Advisories · Weakness

CWE-669.

Every Advisory and CVE whose sources give the weakness CWE-669, newest first.

CVE-2025-62646 CVE record

CVSS 5.0 Medium

Restaurant Brands International assistant platform: The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows…
- Restaurant Brands International assistant platform
- CWE-669
Not analysed yet 17 Oct 2025
CVE-2025-62292 CVE record

CVSS 4.3 Medium

SonarSource SonarQube: In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA…
- SonarSource SonarQube
- CWE-669
Not analysed yet 10 Oct 2025
CVE-2025-56675 CVE record

CVSS 3.5 Low

EKEN video doorbell T6: The EKEN video doorbell T6 BT60PLUS_MAIN_V1.0_GC1084_20230531 periodically sends debug…
- EKEN video doorbell T6
- CWE-669
Not analysed yet 30 Sept 2025
CVE-2025-59692 CVE record

CVSS 3.7 Low

PureVPN client applications on Linux through September 2025 mishandle firewalling.
- PureVPN
- CWE-669
Not analysed yet 18 Sept 2025
CVE-2025-59691 CVE record

CVSS 3.7 Low

PureVPN: PureVPN client applications on Linux through September 2025 allow IPv6 traffic to leak…
- PureVPN
- CWE-669
Not analysed yet 18 Sept 2025
CVE-2025-59453 CVE record

CVSS 3.2 Low

clickstudios Passwordstate: Click Studios Passwordstate before 9.9 Build 9972 has a potential authentication bypass…
- clickstudios Passwordstate
- CWE-669
Not analysed yet 16 Sept 2025
CVE-2025-59378 CVE record

CVSS 5.7 Medium

GNU Guix: In guix-daemon in GNU Guix before 1618ca7…
- GNU Guix
- CWE-669
Not analysed yet 15 Sept 2025
CVE-2025-59363 CVE record

CVSS 7.7 High

One Identity OneLogin: In One Identity OneLogin before 2025.3.0…
- One Identity OneLogin
- CWE-669
Not analysed yet 14 Sept 2025
CVE-2025-34158 CVE record

CVSS 8.5 High

Plex Media Server: Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect…
- Plex Media Server
- CWE-669
Not analysed yet 21 Aug 2025
CVE-2025-54956 CVE record

CVSS 3.2 Low

r-lib gh: The gh package before 1.5.0 for R delivers an HTTP response in a data structure that…
- r-lib gh
- CWE-669
Not analysed yet 3 Aug 2025
CVE-2025-54352 CVE record

CVSS 3.7 Low

WordPress: WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft…
- WordPress
- CWE-669
Not analysed yet 21 Jul 2025
CVE-2025-54310 CVE record

CVSS 4.0 Medium

qBittorrent before 5.1.2 does not prevent access to a local file that is referenced in a link URL.
- qBittorrent
- CWE-669
Not analysed yet 18 Jul 2025
CVE-2025-41645 CVE record

CVSS 8.6 High

SMA: Sunny Portal demo system privilege escalation
- SMA www.sunnyportal.com
- CWE-669
Not analysed yet 13 May 2025
@misskey-dev/summaly npm

CVSS 2.1 Low

@misskey-dev/summaly Redirect Filter Bypass
- Open redirect
- CWE-665
>=3.0.1, <5.2.1 · fixed in 5.2.1

GHSA-7899-w6c4-vqc4 · CVE-2025-46553 Not analysed yet 5 May 2025
youtube-dl PyPI

CVSS 7.8 High

youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization
- Unrestricted file upload
- CWE-669
>=2015.01.25, <=2021.12.17 · no fixed version yet

GHSA-22fp-mf44-f2mq Not analysed yet 18 Apr 2025
CVE-2025-26698 CVE record

CVSS 2.7 Low

Incorrect resource transfer between spheres issue exists in RevoWorks SCVX and RevoWorks Browser.
- J’s Communication Co., Ltd. RevoWorks SCVX
- J’s Communication Co., Ltd. RevoWorks Browser
- CWE-669
Not analysed yet 26 Feb 2025
github.com/ElrondNetwork/elrond-go Go

CVSS 7.2 High

Elrond-GO processing: fallback search of SCRs when not found in the main cache in github.com/ElrondNetwork/elrond-go
- CWE-669
<1.3.50 · fixed in 1.3.50

GHSA-p228-4mrh-ww7r · CVE-2022-46173 Not analysed yet 21 Aug 2024
yt-dlp PyPI

CVSS 7.8 High

yt-dlp File system modification and RCE through improper file-extension sanitization
- Unrestricted file upload
- CWE-669
<2024.07.01 · fixed in 2024.07.01

GHSA-79w7-vh3h-8g4j · CVE-2024-38519 Not analysed yet 2 Jul 2024
urllib3 PyPI

CVSS 4.4 Medium

urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects
- CWE-669
<1.26.19 || >=2.0.0, <2.2.2 · fixed in 1.26.19, 2.2.2

GHSA-34jh-p97f-mpxf · CVE-2024-37891 Not analysed yet 17 Jun 2024
org.xmlunit:xmlunit-core Maven

CVSS 4.0 Medium

XMLUnit for Java has Insecure Defaults when Processing XSLT Stylesheets
- CWE-669
<2.10.0 · fixed in 2.10.0

GHSA-chfm-68vv-pvw5 · CVE-2024-31573 Not analysed yet 1 May 2024
github.com/docker/docker Go

CVSS 5.9 Medium

Moby's external DNS requests from 'internal' networks could lead to data exfiltration
- CWE-669
<23.0.11 || >=25.0.0, <25.0.5 || >=26.0.0-rc1, <26.0.0-rc3 · fixed in 23.0.11, 25.0.5, 26.0.0-rc3

GHSA-mq39-4gv4-mvpx · CVE-2024-29018 Not analysed yet 20 Mar 2024
CVE-2023-41894 CVE record

CVSS 5.3 Medium

Local-only webhooks externally accessible via SniTun in Home Assistant Core
- home-assistant core
- CWE-669
Not analysed yet 19 Oct 2023
CVE-2023-31115 CVE record

CVSS 7.5 High

An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300.
- CWE-669
Not analysed yet 7 Jun 2023
CVE-2023-31114 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300.
- CWE-669
Not analysed yet 7 Jun 2023
CVE-2023-22950 CVE record

CVSS 6.5 Medium

An issue was discovered in TigerGraph Enterprise Free Edition 3.x.
- CWE-669
Not analysed yet 13 Apr 2023
parse-server npm

CVSS 4.3 Medium

parse-server's session object properties can be updated by foreign user if object ID is known
- Broken access control
- CWE-669
<4.10.15 || >=5.0.0, <5.2.6 · fixed in 4.10.15, 5.2.6

GHSA-6w4q-23cf-j9jp · CVE-2022-39225 Not analysed yet 21 Sept 2022
@openzeppelin/contracts +1 npm

CVSS 5.3 Medium

OpenZeppelin Contracts's Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls
- CWE-669
>=4.6.0, <4.7.2 · fixed in 4.7.2

GHSA-9j3m-g383-29qr · CVE-2022-35916 Not analysed yet 14 Aug 2022
CVE-2022-30236 CVE record

CVSS 8.2 High

Schneider Electric Wiser Smart: A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could…
- Schneider Electric Wiser Smart
- CWE-669
Not analysed yet 2 Jun 2022
org.grails:grails-core Maven

CVSS 8.1 High

Incorrect Resource Transfer Between Spheres in Grails
- CWE-494
- CWE-669
<3.3.10 · fixed in 3.3.10

GHSA-pmxf-4v8c-rwr7 · CVE-2019-12728 Not analysed yet 24 May 2022
org.eclipse.vorto:org.eclipse.vorto.core Maven

CVSS 8.1 High

Eclipse Vorto resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS
- CWE-494
- CWE-669
<0.11.0 · fixed in 0.11.0

GHSA-fg2q-v428-2gph · CVE-2019-10248 Not analysed yet 24 May 2022
CVE-2021-22806 CVE record

spaceLYnk (V2.6.1 and prior)…: A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could…
- spaceLYnk (V2.6.1 and prior), Wiser for KNX (V2.6.1 and prior), fellerLYnk (V2.6.1 and prior)
- CWE-669
Not analysed yet 11 Feb 2022
publify_core RubyGems

CVSS 6.5 Medium

Publify `guest` role users can self-register even when the admin does not allow it
- Broken access control
- CWE-669
>=9.0.0.pre1, <9.2.5 · fixed in 9.2.5

GHSA-x24j-87x9-jvv5 · CVE-2021-25973 Not analysed yet 3 Nov 2021
CVE-2021-34574 CVE record

CVSS 4.3 Medium

Password policy evasion in products of MB connect line and Helmholz
- MB connect line mymbCONNECT24
- MB connect line mbCONNECT24
- CWE-669
Not analysed yet 2 Aug 2021
github.com/containerd/containerd Go

CVSS 5.2 Medium

containerd-shim API Exposed to Host Network Containers
- CWE-669
<1.3.9 || >=1.4.0, <1.4.3 · fixed in 1.3.9, 1.4.3

GHSA-36xw-fx78-c5r4 · CVE-2020-15257 Not analysed yet 24 May 2021
com.diffplug.spotless:spotless-eclipse-cdt +2 Maven

CVSS 5.9 Medium

Incorrect Resource Transfer Between Spheres in eclipse-wtp
- CWE-669
<9.4.4 · fixed in 9.4.4

GHSA-gvxv-5fp2-358q · CVE-2019-10753 Not analysed yet 11 Sept 2019
CVE-2019-0042 CVE record

CVSS 5.7 Medium

Incorrect messages from Juniper Identity Management Service (JIMS) can trigger Denial of Service or firewall bypass conditions for SRX series devices
- Juniper Networks Juniper Identity Management Service
- Denial of service
- CWE-305
Not analysed yet 10 Apr 2019