Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the process that writes configuration payloads to the audit log, where sensitive fields such as ldapsearchpassword and oidcclientsecret are not redacted. An attacker can obtain...

GO-2025-3826 Possible ORM Leak Vulnerability in the Harbor in github.com/goharbor/harbor

Possible ORM Leak Vulnerability in the Harbor in github.com/goharbor/harbor. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

PT-2025-30606 · Harbor · Harbor

Name of the Vulnerable Software and Affected Versions: Harbor versions 2.11.2 and below Harbor versions 2.12.0-rc1 Harbor versions 2.13.0-rc1 Description: Harbor, an open source trusted cloud native registry project, is susceptible to a stored cross-site scripting XSS issue. The markdown field...

CVE-2024-22278

Incorrect user permission validation in Harbor v2.9.5 and Harbor v2.10.3 allows authenticated users to modify configurations...

CVE-2024-40464 vulnerabilities

Vulnerabilities for packages: harbor-fips, harbor...

CVE-2024-22244

Open Redirect in Harbor =v2.8.4, =v2.9.2, and =v2.10.0 may redirect a user to a malicious site...

CVE-2022-46463

An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories without authentication. NOTE: the vendor's position is that this "is clearly described in the documentation as a feature."...

PT-2023-14936

Name of the Vulnerable Software and Affected Versions Harbor versions 1.X.X through 2.5.3 Description An access control issue allows attackers to access public and private image repositories without authentication. The vendor states this behavior is documented as a feature. There is no informatio...

SQL Injection

github.com/goharbor/harbor is vulnerable to SQL injection. The vulnerability exists as it was possible for an authenticated administrator to send a SQL payload through the sort GET parameter in the project quotas section...

LDAP Injection

github.com/vmware/harbor is vulnerable to LDAP injection attacks. The vulnerability exists due to the lack of sanitization on the username parameter, which is subsequently used to create the ldapFilter...

CVE-2017-17697

The Ping function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping...