CWE-653: Improper Isolation or Compartmentalization, page 2
Filter
The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
What the weakness is: CWE-653 at MITRE
Ask an AI about CWE-653
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-653: Improper Isolation or Compartmentalization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/653.html and https://cve.bz/cve/cwe/653?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.8CVE-2026-25905EPSS 0.2%
The Python code being run by 'runPython' or 'runPythonAsync' is not isolated from the rest of the JS code, allowing any Python code to use the Pyodide APIs to modify the JS environment. This may result in an attacker hijacking the MCP serv…
- 7.5CVE-2025-53710EPSS 0.3%
Due to a product misconfiguration in certain deployment types, it was possible from different pods in the same namespace to communicate with each other. This issue resulted in bypass of access control due to the presence of a vulnerable en…
- 5.3CVE-2025-46215EPSS 0.3%
An Improper Isolation or Compartmentalization vulnerability [CWE-653] in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an unauthenticated…
- 2.1CVE-2025-41116EPSS 0.3%
When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user id…
- 2.1CVE-2025-3717EPSS 0.3%
When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user ide…
- 5.9CVE-2025-12695EPSS 0.3%
The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input and uses the “PythonInterpreter” class.
- 7.2CVE-2025-57738EPSS 23%
Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, wi…
- 8.5CVE-2025-34201EPSS 0.3%
Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) run many Docker containers on shared internal networks without firewalling or segmentation between instances. A compromise of any single …
- 7.3CVE-2025-20109EPSS 0.1%
Improper Isolation or Compartmentalization in the stream cache mechanism for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.2CVE-2025-41688EPSS 0.8%
A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sandbox.
- 4.1CVE-2025-27027EPSS 0.3%
A user with vpuser credentials that opens an SSH connection to the device, gets a restricted shell rbash that allows only a small list of allowed commands. This vulnerability enables the user to get a full-featured Linux shell, bypassing t…
- 7.6CVE-2025-6705EPSS 0.3%
A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions. Specifically, the system’s build scripts were executed without proper isolation, potentially exposing a p…
- 8.8CVE-2025-5476EPSS 0.4%
Sony XAV-AX8500 Bluetooth Improper Isolation Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected Sony XAV-AX8500 devices. Authentication is not required to exploit …
- 7.8CVE-2024-35281EPSS 0.1%
An improper isolation or compartmentalization vulnerability [CWE-653] in FortiClientMac version 7.4.2 and below, version 7.2.8 and below, 7.0 all versions and FortiVoiceUCDesktop 3.0 all versions desktop application may allow an authentica…
- 9.1CVE-2025-4083EPSS 0.5%
A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox esc…
- 6.3CVE-2025-3086EPSS 0.4%
Improper isolation of users in M-Files Server version before 25.3.14549 allows anonymous user to affect other anonymous users views and possibly cause a denial of service
- 9.8CVE-2025-1974ExploitEPSS 99.4%
A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to …
- 6.5CVE-2025-29781EPSS 0.2%
The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. Baremetal Operator enables users to load Secret from arbitrary namespaces upon deployment of the namespace scoped Custom Resource `BMCEventS…
- 5.4CVE-2025-26393EPSS 0.3%
SolarWinds Service Desk is affected by a broken access control vulnerability. The issue allows authenticated users to escalate privileges, leading to unauthorized data manipulation.
- 6.7CVE-2025-21590KEVEPSS 1.7%
An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device. A local attacker with access to the shell is ab…
- 6.5CVE-2025-24986EPSS 0.5%
Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network.
- 6.5CVE-2024-55456EPSS 0.4%
lunasvg v3.0.1 was discovered to contain a segmentation violation via the component gray_find_cell
- 6.5CVE-2024-0137EPSS 0.3%
NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code running in the host’s network namespace. This vulnerability is present only when the NVIDIA Contai…
- 8.4CVE-2024-0136EPSS 0.7%
NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code obtaining read and write access to host devices. This vulnerability is present only when the NVIDI…
- 7.6CVE-2024-0135EPSS 1.1%
NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to modification of a host binary. A successful exploit of this vulnerability may lead to code execution, denial of s…
- 6.5CVE-2024-57723EPSS 0.4%
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition_source_over.
- 6.5CVE-2024-57721EPSS 0.4%
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_path_add_path.
- 6.5CVE-2024-57720EPSS 0.4%
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_blend.
- 7.6CVE-2024-47520EPSS 0.4%
A user with advanced report application access rights can perform actions for which they are not authorized
- 4.3CVE-2024-53855EPSS 0.4%
Centurion ERP (Enterprise Rescource Planning) is a simple application developed to provide open source IT management with a large emphasis on the IT Service Management (ITSM) modules. A user who is authenticated and has view permissions fo…
- 5.5CVE-2024-35425EPSS 0.2%
vmir e8117 was discovered to contain a segmentation violation via the function_prepare_parse function at /src/vmir_function.c.
- 4.3CVE-2024-49373EPSS 0.4%
No Fuss Computing Centurion ERP is open source enterprise resource planning (ERP) software. Prior to version 1.2.1, an authenticated user can view projects within organizations they are not apart of. Version 1.2.1 fixes the problem.
- 5.1CVE-2024-8118EPSS 0.6%
In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.
- 4.9CVE-2024-43803EPSS 0.6%
The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. The `BareMetalHost` (BMH) CRD allows the `userData`, `metaData`, and `networkData` for the provisioned host to be specified as links to Kube…
- 8.8CVE-2024-20285EPSS 0.2%
A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and gain unauthorized access to the underlying operating system of the device. T…
- 5.3CVE-2024-5801EPSS 0.3%
Enabled IP Forwarding feature in B&R Automation Runtime versions before 6.0.2 may allow remote attack-ers to compromise network security by routing IP-based packets through the host, potentially by-passing firewall, router, or NAC filterin…
- 9.8CVE-2024-33768EPSS 0.8%
lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source_over.
- 7.1CVE-2024-30388EPSS 0.3%
An Improper Isolation or Compartmentalization vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on QFX5000 Series and EX Series allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS).…
- 8.2CVE-2024-23683EPSS 0.4%
Artemis Java Test Sandbox versions less than 1.7.6 are vulnerable to a sandbox escape when an attacker crafts a special subclass of InvocationTargetException. An attacker can abuse this issue to execute arbitrary Java when a victim execute…
- 8.2CVE-2024-23682EPSS 0.4%
Artemis Java Test Sandbox versions before 1.8.0 are vulnerable to a sandbox escape when an attacker includes class files in a package that Ares trusts. An attacker can abuse this issue to execute arbitrary Java when a victim executes the s…
- 5.0CVE-2023-1636EPSS 0.5%
A vulnerability was found in OpenStack Barbican containers. This vulnerability is only applicable to deployments that utilize an all-in-one configuration. Barbican containers share the same CGROUP, USER, and NET namespace with the host sys…
- 5.5CVE-2023-29580EPSS 0.3%
yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the component yasm_expr_create at /libyasm/expr.c.
- 8.1CVE-2023-1305EPSS 0.8%
An authenticated attacker can leverage an exposed “box” object to read and write arbitrary files from disk, provided those files can be parsed as yaml or JSON. This issue was resolved in the Managed and SaaS deployments on February 1, 2023…