630 matches found
GHSA-F9VC-VF3R-PQQQ Harbor repository description page has Cross-site Scripting vulnerability
Impact In the Harbor repository information, it is possible to inject code resulting in a stored XSS issue. Patches Harbor v2.12.3 Harbor 2.11.3 Workarounds No References Credit [email protected]...
Harbor repository description page has Cross-site Scripting vulnerability
Impact In the Harbor repository information, it is possible to inject code resulting in a stored XSS issue. Patches Harbor v2.12.3 Harbor 2.11.3 Workarounds No References Credit [email protected]...
Harbor 跨站脚本漏洞
Harbor is an open source registry from Harbor Open Source. Protects artifacts with policies and role-based access control, ensures images are scanned and free of vulnerabilities, and signs images as trusted. A cross-site scripting vulnerability exists in Harbor versions 2.11.2 and earlier,...
PT-2025-30605 · Cncf · Cncf Harbor
Name of the Vulnerable Software and Affected Versions: CNCF Harbor versions 2.12.0 through 2.12.3 CNCF Harbor versions 2.13.0 through 2.13.0 Description: An ORM leak exists in the /api/v2.0/users endpoint, allowing administrators to potentially disclose users' password hash and salt values. The q...
PT-2025-30606 · Harbor · Harbor
Name of the Vulnerable Software and Affected Versions: Harbor versions 2.11.2 and below Harbor versions 2.12.0-rc1 Harbor versions 2.13.0-rc1 Description: Harbor, an open source trusted cloud native registry project, is susceptible to a stored cross-site scripting XSS issue. The markdown field...
TencentOS Server 4: harbor (TSSA-2024:0828)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0828 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
CVE-2024-22278
Incorrect user permission validation in Harbor...
CVE-2024-22261
SQL-Injection in Harbor allows priviledge users to leak the task IDs...
CVE-2024-22244
Open Redirect in Harbor =v2.8.4, =v2.9.2, and =v2.10.0 may redirect a user to a malicious site...
CVE-2024-8177
An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.4.5, starting from 17.5 prior to 17.5.3, starting from 17.6 prior to 17.6.1 which could cause Denial of Service via integrating a malicious harbor registry...
CVE-2024-8647
An issue was discovered in GitLab affecting all versions starting 15.2 to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2. On self hosted installs, it was possible to leak the anti-CSRF-token to an external site while the Harbor integration was enabled...
CVE-2024-51419
Cross Site Scripting vulnerability in Shenzhen Interconnection Harbor Network Technology Co., Ltd Ofweek Online Exhibition v.1.0.0 allows a remote attacker to execute arbitrary code...
CVE-2023-20902
A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create jobs/stop job tasks and retrieve job task information...
CVE-2022-46463
An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories without authentication. NOTE: the vendor's position is that this "is clearly described in the documentation as a feature."...
CVE-2020-13788
Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's intranet...
CVE-2020-29662
In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path...
CVE-2019-3990
A User Enumeration flaw exists in Harbor. The issue is present in the "/users" API endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained about registered users can be obtained via the "search" functionality...
CVE-2019-19030
Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal via the HTTP status code whether a resource exists...