CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2019-19029
https://notcve.org/view.php?id=CVE-2019-19029
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal Platform. Cloud Native Computing Foundation Harbor versiones anteriores a 1.8.6 y 1.9.3, permite una inyección SQL por medio de grupos de usuarios en el VMware Harbor Container Registry para la Pivotal Platform. • https://github.com/goharbor/harbor/security/advisories https://github.com/goharbor/harbor/security/advisories/GHSA-qcfv-8v29-469w https://tanzu.vmware.com/security/cve-2019-19029 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.9EPSS: 0%CPEs: 3EXPL: 0CVE-2019-19026
https://notcve.org/view.php?id=CVE-2019-19026
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivotal Platform. Cloud Native Computing Foundation Harbor versiones anteriores a 1.8.6 y 1.9.3, permite una inyección SQL por medio de cuotas de proyecto en el VMware Harbor Container Registry para la Pivotal Platform. • https://github.com/goharbor/harbor/security/advisories https://github.com/goharbor/harbor/security/advisories/GHSA-rh89-vvrg-fg64 https://tanzu.vmware.com/security/cve-2019-19026 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-19025
https://notcve.org/view.php?id=CVE-2019-19025
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the VMware Harbor Container Registry for the Pivotal Platform. Cloud Native Computing Foundation Harbor versiones anteriores a 1.8.6 y 1.9.3, permite un ataque de tipo CSRF en el VMware Harbor Container Registry para la Pivotal Platform. • https://github.com/goharbor/harbor/security/advisories https://github.com/goharbor/harbor/security/advisories/GHSA-gcqm-v682-ccw6 https://tanzu.vmware.com/security/cve-2019-19025 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-5403 – DoS Via Malformed URL with Reactor Netty HTTP Server
https://notcve.org/view.php?id=CVE-2020-5403
Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response. Reactor Netty HttpServer, versiones 0.9.3 y 0.9.4, está expuesto a una URISyntaxException que causa que la conexión sea cerrada prematuramente en lugar de producir una respuesta 400. • https://pivotal.io/security/cve-2020-5403 • CWE-20: Improper Input Validation CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-5404 – Authentication Leak On Redirect With Reactor Netty HttpClient
https://notcve.org/view.php?id=CVE-2020-5404
The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects. El HttpClient del Reactor Netty, versiones 0.9.x anteriores a 0.9.5, y versiones 0.8.x anteriores a 0.8.16, puede ser usado incorrectamente, conllevando a un filtrado de credenciales durante un redireccionamiento hacia un dominio diferente. A fin de que esto ocurra, el HttpClient debe haber sido configurado explícitamente para seguir los redireccionamientos. • https://pivotal.io/security/cve-2020-5404 https://access.redhat.com/security/cve/CVE-2020-5404 https://bugzilla.redhat.com/show_bug.cgi?id=1975160 • CWE-522: Insufficiently Protected Credentials •