34 matches found
Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection
SummaryCVE-2026-32608 "Command Injection via Process Names in Action Command Templates" was fixed commit 5680a5d by adding sanitizemustachedict, which replaces the shell operators &&, |, , with spaces in the values rendered into action command templates.The sanitizer only processes top-level stri...
Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection
Summary CVE-2026-32608 "Command Injection via Process Names in Action Command Templates" was fixed commit 5680a5d by adding sanitizemustachedict, which replaces the shell operators &&, |, , with spaces in the values rendered into action command templates. The sanitizer only processes top-level...
EUVD-2026-60303
Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...
CVE-2026-62982 Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection
Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...
CVE-2026-62982 Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection
Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...
CVE-2026-32608
A flaw was found in glances. The Glances action system allows administrators to configure shell commands that execute when monitoring thresholds are exceeded. These commands support Mustache template variables e.g., 'name', 'key' that are populated with runtime monitoring data. The 'securepopen'...
DEBIAN-CVE-2026-32608
Glances is an open-source system cross-platform monitoring tool. The Glances action system allows administrators to configure shell commands that execute when monitoring thresholds are exceeded. These commands support Mustache template variables e.g., name, key that are populated with runtime...
CVE-2026-32608
Glances is an open-source system cross-platform monitoring tool. The Glances action system allows administrators to configure shell commands that execute when monitoring thresholds are exceeded. These commands support Mustache template variables e.g., name, key that are populated with runtime...
croparray (0.1.1) potentially affected by CVE-2026-32608 via glances (3.2.7)
glances PYPI version 3.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on glances and may be impacted: - croparray 0.1.1 Source cves: CVE-2026-32608 Source advisory: MEND:CVE-2026-32608...
croparray (0.1.1) potentially affected by CVE-2026-32608 via glances (3.2.7)
glances PYPI version 3.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on glances and may be impacted: - croparray 0.1.1 Source cves: CVE-2026-32608 Source advisory: OSV:GHSA-VCV2-Q258-WRG7...
CVE-2026-32608
creationtimestamp| type| source ---|---|--- 2026-03-14 14:52:54+00:00| published-proof-of-concept| https://github.com/nicolargo/glances/security/advisories/GHSA-vcv2-q258-wrg7 2026-03-18 09:46:58+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mhd7en3acd2n 2026-03-18...
CVE-2021-32608
An issue was discovered in Smartstore aka SmartStoreNET through 4.1.1. Views/Boards/Partials/ForumPost.cshtml does not call HtmlUtils.SanitizeHtml on certain text for a forum post...
CVE-2025-32608
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Movylo Movylo Marketing Automation movylo-widget allows Reflected XSS.This issue affects Movylo Marketing Automation: from n/a through = 2.0.7...
CVE-2025-32608 WordPress Movylo Marketing Automation Plugin <= 2.0.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Movylo Movylo Marketing Automation movylo-widget allows Reflected XSS.This issue affects Movylo Marketing Automation: from n/a through = 2.0.7...
CVE-2025-32608 WordPress Movylo Marketing Automation Plugin <= 2.0.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Movylo Movylo Marketing Automation allows Reflected XSS. This issue affects Movylo Marketing Automation: from n/a through 2.0.7...
CVE-2025-32608
CVE-2025-32608 describes a reflected Cross-Site Scripting (XSS) in Movylo Marketing Automation up to version 2.0.7, caused by improper neutralization of input during web page generation. Public records (NVD, Red Hat, CVE List, PatchStack) confirm the affected product and version range, and that e...
Linux Distros Unpatched Vulnerability : CVE-2024-32608
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HDF5 library through 1.14.3 has memory corruption in H5Aclose resulting in the corruption of the instruction pointer and causing denial of service or potential...
CVE-2024-32608
creationtimestamp| type| source ---|---|--- 2024-10-09 08:07:10+00:00| seen| https://t.me/cvedetector/7425...
