CVE-2019-19030

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether a resource exists.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-204

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/goharbor/harbor/security/advisories/GHSA-q9x4-q76f-5h5jExploit, Third Party Advisory
https://github.com/goharbor/harbor/security/advisories/GHSA-q9x4-q76f-5h5jExploit, Third Party Advisory

Timeline

Published: Dec 26, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-190318.1Easy XML Editor through v1.7.8 is affected by: XML External Entity Injection. The impact is: Arbitrary File Read and DoS by consuming resour CVE-2019-190328.1XMLBlueprint through 16.191112 is affected by XML External Entity Injection. The impact is: Arbitrary File Read when an XML File is validate CVE-2019-190339.8Jalios JCMS 10 allows attackers to access any part of the website and the WebDAV server with administrative privileges via a backdoor accoun CVE-2019-190347.2Zoho ManageEngine Asset Explorer 6.5 does not validate the System Center Configuration Manager (SCCM) database username when dynamically gen CVE-2019-190355.5jhead 3.03 is affected by: heap-based buffer over-read. The impact is: Denial of service. The component is: ReadJpegSections and process_SOF CVE-2019-190365.5btrfs_root_node in fs/btrfs/ctree.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because rcu_dereference(root->node)CVE-2019-190375.5ext4_empty_dir in fs/ext4/namei.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because ext4_read_dirblock(inode,0,DI CVE-2019-190395.5__btrfs_free_extent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfs_print_leaf in a certain ENOENT case, which allo CVE-2019-19048.8A vulnerability in the web-based UI (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-sit CVE-2019-190406.1KairosDB through 1.2.2 has XSS in view.html because of showErrorMessage in js/graph.js, as demonstrated by view.html?q= with a '"sampling":{CVE-2019-190417.2An issue was discovered in Xorux Lpar2RRD 6.11 and Stor2RRD 2.61, as distributed in Xorux 2.41. They do not correctly verify the integrity o CVE-2019-190435.5A memory leak in the i40e_setup_macvlans() function in drivers/net/ethernet/intel/i40e/i40e_main.c in the Linux kernel through 5.3.11 allows