Skip to content
OpenAdvisories

Package · npm

glance

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.5
    CVE-2022-25937

    Path traversal vulnerability in glance

    Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root directory. This is related to but distinct from the vulnerability reported in [CVE-2018-3715](https://security.snyk.io/vu…

    glance npm
  • Medium —
    GHSA-vw7g-jq9m-3q9v

    Unauthorized File Access in glance

    Versions of `glance` prior to 3.0.7 are vulnerable to Unauthorized File Access. The package provides a `--nodot` option meant to hide files and directories with names that begin with a `.`, such as `.git` but fails to hide files inside a folder that begins wi…

    glance npm
  • Medium 6.1
    CVE-2018-3748

    Cross-Site Scripting in glance

    There is a Stored XSS vulnerability in the glance node module versions <= 3.0.5. File name, which contains malicious HTML (eg. embedded iframe element or javascript: pseudo-protocol handler in <a> element) allows to execute JavaScript code against any user wh…

    glance npm
  • Medium 6.5
    CVE-2018-3715

    Path Traversal in glance

    glance node module before 3.0.4 suffers from a Path Traversal vulnerability due to lack of validation of path passed to it, which allows a malicious user to read content of any file with known path.

    HackerOne glance node module glance npm