CVE-2022-31546

Affected software: nlpweb/glance repository (GitHub) up to 2014-06-27. Vulnerability: absolute path traversal due to unsafe usage of Flask send_file. Impact: potential exposure of sensitive server files; practical consequences stated as absolute path traversal. Evidence: CVE-2022-31546 entries fr...

CVE-2018-3715

The CVE-2018-3715 entry is supported by multiple connected records showing a Path Traversal vulnerability in the npm package glance. Affected versions are before 3.0.9 (Red Hat/OSV notes) with related advisories indicating the root cause is lack of validation of the requested path, allowing a mal...

CVE-2022-25937

CVE-2022-25937 affects the npm package “glance.” Versions before 3.0.9 are vulnerable to a directory traversal flaw that allows reading files outside the public root directory. The issue is a root-cause in path handling and is related to but distinct from CVE-2018-3715. The commonly cited fix is ...

CVE-2018-3748

The CVE concerns the Node.js module glance with a stored XSS vulnerability due to unsanitized file names served by its static directory. Connected sources show affected versions include glance