30 matches found
CVE-2026-18255
A flaw was found in Quay. A user configured in GLOBALREADONLYSUPERUSERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account...
CVE-2026-18255 Quay: quay: global read-only superuser can view robot account tokens
A flaw was found in Quay. A user configured in GLOBALREADONLYSUPERUSERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account...
CVE-2026-18255 Quay: quay: global read-only superuser can view robot account tokens
A flaw was found in Quay. A user configured in GLOBALREADONLYSUPERUSERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account...
CVE-2026-18255: Incorrect Authorization
A flaw was found in Quay. A user configured in GLOBALREADONLYSUPERUSERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account...
PT-2026-65842
Name of the Vulnerable Software and Affected Versions Quay affected versions not specified Description A flaw exists where a user configured in GLOBAL READONLY SUPER USERS can view robot account tokens for repositories they are not members of. This allows an attacker with read-only superuser...
CVE-2026-6848 Quay: red hat quay: authentication bypass allows privileged actions without valid credentials
A flaw was found in Red Hat Quay. When Red Hat Quay requests password re-verification for sensitive operations, such as token generation or robot account creation, the re-authentication prompt can be bypassed. This allows a user with a timed-out session, or an attacker with access to an idle...
CVE-2026-6848
A flaw was found in Red Hat Quay. When Red Hat Quay requests password re-verification for sensitive operations, such as token generation or robot account creation, the re-authentication prompt can be bypassed. This allows a user with a timed-out session, or an attacker with access to an idle...
CVE-2026-6848 Quay: red hat quay: authentication bypass allows privileged actions without valid credentials
A flaw was found in Red Hat Quay. When Red Hat Quay requests password re-verification for sensitive operations, such as token generation or robot account creation, the re-authentication prompt can be bypassed. This allows a user with a timed-out session, or an attacker with access to an idle...
CVE-2026-6848: Insufficient Session Expiration
A flaw was found in Red Hat Quay. When Red Hat Quay requests password re-verification for sensitive operations, such as token generation or robot account creation, the re-authentication prompt can be bypassed. This allows a user with a timed-out session, or an attacker with access to an idle...
CVE-2019-16919
Harbor API has a Broken Access Control vulnerability. The vulnerability allows project administrators to use the Harbor API to create a robot account with unauthorized push and/or pull access permissions to a project they don't have access or control for. The Harbor API did not enforce the proper...
EUVD-2019-7413
Malware in sbrugna...
EUVD-2022-6985
Malicious code in bioql PyPI...
BIT-HARBOR-2022-31667 Harbor fails to validate the user permissions when updating a robot account
Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a...
CVE-2022-31667
Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a...
CVE-2022-31667 Harbor fails to validate the user permissions when updating a robot account
Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a...
CVE-2022-31667
Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a...
CVE-2022-31667 Harbor fails to validate the user permissions when updating a robot account
Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a...
CVE-2022-31667 Harbor fails to validate the user permissions when updating a robot account
Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a...
CVE-2022-31667: Improper Authorization
Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a...
Improper Authorization
github.com/goharbor/harbor is vulnerable to improper authorization. A remote authenticated attacker is able to revoke the permissions or impersonate a robot account due to improper validation of the user permissions when updating the robot account through the vulnerable updateV2Robot function...