CVE-2019-19026

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivotal Platform.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/goharbor/harbor/security/advisoriesThird Party Advisory
https://github.com/goharbor/harbor/security/advisories/GHSA-rh89-vvrg-fg64Third Party Advisory
https://tanzu.vmware.com/security/cve-2019-19026Third Party Advisory
https://github.com/goharbor/harbor/security/advisoriesThird Party Advisory
https://github.com/goharbor/harbor/security/advisories/GHSA-rh89-vvrg-fg64Third Party Advisory
https://tanzu.vmware.com/security/cve-2019-19026Third Party Advisory

Timeline

Published: Mar 20, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-190297.2Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Regist CVE-2019-19039.1A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information or cause a denial CVE-2019-190305.3Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls re CVE-2019-190318.1Easy XML Editor through v1.7.8 is affected by: XML External Entity Injection. The impact is: Arbitrary File Read and DoS by consuming resour CVE-2019-190328.1XMLBlueprint through 16.191112 is affected by XML External Entity Injection. The impact is: Arbitrary File Read when an XML File is validate CVE-2019-190339.8Jalios JCMS 10 allows attackers to access any part of the website and the WebDAV server with administrative privileges via a backdoor accoun CVE-2019-190347.2Zoho ManageEngine Asset Explorer 6.5 does not validate the System Center Configuration Manager (SCCM) database username when dynamically gen CVE-2019-190355.5jhead 3.03 is affected by: heap-based buffer over-read. The impact is: Denial of service. The component is: ReadJpegSections and process_SOF CVE-2019-190365.5btrfs_root_node in fs/btrfs/ctree.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because rcu_dereference(root->node)CVE-2019-190375.5ext4_empty_dir in fs/ext4/namei.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because ext4_read_dirblock(inode,0,DI CVE-2019-190395.5__btrfs_free_extent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfs_print_leaf in a certain ENOENT case, which allo CVE-2019-19048.8A vulnerability in the web-based UI (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-sit