https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 24 Oct 2026 14:55:43 +0000 https://cve.radiocsirt.org/vuln/bit-harbor-2020-13788 <p><strong>Affected:</strong> Bitnami: harbor</p> <p>Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server&#39;s intranet.</p> <p><strong>Affected:</strong> Bitnami: harbor</p> <p>Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server&#39;s intranet.</p> https://cve.radiocsirt.org/vuln/bit-harbor-2020-13788 https://cve.radiocsirt.org/vuln/euvd-2026-41991 EUVD-2026-41991 https://cve.radiocsirt.org/vuln/euvd-2026-41991 https://cve.radiocsirt.org/vuln/fkie_cve-2020-13788 <p>Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server&#39;s intranet.</p> <p>Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server&#39;s intranet.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-13788 https://cve.radiocsirt.org/vuln/ghsa-33p6-fx42-7rf5 <p><strong>Affected:</strong> Go: github.com/goharbor/harbor</p> <p># Impact Matt Hamilton from Soluble has discovered a limited Server-Side Request Forgery (SSRF) that allowed Harbor project owners to scan the TCP ports of hosts on the Harbor server&#39;s internal network.</p> <p>The vulnerability was immediately fixed by the Harbor team.</p> <p># Issue The “Test Endpoint” API, part of the functionality for ensuring a project Webhook is accessible and functional, is vulnerable to a limited SSRF attack. A malicious user that is also a project administrator can use this API for internal port scanning.</p> <p># Known Attack Vectors Successful exploitation of this issue will lead to bad actors identifying open TCP ports on any network that is accessible by the Harbor core services</p> <p># Patches If your product uses the affected releases of Harbor, update to version 2.0.1 to patch this issue immediately.</p> <p>https://github.com/goharbor/harbor/releases/tag/v2.0.1</p> <p># Workarounds Since only project administrators (the user that created the project) are allowed to test the webhook endpoints configured in Harbor, a Harbor system administrator can control who is a project admin. In addition, Harbor system administrators can enforce a setting where only an administrator is allowed to create new projects instead of the default Everyone. This further restricts who can be a project administrator in Harbor.</p> <p># For more information If you have any questions or comments about this advisory, contact cncf-harbor-security@lists.cncf.io View our security policy at https://github.com/go…</p> <p><strong>Affected:</strong> Go: github.com/goharbor/harbor</p> <p># Impact Matt Hamilton from Soluble has discovered a limited Server-Side Request Forgery (SSRF) that allowed Harbor project owners to scan the TCP ports of hosts on the Harbor server&#39;s internal network.</p> <p>The vulnerability was immediately fixed by the Harbor team.</p> <p># Issue The “Test Endpoint” API, part of the functionality for ensuring a project Webhook is accessible and functional, is vulnerable to a limited SSRF attack. A malicious user that is also a project administrator can use this API for internal port scanning.</p> <p># Known Attack Vectors Successful exploitation of this issue will lead to bad actors identifying open TCP ports on any network that is accessible by the Harbor core services</p> <p># Patches If your product uses the affected releases of Harbor, update to version 2.0.1 to patch this issue immediately.</p> <p>https://github.com/goharbor/harbor/releases/tag/v2.0.1</p> <p># Workarounds Since only project administrators (the user that created the project) are allowed to test the webhook endpoints configured in Harbor, a Harbor system administrator can control who is a project admin. In addition, Harbor system administrators can enforce a setting where only an administrator is allowed to create new projects instead of the default Everyone. This further restricts who can be a project administrator in Harbor.</p> <p># For more information If you have any questions or comments about this advisory, contact cncf-harbor-security@lists.cncf.io View our security policy at https://github.com/go…</p> https://cve.radiocsirt.org/vuln/ghsa-33p6-fx42-7rf5 https://cve.radiocsirt.org/vuln/gsd-2020-13788 gsd-2020-13788 https://cve.radiocsirt.org/vuln/gsd-2020-13788