Harbor

harbor

CVEs (23)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-16919 2Linuxfoundation Vmware 3Cloud Foundation HarborHarbor Container Registry Jun 17, 2026 Oct 18, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Harbor API has a Broken Access Control vulnerability. The vulnerability allows project administrators to use the Harbor API to create a robot account with unauthorized push and/or pull access permissions to a project the...Show more Harbor API has a Broken Access Control vulnerability. The vulnerability allows project administrators to use the Harbor API to create a robot account with unauthorized push and/or pull access permissions to a project they don't have access or control for. The Harbor API did not enforce the proper project permissions and project scope on the API request to create a new robot account.Show less
CVE-2019-16097 1Linuxfoundation 1Harbor Jun 17, 2026 Sep 8, 2019 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. F...Show more core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix: configure Harbor to use non-DB authentication backend such as LDAP.Show less
CVE-2017-17697 1Linuxfoundation 1Harbor May 13, 2026 Dec 15, 2017 N/A· v4 8.6 HIGH· v3 5.0 MEDIUM· v2 The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping.

Previous 12