Sectroyer

**Name of the Vulnerable Software and Affected Versions** Glances versions prior to 4.5.5 **Description** The XML-RPC server (implemented in `glances/server.py` and started with `glances -s`) fails to validate the HTTP Host header. This allows a DNS rebinding attack, where an attacker can bypass the same-origin policy to exfiltrate the complete system monitoring dataset through a victim's browser. DNS rebinding is a technique used to trick a browser into making requests to a local or private network resource by manipulating DNS records. **Recommendations** Update to version 4.5.5.

**Name of the Vulnerable Software and Affected Versions** Glances versions prior to 4.5.5 **Description** The KVM/QEMU monitoring engine in the `glances/plugins/vms/engines/virsh.py` file fails to sanitize VM domain names retrieved from the `virsh list --all` output. These names are passed into f-string command templates processed by the `secure popen()` function. Because `secure popen()` is designed to interpret `&&`, `|`, and `>` as shell operators, a user with permissions to create or rename a KVM/QEMU virtual machine can inject these operators into the domain name to execute arbitrary commands. This execution occurs with the privileges of the OS user running Glances, which is frequently root on hypervisor hosts. **Recommendations** Update to version 4.5.5. As a temporary mitigation, restrict permissions to create or rename KVM/QEMU virtual machines to trusted users only. Run Glances under a dedicated low-privilege service account instead of root to limit the impact of potential exploitation.

**Name of the Vulnerable Software and Affected Versions** Glances versions prior to 4.5.5 **Description** Insecure deserialization occurs in `glances/outdated.py` because the ` load cache()` function uses `pickle.load()` to read a version-check cache file. This file is stored at predictable, world-accessible paths such as `~/.cache/glances/glances-version.db` or `$XDG CACHE HOME/glances/glances-version.db`. Since no integrity check, signature verification, or format validation is performed before deserialization, an attacker with write access to these paths can plant a malicious pickle file. This allows for arbitrary code execution as the OS user running Glances when the application starts with version checking enabled, which is the default setting. This issue can be exploited in shared multi-user hosts, compromised containers sharing volumes, or via symlink race conditions. **Recommendations** Update Glances to version 4.5.5. As a temporary mitigation, disable the version check feature by setting `check update = false` in the configuration. Restrict the permissions of the Glances cache directory to 0700 to prevent unauthorized write access.

**Name of the Vulnerable Software and Affected Versions** Glances versions prior to 4.5.5 **Description** The XML-RPC server (`glances -s`) contains a misconfiguration in its Cross-Origin Resource Sharing (CORS) implementation. When the `cors origins` variable is configured with more than one entry, the system silently reverts to using a wildcard (`Access-Control-Allow-Origin: *`), effectively bypassing intended access restrictions. This allows a malicious web page from any origin to send a CORS simple request to the `/RPC2` endpoint and read the full system monitoring dataset, including the hostname, OS version, full process list (which may contain sensitive tokens or passwords), and network statistics. **Recommendations** Update to version 4.5.5. As a temporary mitigation, restrict the `cors origins` configuration to a single origin or avoid using the XML-RPC server in favor of the REST API (`glances -w`).

Name of the Vulnerable Software and Affected Versions: AdmirorFrames versions prior to 5.0 Description: The issue allows an unauthorized attacker to retrieve the location of the web root folder due to a Full Path Disclosure vulnerability in the afHelper.php script of the AdmirorFrames Joomla! extension. Recommendations: For versions prior to 5.0, update to version 5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the afHelper.php script until a patch is available.

Name of the Vulnerable Software and Affected Versions: AdmirorFrames versions prior to 5.0 Description: The issue is related to a Server Side Request Forgery (SSRF) vulnerability in the AdmirorFrames Joomla! extension, specifically in the afGdStream.php script. This vulnerability allows access to local files or server pages that are only available from localhost. Recommendations: For versions prior to 5.0, update to version 5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the afGdStream.php script until a patch is available.

Name of the Vulnerable Software and Affected Versions: AdmirorFrames versions prior to 5.0 Description: The issue affects the AdmirorFrames Joomla! extension, specifically the afGdStream.php script, which fails to specify a content type, resulting in the default text/html type being used. This allows an attacker to embed HTML tags directly in image data, which can be rendered by a webpage as HTML. Recommendations: For versions prior to 5.0, update to version 5.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the afGdStream.php script until a patch is available.

**Name of the Vulnerable Software and Affected Versions** elFinder versions prior to 2.1.62 **Description** The issue allows path traversal in the PHP LocalVolumeDriver connector due to incomplete validity checking of supplied request parameters. This can be exploited by allowing untrusted users to write to the local file system. **Recommendations** For versions prior to 2.1.62, update to elFinder version 2.1.62 as soon as possible to fix the issue. If you cannot update for some reason, consider stopping the use of the vulnerable connector or prohibit writing to untrusted users.