CWE-653.

High Privilege RCE via LUA Sandbox Escape

• MB connect line mbNET HW1
• MB connect line mbNET/mbNET.rokey
• CWE-653

Restricted shell evasion in Radiflow iSAP Smart Collector

• Radiflow iSAP Smart Collector
• CWE-653

Eclipse Foundation Eclipse Open VSX Registry: A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have…

• Eclipse Foundation Eclipse Open VSX Registry
• CWE-653
• CWE-913

Sony XAV-AX8500 Bluetooth Improper Isolation Authentication Bypass Vulnerability

• Sony XAV-AX8500
• CWE-653

Fortinet FortiClientMac: An improper isolation or compartmentalization vulnerability [CWE-653] in FortiClientMac…

• Fortinet FortiClientMac
• Fortinet FortiVoiceUCDesktop
• CWE-653

Process isolation bypass using "javascript:" URI links in cross-origin frames

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-653

User in anonymous role could create and delete views

• M-Files Corporation M-Files Server
• CWE-653

ingress-nginx admission controller RCE escalation

• CWE-653

<1.11.5 || >=1.12.0-beta.0, <1.12.1 · fixed in 1.11.5, 1.12.1

Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD in github.com/metal3-io/baremetal-operator/apis

• Information disclosure
• CWE-653

<0.8.1 || >=0.9.0, <0.9.1 · fixed in 0.8.1, 0.9.1

SolarWinds Service Desk Broken Access Control Vulnerability

• SolarWinds Service Desk
• CWE-653

Junos OS: An local attacker with shell access can execute arbitrary code

• Juniper Networks Junos OS
• CWE-653

Azure PromptFlow remote code execution related to Jinja templates

• CWE-653

<1.17.2 · fixed in 1.17.2

lunasvg v3.0.1 was discovered to contain a segmentation violation via the component gray_find_cell

• CWE-653

<=3.0.1 · no fixed version yet

NVIDIA Container Toolkit: NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially…

• NVIDIA Container Toolkit
• NVIDIA GPU Operator
• CWE-653

NVIDIA Container Toolkit: NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially…

• NVIDIA Container Toolkit
• NVIDIA GPU Operator
• CWE-653

NVIDIA Container Toolkit: NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially…

• NVIDIA Container Toolkit
• NVIDIA GPU Operator
• CWE-653

lunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition_source_over.

• CWE-653

<=3.0.0 · no fixed version yet

lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_path_add_path.

• CWE-653

<=3.0.0 · no fixed version yet

lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_blend.

• CWE-653

<=3.0.0 · no fixed version yet

A user with advanced report application access rights can perform actions for which they are not authorized

• Arista Networks Arista Edge Threat Management
• CWE-653

The Bare Metal Operator (BMO) can expose particularly named secrets from other namespaces via BMH CRD in github.com/metal3-io/baremetal-operator

• Information disclosure
• CWE-653

<0.5.2 || >=0.6.0, <0.6.2 || >=0.7.0-rc.0, <0.8.0 · fixed in 0.5.2, 0.6.2, 0.8.0

User can view tickets from organizations they're not apart of in centurion_erp

• nofusscomputing centurion_erp
• CWE-653

vmir e8117 was discovered to contain a segmentation violation via the function_prepare_parse function at /src/vmir_function.c.

• CWE-653

Centurion ERP user can view projects from organizations they're not apart of

• nofusscomputing centurion_erp
• CWE-653

Grafana alerting wrong permission on datasource rule write endpoint

• Grafana
• CWE-653

Cisco NX-OS Software Python Parser Escape Vulnerability

• Cisco NX-OS Software
• CWE-653

IP Forwarding enabled in B&R Automation Runtime

• B&R Industrial Automation Automation Runtime
• CWE-653
• CWE-1188

lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source_over.

• CWE-653

<=2.3.9 · no fixed version yet

Junos OS: QFX5000 Series and EX Series: Specific malformed LACP packets will cause flaps

• Juniper Networks Junos OS
• CWE-653

OpenStack Barbican information disclosure vulnerability

• CWE-653

<=16.0.0 · no fixed version yet

yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the component yasm_expr_create at /libyasm/expr.c.

• CWE-653

Rapid7 InsightCloudSec box object access

• Rapid7 InsightCloudSec
• CWE-653

Class Loading Vulnerability in Artemis

• CWE-501
• CWE-653

<1.8.0 · fixed in 1.8.0

Trust Boundary Violation due to Incomplete Blacklist in Test Failure Processing in Ares

• CWE-653

<1.7.6 · fixed in 1.7.6