742 matches found
CVE-2024-40465 vulnerabilities
Vulnerabilities for packages: harbor...
CVE-2024-40464 vulnerabilities
Vulnerabilities for packages: harbor, harbor-fips...
CVE-2024-40465 vulnerabilities
Vulnerabilities for packages: harbor, harbor-fips...
GHSA-HW28-333W-QXP3 Harbor fails to validate the user permissions when updating project configurations
Impact Harbor fails to validate the maintainer role permissions when creating/updating/deleting project configurations - API call: - PUT /projects/projectnameorid/metadatas/metaname - POST /projects/projectnameorid/metadatas/metaname - DELETE /projects/projectnameorid/metadatas/metaname By sendin...
Harbor fails to validate the user permissions when updating project configurations
Impact Harbor fails to validate the maintainer role permissions when creating/updating/deleting project configurations - API call: - PUT /projects/projectnameorid/metadatas/metaname - POST /projects/projectnameorid/metadatas/metaname - DELETE /projects/projectnameorid/metadatas/metaname By sendin...
PT-2024-19298
Name of the Vulnerable Software and Affected Versions Harbor versions prior to 2.9.5 Harbor versions prior to 2.10.3 Description The issue arises from incorrect user permission validation, allowing authenticated users with the maintainer role to modify configurations. This can be exploited throug...
GHSA-V23V-6JW2-98FQ vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-fips, slsa-verifier, tekton-chains, dagdotdev, cosign, ctop, dagger, kaniko-fips, wolfictl, helm-operator, cadvisor-fips, helm-push, buildkitd, ko, crossplane, k3d, cert-manager-cmctl-fips, kpt, cosign-fips, cadvisor, helm-fips, eksctl, k8sgpt...
GHSA-3669-72X9-R9P3 vulnerabilities
Vulnerabilities for packages: harbor-scanner-trivy, zot...
GHSA-3669-72X9-R9P3 vulnerabilities
Vulnerabilities for packages: zot, harbor-scanner-trivy-fips, harbor-scanner-trivy...
CVE-2024-37298 vulnerabilities
Vulnerabilities for packages: harbor-scanner-trivy, zot...
CVE-2024-37298 vulnerabilities
Vulnerabilities for packages: zot, harbor-scanner-trivy-fips, harbor-scanner-trivy...
GO-2024-2915 Open Redirect URL in Harbor in github.com/goharbor/harbor
Open Redirect URL in Harbor in github.com/goharbor/harbor...
GO-2024-2916 SQL Injection in Harbor scan log API in github.com/goharbor/harbor
SQL Injection in Harbor scan log API in github.com/goharbor/harbor...
CVE-2024-35255 vulnerabilities
Vulnerabilities for packages: argo-events, zarf, wal-g, grafana-agent-operator, goreleaser, trivy, terragrunt, guac, cosign, py3-cassandra-medusa, flux-image-reflector-controller, tekton-chains, hugo-extended, buildkitd, falcoctl, opentelemetry-collector, sigstore-scaffolding, k8sgpt, step, tkn,...
CVE-2024-22261
SQL-Injection in Harbor allows priviledge users to leak the task IDs...
CVE-2024-22261: Authorization Bypass Through User-Controlled SQL Primary Key
SQL-Injection in Harbor allows priviledge users to leak the task IDs...
CVE-2024-22261 SQL Injection in Harbor scan log API
SQL-Injection in Harbor allows priviledge users to leak the task IDs...
CVE-2024-22261
Harbor (scan log API) is affected by a SQL Injection vulnerability described across OSV-BIT-HARBOR-2024-22261 and NVD CVE-2024-22261. The issue arises in the Harbor scan log API where privileged users (administrator, project_admin, project_maintainer) can trigger arbitrary SQL execution to leak t...
