TI-2022-09479 CVE-2022-25937 · GHSA-3hjh-5hgx-f5wh
Path traversal in glance
Priority MEDIUM 62
Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root directory.
Glance Project
Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9
Exploited now
Glance Project records in CISA KEVNo Glance Project vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
4 records in Glance · all components
TI-2022-13471 CVE-2022-31546 · GHSA-29vr-p37f-25gc
The nlpweb/glance repository through 2014-06-27 on GitHub allows absolute path traversal…
Priority MEDIUM 43
The nlpweb/glance repository through 2014-06-27 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
TI-2018-02713 CVE-2018-3715 · GHSA-2x4q-6jfv-8h9h
Path traversal in HackerOne glance node module
Priority LOW 32
glance node module before 3.0.4 suffers from a Path Traversal vulnerability due to lack of validation of path passed to it, which allows a malicious user to read content of any file with known path.
TI-2018-02744 CVE-2018-3748 · GHSA-7375-vjr2-3g7w
There is a Stored XSS vulnerability in the glance node module versions <= 3.0.5.
Priority LOW 29
There is a Stored XSS vulnerability in the glance node module versions <= 3.0.5.