Skip to content
OpenAdvisories

Weakness (CWE)

CWE-653: Improper Isolation or Compartmentalization

Class Draft

The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Break up privileges between different modules, objects, or entities. Minimize the interfaces between modules and require strong access control between them.

Source: MITRE CWE-653

All Critical High Medium Low Exploited only Public exploit

96 results · Feed

  • Medium 6.5
    CVE-2024-57720

    lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_blend.

    lunasvg PyPI
  • High 7.6
    CVE-2024-47520

    A user with advanced report application access rights can perform actions for which they are not authorized

    A user with advanced report application access rights can perform actions for which they are not authorized

    Arista Networks Arista Edge Threat Management Network devices Browsers
  • Low 1.9
    CVE-2024-53855

    User can view tickets from organizations they're not apart of in centurion_erp

    Centurion ERP (Enterprise Rescource Planning) is a simple application developed to provide open source IT management with a large emphasis on the IT Service Management (ITSM) modules. A user who is authenticated and has view permissions for a ticket, can view…

    nofusscomputing centurion_erp
  • Medium 5.5
    CVE-2024-35425

    vmir e8117 was discovered to contain a segmentation violation via the function_prepare_parse function at /src/vmir_func…

  • Medium 4.1
    CVE-2024-49373

    Centurion ERP user can view projects from organizations they're not apart of

    No Fuss Computing Centurion ERP is open source enterprise resource planning (ERP) software. Prior to version 1.2.1, an authenticated user can view projects within organizations they are not apart of. Version 1.2.1 fixes the problem.

    nofusscomputing centurion_erp
  • Medium 5.1
    CVE-2024-8118 Public exploit

    Grafana alerting wrong permission on datasource rule write endpoint

    In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.

    Grafana Grafana grafana grafana Web / CMS Ubuntu Alpine
  • Medium 4.9
    CVE-2024-43803

    BMO can expose particularly named secrets from other namespaces via BMH CRD

    The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. The `BareMetalHost` (BMH) CRD allows the `userData`, `metaData`, and `networkData` for the provisioned host to be specified as links to Kubernetes Secrets. Ther…

    metal3-io baremetal-operator github.com/metal3-io/baremetal-operator Go
  • Medium 5.3
    CVE-2024-20285

    Cisco NX-OS Software Python Parser Escape Vulnerability

    A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and gain unauthorized access to the underlying operating system of the device. The vulnerability is due…

    Cisco Cisco NX-OS Software Network devices
  • Medium 5.3
    CVE-2024-5801

    IP Forwarding enabled in B&R Automation Runtime

    Enabled IP Forwarding feature in B&R Automation Runtime versions before 6.0.2 may allow remote attack-ers to compromise network security by routing IP-based packets through the host, potentially by-passing firewall, router, or NAC filtering.

    B&R Industrial Automation Automation Runtime
  • Critical 9.8
    CVE-2024-33768

    lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source_over.

    lunasvg PyPI
  • Medium 6.5
    CVE-2024-30388

    Junos OS: QFX5000 Series and EX Series: Specific malformed LACP packets will cause flaps

    An Improper Isolation or Compartmentalization vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on QFX5000 Series and EX Series allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS). If a specific malfo…

    Juniper Networks Junos OS Network devices
  • High 8.2
    CVE-2024-23683

    Artemis Java Test Sandbox InvocationTargetException Subclass Escape

    Artemis Java Test Sandbox versions less than 1.7.6 are vulnerable to a sandbox escape when an attacker crafts a special subclass of InvocationTargetException. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly san…

    de.tum.in.ase:artemis-java-test-sandbox Maven
  • High 8.2
    CVE-2024-23682

    Artemis Java Test Sandbox Class Loading Escape

    Artemis Java Test Sandbox versions before 1.8.0 are vulnerable to a sandbox escape when an attacker includes class files in a package that Ares trusts. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed …

    de.tum.in.ase:artemis-java-test-sandbox Maven
  • Medium 6.0
    CVE-2023-1636

    Incomplete container isolation

    A vulnerability was found in OpenStack Barbican containers. This vulnerability is only applicable to deployments that utilize an all-in-one configuration. Barbican containers share the same CGROUP, USER, and NET namespace with the host system and other OpenSt…

    Red Hat RDO Red Hat OpenStack Platform 13 (Queens) Red Hat OpenStack Platform 16.2 PyPI
  • Medium 5.5
    CVE-2023-29580

    yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the component yasm_expr_create at /libyasm/…

    yasm yasm Debian Ubuntu
  • High 8.1
    CVE-2023-1305

    Rapid7 InsightCloudSec box object access

    An authenticated attacker can leverage an exposed “box” object to read and write arbitrary files from disk, provided those files can be parsed as yaml or JSON. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.…

    Rapid7 InsightCloudSec