HA
Product
Harbor
24
CVEs
0
On KEV
9.4
Max CVSS
0
New 30D
Severity mix
Critical 1High 10Medium 13Low 0
Watch
Add Harbor to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-4404 | 9.4 | Mar 23 | Use of hard coded credentials in GoHarbor Harbor Affected: through 2.15.0 |
| CVE-2019-19025 | 8.8 | Mar 20 | Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the VMware Harbor Container Registry for the Pivotal Platform Affected: 1.7.0 before 1.8.6; 1.9.0 before 1.9.3 |
| CVE-2019-19023 | 8.8 | Mar 20 | Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege Escalation Vulnerability in the VMware Harbor Container Registry for the Pivotal Platform Affected: 1.7.0 before 1.8.6; 1.9.0 before 1.9.3 |
| CVE-2017-17697 | 8.6 | Dec 15 | The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping Affected: before 1.3.0; 1.3.0; 1.3.0; 1.3.0; 1.3.0; 1.3.0 |
| CVE-2022-31670 | 7.7 | Nov 14 | Harbor fails to validate the user permissions when updating tag retention policies. By sending a request to update a tag retention policy with an id that belongs to a… Affected: 1.0.0 before 1.10.13; 2.0.0 before 2.4.3; 2.5.0 before 2.5.2 |
| CVE-2022-31669 | 7.7 | Nov 14 | Harbor fails to validate the user permissions when updating tag immutability policies. By sending a request to update a tag immutability policy with an id that belongs to a… Affected: 2.0.0 before 2.4.3; 2.5.0 before 2.5.2 |
| CVE-2022-31668 | 7.7 | Nov 14 | Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the… Affected: 2.0.0 before 2.4.3; 2.5.0 before 2.5.2 |
| CVE-2022-46463 | 7.5 | Jan 13 | An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories without authentication Affected: 1.1.0 through 2.5.3 |
| CVE-2019-16919 | 7.5 | Oct 18 | Harbor API has a Broken Access Control vulnerability Affected: 1.8.0 through 1.8.3; 1.9.0 |
| CVE-2022-31671 | 7.4 | Nov 14 | Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs Affected: 2.0.0 before 2.4.3; 2.5.0 before 2.5.2 |
| CVE-2019-19029 | 7.2 | Mar 20 | Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal Platform Affected: 1.7.0 before 1.8.6; 1.9.0 before 1.9.3 |
| CVE-2023-20902 | 6.5 | Nov 9 | A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create… Affected: before 1.10.17; 2.6.0 through 2.6.4; 2.7.0 before 2.7.3; 2.8.0 before 2.8.3 |
| CVE-2019-16097 | 6.5 | Sep 8 | core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend… Affected: 1.7.0; 1.7.0; 1.7.0; 1.7.1; 1.7.2; 1.7.3; +10 more |
| CVE-2022-31667 | 6.4 | Nov 14 | Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. By sending a request… Affected: 2.0.0 before 2.4.3; 2.5.0 before 2.5.2 |
| CVE-2024-22244 | 6.1 | Jun 10 | Open Redirect in Harbor <=v2.8.4, <=v2.9.2, and <=v2.10.0 may redirect a user to a malicious site Affected: 2.8.0 before 2.8.5; 2.9.0 before 2.9.3; 2.10.0 |
| CVE-2024-22261 | 5.5 | Jun 11 | SQL-Injection in Harbor allows priviledge users to leak the task IDs Affected: 2.8.1 before 2.8.6; 2.9.0 before 2.9.4; 2.10.0 before 2.10.2 |
| CVE-2022-31666 | 5.4 | Nov 14 | Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook policies of other users. The attacker could… Affected: 2.0.0 before 2.4.3; 2.5.0 before 2.5.2 |
| CVE-2019-19030 | 5.3 | Dec 26 | Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether… Affected: before 1.10.3; 2.0.0 before 2.0.1 |
| CVE-2020-29662 | 5.3 | Feb 2 | In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path Affected: 2.0 before 2.0.5; 2.1.0 before 2.1.2 |
| CVE-2019-19026 | 4.9 | Mar 20 | Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivotal Platform Affected: 1.7.0 before 1.8.6; 1.9.0 before 1.9.3 |
| CVE-2024-22278 | 4.3 | Aug 2 | Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations Affected: before 2.9.5; 2.10.0 before 2.10.3 |
| CVE-2020-13794 | 4.3 | Sep 30 | Harbor 1.9.* 1.10.* and 2.0.* allows Exposure of Sensitive Information to an Unauthorized Actor Affected: 1.9.0 before 2.0.3 |
| CVE-2020-13788 | 4.3 | Jul 15 | Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's intranet Affected: before 2.0.1 |
| CVE-2019-3990 | 4.3 | Dec 3 | A User Enumeration flaw exists in Harbor Affected: 1.7.0 through 1.7.6; 1.8.0 through 1.8.5; 1.9.0; 1.9.0; 1.9.0; 1.9.1; +1 more |
Showing 24