HA
Product
Harbor
24
CVEs
0
On KEV
9.4
Max CVSS
0
New 30D
Severity mix
Critical 1High 10Medium 13Low 0
Watch
Add Harbor to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-20902 | 6.5 | Nov 9 | A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create… Affected: before 1.10.17; 2.6.0 through 2.6.4; 2.7.0 before 2.7.3; 2.8.0 before 2.8.3 |
| CVE-2019-16097 | 6.5 | Sep 8 | core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend… Affected: 1.7.0; 1.7.0; 1.7.0; 1.7.1; 1.7.2; 1.7.3; +10 more |
| CVE-2022-31667 | 6.4 | Nov 14 | Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. By sending a request… Affected: 2.0.0 before 2.4.3; 2.5.0 before 2.5.2 |
| CVE-2024-22244 | 6.1 | Jun 10 | Open Redirect in Harbor <=v2.8.4, <=v2.9.2, and <=v2.10.0 may redirect a user to a malicious site Affected: 2.8.0 before 2.8.5; 2.9.0 before 2.9.3; 2.10.0 |
| CVE-2024-22261 | 5.5 | Jun 11 | SQL-Injection in Harbor allows priviledge users to leak the task IDs Affected: 2.8.1 before 2.8.6; 2.9.0 before 2.9.4; 2.10.0 before 2.10.2 |
| CVE-2022-31666 | 5.4 | Nov 14 | Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook policies of other users. The attacker could… Affected: 2.0.0 before 2.4.3; 2.5.0 before 2.5.2 |
| CVE-2019-19030 | 5.3 | Dec 26 | Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether… Affected: before 1.10.3; 2.0.0 before 2.0.1 |
| CVE-2020-29662 | 5.3 | Feb 2 | In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path Affected: 2.0 before 2.0.5; 2.1.0 before 2.1.2 |
| CVE-2019-19026 | 4.9 | Mar 20 | Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivotal Platform Affected: 1.7.0 before 1.8.6; 1.9.0 before 1.9.3 |
| CVE-2024-22278 | 4.3 | Aug 2 | Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations Affected: before 2.9.5; 2.10.0 before 2.10.3 |
| CVE-2020-13794 | 4.3 | Sep 30 | Harbor 1.9.* 1.10.* and 2.0.* allows Exposure of Sensitive Information to an Unauthorized Actor Affected: 1.9.0 before 2.0.3 |
| CVE-2020-13788 | 4.3 | Jul 15 | Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's intranet Affected: before 2.0.1 |
| CVE-2019-3990 | 4.3 | Dec 3 | A User Enumeration flaw exists in Harbor Affected: 1.7.0 through 1.7.6; 1.8.0 through 1.8.5; 1.9.0; 1.9.0; 1.9.0; 1.9.1; +1 more |
Showing 13