PT-2021-11705 · Harbor · Harbor

Name of the Vulnerable Software and Affected Versions: Harbor versions 2.0 through 2.0.4 Harbor versions 2.1.x through 2.1.1 Description: The catalog's registry API is exposed on an unauthenticated path, allowing bypass of authorization. The vulnerable API endpoint is "GET /v2/ catalog/" which ca...

CVE-2020-29662: Cleartext Transmission of Sensitive Information

In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path...

Harbor Authorization Issues Vulnerability

Harbor is an open source trusted cloud native registry from the Cloud Native Computing Foundation. The product is primarily used to store, sign, and scan container images for vulnerabilities. An authorization issue vulnerability exists in Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2, which stem...

CVE-2020-13794

Harbor 1.9. 1.10. and 2.0. allows Exposure of Sensitive Information to an Unauthorized Actor...

CVE-2020-13794

Harbor 1.9. 1.10. and 2.0. allows Exposure of Sensitive Information to an Unauthorized Actor...

Design/Logic Flaw

Harbor 1.9. 1.10. and 2.0. allows Exposure of Sensitive Information to an Unauthorized Actor...

CVE-2020-13794

CVE-2020-13794 affects Harbor 1.9., 1.10. and 2.0.*, enabling exposure of sensitive information via user enumeration. Publicly cited detail shows an authenticated user can enumerate usernames via the /api/users/search endpoint (curl example and _ parameter usage), bypassing admin restrictions. Th...

CVE-2020-13794

Harbor 1.9. 1.10. and 2.0. allows Exposure of Sensitive Information to an Unauthorized Actor...

PT-2020-13680 · Vmware · Harbor

Name of the Vulnerable Software and Affected Versions: Harbor versions 1.9. through 2.0. Description: The issue allows exposure of sensitive information to an unauthorized actor. Authenticated users can exploit an enumeration vulnerability in Harbor. The vulnerability is present in the "/users" A...

CVE-2020-13794: Missing Authorization

Harbor 1.9. 1.10. and 2.0. allows Exposure of Sensitive Information to an Unauthorized Actor...

Black Hat 2020: In a Turnaround, Voting Machine Vendor Embraces Ethical Hackers

Voting machine-maker Election Systems & Software ES&S has formally announced a vulnerability disclosure policy, Wednesday, during a Black Hat USA 2020 session. The move, which comes with the U.S. presidential elections looming in November, shows that voting-machine vendors are beginning to take t...

Server-Side Request Forgery (SSRF)

github.com/goharbor/harbor is vulnerable to server-side request forgery SSRF. The vulnerability exists due to a legacy endpoint to test webhook, allowing an attacker with permissions to edit projects to perform a port scan of hosts within the internal network...

CVE-2020-13788

Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's intranet...

CVE-2020-13788

Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's intranet...

Design/Logic Flaw

Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's intranet...

CVE-2020-13788

Harbor (goHarbor) prior to 2.0.1 is affected by a limited SSRF vulnerability (CVE-2020-13788). If a user with project-edit permissions can access the API endpoint used to test a project webhook, they can scan TCP ports on hosts inside Harbor’s intranet. The root cause is a vulnerable “Test Endpoi...

CVE-2020-13788

Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's intranet...

CVE-2020-13788: Server-Side Request Forgery (SSRF)

Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's intranet...

PT-2020-13677 · Vmware · Harbor

Name of the Vulnerable Software and Affected Versions: Harbor versions prior to 2.0.1 Description: The issue allows for a limited Server-Side Request Forgery SSRF attack. An attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's intranet...

Bug Bounty Programs Are Being Used to Buy Silence

Investigative report on how commercial bug-bounty programs like HackerOne, Bugcrowd, and SynAck are being used to silence researchers: Used properly, bug bounty platforms connect security researchers with organizations wanting extra scrutiny. In exchange for reporting a security flaw, the...