glances vulnerabilities (PyPI)
26 vulnerabilities.
-
glancesPyPI Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925) 7.1 High -
glancesPyPI Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection 8.8 High -
glancesPyPI Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config 5.3 Medium -
glancesPyPI Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard 6.5 Medium -
glancesPyPI Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction 8.8 High -
glancesPyPI Glances: Arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration 7.8 High -
glancesPyPI Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack 5.3 Medium -
glancesPyPI Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533) 7.4 High -
glancesPyPI Glances: Insecure Pickle Deserialization in Version Cache Leads to Arbitrary Code Execution 7.8 High -
glancesPyPI Glances: Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py 7.8 High -
glancesPyPI Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values 6.3 Medium -
glancesPyPI Glances IP Plugin has SSRF via public_api that leads to credential leakage 7.3 High -
glancesPyPI Glances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS 7.7 High -
glancesPyPI Glances Vulnerable to Command Injection via Dynamic Configuration Values 7.8 High -
glancesPyPI Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard 7.1 High -
glancesPyPI Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers 8.1 High -
glancesPyPI Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist` 9.1 Critical -
glancesPyPI Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding 5.9 Medium -
glancesPyPI Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements 7.0 High -
glancesPyPI Glances's Default CORS Configuration Allows Cross-Origin Credential Theft 8.1 High -
glancesPyPI Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials 7.5 High -
glancesPyPI Glances has a Command Injection via Process Names in Action Command Templates 7.0 High -
glancesPyPI Glances exposes the REST API without authentication 8.7 High -
glancesPyPI Glances has SQL Injection via Process Names in TimescaleDB Export 7.3 High -
glancesPyPI Glances Exposes Unauthenticated Configuration Secrets 8.7 High -
glancesPyPI XML External Entity (XXE) Injection 6.3 Medium