CVE-2019-19025: Cross-Site Request Forgery (CSRF)

Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the VMware Harbor Container Registry for the Pivotal Platform...

PT-2020-10035 · Cloud Native Computing Foundation +1 · Harbor +1

Name of the Vulnerable Software and Affected Versions: Cloud Native Computing Foundation Harbor versions prior to 1.8.6 and 1.9.3 Description: The issue is related to a Privilege Escalation Vulnerability in the VMware Harbor Container Registry for the Pivotal Platform. This vulnerability affects...

Harbor Container Registry Privilege Escalation (CVE-2019-16097)

A Privilege Escalation vulnerability exists in Harbor Container Registry. Successful exploitation of this vulnerability would allow a remote attacker to gain unauthorized access to the affected system...

CVE-2019-12825

Unauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise 12.0.0-pre. In other words, authenticated remote attackers can read Docker registries of other groups. When a legitimate user changes the path of a group, Docker registries are not adapted, leaving...

CVE-2019-12825

Unauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise 12.0.0-pre. In other words, authenticated remote attackers can read Docker registries of other groups. When a legitimate user changes the path of a group, Docker registries are not adapted, leaving...

Path traversal

Unauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise 12.0.0-pre. In other words, authenticated remote attackers can read Docker registries of other groups. When a legitimate user changes the path of a group, Docker registries are not adapted, leaving...

CVE-2019-12825

Removed by vendor...

CVE-2019-12825

CVE-2019-12825 affects GitLab Enterprise 12.0.0-pre: authenticated remote attackers can read Docker registries of other groups due to a namespace not adapting when a group path changes, leaving registries unprotected and accessible. This describes an unauthorized access vulnerability in the conta...

CVE-2019-10214

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launc...

com.byclosure.jenkins.plugins:gcloud-sdk (0.0.1), org.jenkins-ci.plugins:google-container-registry-auth (>=0.1, <=0.3) +4 more potentially affected by CVE-2019-10436 via org.jenkins-ci.plugins:google-oauth-plugin (>=0.1, <=0.5)

org.jenkins-ci.plugins:google-oauth-plugin MAVEN version =0.1, =0.1, =1.0, =0.1, =0.1, =1.2 Source cves: CVE-2019-10436 Source advisory: MEND:CVE-2019-10436...

VMware Releases Security Update for Harbor Container Registry for PCF

VMware has released a security update to address a vulnerability affecting Harbor Container Registry for Pivotal Cloud Foundry PCF. An attacker could exploit this vulnerability to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and...

VMSA-2019-0016:VMware Cloud Foundation and VMware Harbor Container Registry for PCF address broken access control vulnerability

VMware Security Advisories Advisory ID| VMSA-2019-0016 ---|--- Advisory Severity| Critical CVSSv3 Range| 9.1 Synopsis| VMware Cloud Foundation and VMware Harbor Container Registry for PCF address broken access control vulnerability CVE-2019-16919 Issue Date| 2019-10-15 Updated On| 2019-12-11 CVEs...

VMware Releases Security Updates

VMware has released security updates to address vulnerabilities in Cloud Foundation and Harbor Container Registry for Pivotal Cloud Foundry. An attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA...

VMSA-2019-0015:VMware Cloud Foundation and VMware Harbor Container Registry for PCF address remote escalation of privilege vulnerability

VMware Security Advisories Advisory ID| VMSA-2019-0015 ---|--- Advisory Severity| Critical CVSSv3 Range| 9.8 Synopsis| VMware Cloud Foundation and VMware Harbor Container Registry for PCF address remote escalation of privilege vulnerability CVE-2019-16097 Issue Date| 2019-09-24 Updated On|...

Security Bulletin: Vulnerability Advisor for IBM Cloud Container Registry might fail to detect some package vulnerabilities in Red Hat images

Summary Vulnerability Advisor for IBM Cloud Container Registry might have failed to detect some package vulnerabilities in Red Hat image reports produced before 2019-05-17. Vulnerability Details Vulnerability Advisor for IBM Cloud Container Registry did not detect all known package vulnerabilitie...

CVE-2019-3841

Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into PVCs from container registries. This could enable man-in-the-middle attacks between a container registry and the virt-cdi-component, leading to possible...

CVE-2019-3841: Improper Certificate Validation

Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into PVCs from container registries. This could enable man-in-the-middle attacks between a container registry and the virt-cdi-component, leading to possible...

PT-2019-1727

Name of the Vulnerable Software and Affected Versions Kubevirt/virt-cdi-importer versions 1.4.0 through 1.5.3 Description The issue is related to incorrect authentication of a certificate in the data import service of Kubevirt, which could allow a remote attacker to perform a man-in-the-middle...

openSUSE Security Update : singularity (openSUSE-2018-1223)

Singularity was updated to version 2.6.0, bringing features, bugfixes and security fixes. Security issues fixed : - CVE-2018-12021: Fixed access control on systems supporting overlay file system boo1100333. Highlights of 2.6.0 : - Allow admin to specify a non-standard location for mksquashfs bina...

Clair - Vulnerability Static Analysis for Containers

Clair is an open source project for the static analysis of vulnerabilities in appc and docker containers. Vulnerability data is continuously imported from a known set of sources and correlated with the indexed contents of container images in order to produce lists of vulnerabilities that threaten...