Threats Tagged 'cwe-669'

In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.

Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection. This issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux.

OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.

OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.

CVE-2026-48847 is a vulnerability in Roundcube Webmail versions 1.6.0 through 1.6.15 and 1.7.0 that allows an unauthenticated attacker to delete arbitrary files by exploiting session poisoning via redis or memcache. The vulnerability is classified under CWE-669, indicating incorrect resource transfer between spheres. The CVSS score is 3.7, reflecting a low severity impact primarily affecting availability with no confidentiality or integrity impact.

CVE-2026-48846 is a medium severity vulnerability in Roundcube Webmail versions 1.6.0 through 1.6.15 and 1.7.0. It allows bypassing the remote image blocking feature via a crafted CSS var() value in an email message. This bypass may lead to information disclosure or access-control bypass. No official patch or remediation level has been confirmed yet.

In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinations, which may lead to information disclosure or privilege escalation via a text/html email message.