3 Commits

Author	SHA1	Message	Date
nicolargo	890858944a	REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard	2026-07-04 17:26:38 +02:00
nicolargo	0de3b8f875	XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard - CVE-2026-46608	2026-05-23 11:40:20 +02:00
nicolargo	b88dd7bcfd	test(xmlrpc): failing test — spoofed Host should be rejected (CVE-2026-46611) ... Adds a second test server bound to a config that enables xmlrpc_allowed_hosts, plus the failing assertion that a spoofed Host header returns 400. The fix in glances/server.py follows in the next commit. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-23 09:50:40 +02:00