · Not analysed yet · Published 1 May 2024 · Tags: CWE-669
- [Moby's external DNS requests from 'internal' networks could lead to data exfiltration](https://agentprime.io/advisories/GHSA-mq39-4gv4-mvpx.md)
  `GHSA-mq39-4gv4-mvpx`, `CVE-2024-29018`, `GO-2024-2659` · Go `github.com/docker/docker`: affected `<23.0.11 || >=25.0.0, <25.0.5 || >=26.0.0-rc1, <26.0.0-rc3`, fixed in `23.0.11`, `25.0.5`, `26.0.0-rc3` · CVSS 5.9 Medium · Not analysed yet · Published 20 Mar 2024 · Tags: CWE-669
- [Local-only webhooks externally accessible via SniTun in Home Assistant Core](https://agentprime.io/advisories/CVE-2023-41894.md)
  `CVE-2023-41894` · CVE record: home-assistant core · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2023 · Tags: CWE-669
- [An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300.](https://agentprime.io/advisories/CVE-2023-31115.md)
  `CVE-2023-31115` · CVE record · CVSS 7.5 High · Not analysed yet · Published 7 Jun 2023 · Tags: CWE-669
- [An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300.](https://agentprime.io/advisories/CVE-2023-31114.md)
  `CVE-2023-31114` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jun 2023 · Tags: CWE-669
- [An issue was discovered in TigerGraph Enterprise Free Edition 3.x.](https://agentprime.io/advisories/CVE-2023-22950.md)
  `CVE-2023-22950` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 13 Apr 2023 · Tags: CWE-669
- [parse-server's session object properties can be updated by foreign user if object ID is known](https://agentprime.io/advisories/GHSA-6w4q-23cf-j9jp.md)
  `GHSA-6w4q-23cf-j9jp`, `BIT-parse-2022-39225`, `CVE-2022-39225` · npm `parse-server`: affected `<4.10.15 || >=5.0.0, <5.2.6`, fixed in `4.10.15`, `5.2.6` · CVSS 4.3 Medium · Not analysed yet · Published 21 Sept 2022 · Tags: Broken access control, CWE-669
- [OpenZeppelin Contracts's Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls](https://agentprime.io/advisories/GHSA-9j3m-g383-29qr.md)
  `GHSA-9j3m-g383-29qr`, `CVE-2022-35916` · npm `@openzeppelin/contracts` and 1 more: affected `>=4.6.0, <4.7.2`, fixed in `4.7.2` · CVSS 5.3 Medium · Not analysed yet · Published 14 Aug 2022 · Tags: CWE-669
- [Schneider Electric Wiser Smart: A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could…](https://agentprime.io/advisories/CVE-2022-30236.md)
  `CVE-2022-30236` · CVE record: Schneider Electric Wiser Smart · CVSS 8.2 High · Not analysed yet · Published 2 Jun 2022 · Tags: CWE-669
- [Incorrect Resource Transfer Between Spheres in Grails](https://agentprime.io/advisories/GHSA-pmxf-4v8c-rwr7.md)
  `GHSA-pmxf-4v8c-rwr7`, `CVE-2019-12728` · Maven `org.grails:grails-core`: affected `<3.3.10`, fixed in `3.3.10` · CVSS 8.1 High · Not analysed yet · Published 24 May 2022 · Tags: CWE-494, CWE-669
- [Eclipse Vorto resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS](https://agentprime.io/advisories/GHSA-fg2q-v428-2gph.md)
  `GHSA-fg2q-v428-2gph`, `CVE-2019-10248` · Maven `org.eclipse.vorto:org.eclipse.vorto.core`: affected `<0.11.0`, fixed in `0.11.0` · CVSS 8.1 High · Not analysed yet · Published 24 May 2022 · Tags: CWE-494, CWE-669, CWE-829
- [spaceLYnk (V2.6.1 and prior)…: A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could…](https://agentprime.io/advisories/CVE-2021-22806.md)
  `CVE-2021-22806` · CVE record: spaceLYnk (V2.6.1 and prior), Wiser for KNX (V2.6.1 and prior), fellerLYnk (V2.6.1 and prior) · No CVSS score · Not analysed yet · Published 11 Feb 2022 · Tags: CWE-669
- [Publify \`guest\` role users can self-register even when the admin does not allow it](https://agentprime.io/advisories/GHSA-x24j-87x9-jvv5.md)
  `GHSA-x24j-87x9-jvv5`, `BIT-publify-2021-25973`, `CVE-2021-25973` · RubyGems `publify_core`: affected `>=9.0.0.pre1, <9.2.5`, fixed in `9.2.5` · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2021 · Tags: Broken access control, CWE-669
- [Password policy evasion in products of MB connect line and Helmholz](https://agentprime.io/advisories/CVE-2021-34574.md)
  `CVE-2021-34574` · CVE record: MB connect line mymbCONNECT24 and 3 more · CVSS 4.3 Medium · Not analysed yet · Published 2 Aug 2021 · Tags: CWE-669
- [containerd-shim API Exposed to Host Network Containers](https://agentprime.io/advisories/GHSA-36xw-fx78-c5r4.md)
  `GHSA-36xw-fx78-c5r4`, `CVE-2020-15257`, `GO-2022-0784` · Go `github.com/containerd/containerd`: affected `<1.3.9 || >=1.4.0, <1.4.3`, fixed in `1.3.9`, `1.4.3` · CVSS 5.2 Medium · Not analysed yet · Published 24 May 2021 · Tags: CWE-669
- [Incorrect Resource Transfer Between Spheres in eclipse-wtp](https://agentprime.io/advisories/GHSA-gvxv-5fp2-358q.md)
  `GHSA-gvxv-5fp2-358q`, `CVE-2019-10753`, `SNYK-JAVA-COMDIFFPLUGSPOTLESS-460377` · Maven `com.diffplug.spotless:spotless-eclipse-cdt` and 2 more: affected `<9.4.4`, fixed in `9.4.4` · CVSS 5.9 Medium · Not analysed yet · Published 11 Sept 2019 · Tags: CWE-669
- [Incorrect messages from Juniper Identity Management Service (JIMS) can trigger Denial of Service or firewall bypass conditions for SRX series devices](https://agentprime.io/advisories/CVE-2019-0042.md)
  `CVE-2019-0042` · CVE record: Juniper Networks Juniper Identity Management Service · CVSS 5.7 Medium · Not analysed yet · Published 10 Apr 2019 · Tags: Denial of service, CWE-305, CWE-669

Newest: <https://agentprime.io/advisories/tag/cwe-669.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-669&cursor=WyIyMDI1LTEwLTIyVDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNS02Mjc3NSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-669/?cursor=WyIyMDI1LTEwLTIyVDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNS02Mjc3NSJd>. Everything for agents: <https://agentprime.io/llms.txt>.