rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-20860 
Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.
Problem types: description: Potential for security bypass with Spring mvcRequestMatcher configuration
Affected products: vendor: n/a
product: Spring Framework
Published: 2023-03-27T00:00:00.000Z
CVE-2023-20861 
In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
Problem types: description: Denial-of-service vulnerability
Affected products: vendor: n/a
product: Spring Framework
Published: 2023-03-23T00:00:00.000Z
CVE-2023-20862 
In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.
Problem types: description: Empty SecurityContext Is Not Properly Saved Upon Logout
Affected products: vendor: n/a
product: Spring Security
Published: 2023-04-19T00:00:00.000Z
CVE-2023-20863 
In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
Problem types: cwe_id: CWE-400
description: CWE-400-Uncontrolled Resource Consumption
Affected products: vendor: n/a
product: Spring Framework
Published: 2023-04-13T00:00:00.000Z
CVE-2023-20864 
VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware Aria Operations for Logs may be able to execute arbitrary code as root.
Problem types: description: VMware Aria Operations for Logs contains a deserialization vulnerability
Affected products: vendor: n/a
product: VMware Aria Operations for Logs (formerly vRealize Log Insight)
Published: 2023-04-20T00:00:00.000Z
CVE-2023-20865 
VMware Aria Operations for Logs contains a command injection vulnerability. A malicious actor with administrative privileges in VMware Aria Operations for Logs can execute arbitrary commands as root.
Problem types: description: VMware Aria Operations for Logs contains a command injection vulnerability
Affected products: vendor: n/a
product: VMware Aria Operations for Logs (formerly vRealize Log Insight)
Published: 2023-04-20T00:00:00.000Z
CVE-2023-20866 
In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it is using HeaderHttpSessionIdResolver.
Problem types: cwe_id: CWE-200
description: CWE-200-Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: n/a
product: Spring Session
Published: 2023-04-13T00:00:00.000Z
CVE-2023-20867 VMware Tools Authentication Bypass Vulnerability
A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: VMware
product: VMware Tools
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.9
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
version: 3.1
Published: 2023-06-13T16:47:21.689Z
CVE-2023-20868 
NSX-T contains a reflected cross-site scripting vulnerability due to a lack of input validation. A remote attacker can inject HTML or JavaScript to redirect to malicious pages.
Problem types: description: Reflected cross-site scripting vulnerability
Affected products: vendor: n/a
product: NSX-T
Published: 2023-05-26T00:00:00.000Z
CVE-2023-20869 
VMware Workstation (17.x) and VMware Fusion (13.x) contain a stack-based buffer-overflow vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine.
Problem types: description: Stack-based buffer-overflow vulnerability in bluetooth device-sharing functionality
Affected products: vendor: n/a
product: VMware Workstation Pro / Player (Workstation) and VMware Fusion
Published: 2023-04-25T00:00:00.000Z
CVE-2023-20870 
VMware Workstation and Fusion contain an out-of-bounds read vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine.
Problem types: description: Information disclosure vulnerability in bluetooth device-sharing functionality
Affected products: vendor: n/a
product: VMware Workstation Pro / Player (Workstation) and VMware Fusion
Published: 2023-04-25T00:00:00.000Z
CVE-2023-20871 
VMware Fusion contains a local privilege escalation vulnerability. A malicious actor with read/write access to the host operating system can elevate privileges to gain root access to the host operating system.
Problem types: description: VMware Fusion Raw Disk local privilege escalation vulnerability
Affected products: vendor: n/a
product: VMware Fusion
Published: 2023-04-25T00:00:00.000Z
CVE-2023-20872 
VMware Workstation and Fusion contain an out-of-bounds read/write vulnerability in SCSI CD/DVD device emulation.
Problem types: description: Out-of-bounds read/write vulnerability
Affected products: vendor: n/a
product: VMware Workstation Pro / Player (Workstation) and VMware Fusion
Published: 2023-04-25T00:00:00.000Z
CVE-2023-20873 
In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users should upgrade to 2.7.11+. Users of older, unsupported versions should upgrade to 3.0.6+ or 2.7.11+.
Problem types: description: Security Bypass with Spring Boot when deployed to Cloud Foundry
Affected products: vendor: n/a
product: Spring Boot
Published: 2023-04-20T00:00:00.000Z
CVE-2023-20877 
VMware Aria Operations contains a privilege escalation vulnerability. An authenticated malicious user with ReadOnly privileges can perform code execution leading to privilege escalation.
Problem types: description: Privilege Escalation Vulnerability
Affected products: vendor: n/a
product: VMware Aria Operations (formerly vRealize Operations)
Published: 2023-05-12T00:00:00.000Z
CVE-2023-20878 
VMware Aria Operations contains a deserialization vulnerability. A malicious actor with administrative privileges can execute arbitrary commands and disrupt the system.
Problem types: description: Deserialization Vulnerability
Affected products: vendor: n/a
product: VMware Aria Operations (formerly vRealize Operations)
Published: 2023-05-12T00:00:00.000Z
CVE-2023-20879 
VMware Aria Operations contains a Local privilege escalation vulnerability. A malicious actor with administrative privileges in the Aria Operations application can gain root access to the underlying operating system.
Problem types: description: Local Privilege Escalation Vulnerability
Affected products: vendor: n/a
product: VMware Aria Operations (formerly vRealize Operations)
Published: 2023-05-12T00:00:00.000Z
CVE-2023-20880 
VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges to 'root'.
Problem types: description: Local Privilege Escalation Vulnerability
Affected products: vendor: n/a
product: VMware Aria Operations (formerly vRealize Operations)
Published: 2023-05-12T00:00:00.000Z
CVE-2023-20881 
Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drain credentials if they're aware of the client certificate used for that syslog drain. This applies even if the drain has zero certs. This would allow the user to override the private key and add or modify a certificate authority used for the connection.
Problem types: cwe_id: CWE-295
description: CWE-295: Improper Certificate Validation
Affected products: vendor: n/a
product: Cloud Controller API
Published: 2023-05-19T00:00:00.000Z
CVE-2023-20882 
In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service of applications hosted on Cloud Foundry. Under the right circumstances, when client connections are closed prematurely, gorouter marks the currently selected backend as failed and removes it from the routing pool.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: n/a
product: Cloud Foundry Routing release
Published: 2023-05-26T00:00:00.000Z
CVE-2023-20883 
In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: n/a
product: Spring Boot
Published: 2023-05-26T00:00:00.000Z
CVE-2023-20884 
VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated malicious actor may be able to redirect a victim to an attacker controlled domain due to improper path handling leading to sensitive information disclosure.
Problem types: description: Insecure Redirect Vulnerability
Affected products: vendor: n/a
product: VMware Workspace ONE Access (Access), VMware Identity Manager (vIDM), VMware Cloud Foundation (Cloud Foundation)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2023-05-30T15:05:53.284Z
CVE-2023-20885 CF workflows leak credentials in system audit logs
Vulnerability in Cloud Foundry Notifications, Cloud Foundry SMB-volume release, Cloud FOundry cf-nfs-volume release.This issue affects Notifications: All versions prior to 63; SMB-volume release: All versions prior to 3.1.19; cf-nfs-volume release: 5.0.X versions prior to 5.0.27, 7.1.X versions prior to 7.1.19.


Affected products: vendor: Cloud Foundry
product:  Notifications
default_status: unaffected
vendor: Cloud Foundry
product: SMB-volume release
default_status: unaffected
vendor: Cloud FOundry
product: cf-nfs-volume release
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-06-16T12:18:35.886Z
CVE-2023-20886 
VMware Workspace ONE UEM console contains an open redirect vulnerability.


A malicious actor may be able to redirect a victim to an attacker and retrieve their SAML response to login as the victim user.


Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: n/a
product: VMware Workspace ONE UEM Console
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-10-31T20:44:50.773Z
CVE-2023-20887 
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.
Problem types: description: Networks Command Injection Vulnerability
Affected products: vendor: n/a
product: Aria Operations for Networks (Formerly vRealize Network Insight)
default_status: unaffected
Published: 2023-06-07T14:16:56.641Z
CVE-2023-20888 
Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network access to VMware Aria Operations for Networks and valid 'member' role credentials may be able to perform a deserialization attack resulting in remote code execution.
Problem types: description: Networks Authenticated Deserialization Vulnerability 
Affected products: vendor: n/a
product: Aria Operations for Networks (Formerly vRealize Network Insight)
default_status: unaffected
Published: 2023-06-07T14:18:41.771Z
CVE-2023-20889 
Aria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in information disclosure.
Problem types: description: Information Disclosure Vulnerability
Affected products: vendor: n/a
product: Aria Operations for Networks (Formerly vRealize Network Insight)
default_status: unaffected
Published: 2023-06-07T14:20:14.452Z
CVE-2023-20890 
Aria Operations for Networks contains an arbitrary file write vulnerability. An authenticated malicious actor with administrative access to VMware Aria Operations for Networks can write files to arbitrary locations resulting in remote code execution.
Problem types: description: Arbitrary File Write Vulnerability
Affected products: vendor: n/a
product: Aria Operations for Networks
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-08-29T17:38:05.601Z
CVE-2023-20891 VMware Tanzu Application Service for VMs and Isolation Segment information disclosure vulnerability
The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs. A malicious non-admin user who has access to the platform system audit logs can access hex encoded CF API admin credentials and can push new malicious versions of an application. In a default deployment non-admin users do not have access to the platform system audit logs.
Problem types: cwe_id: CWE-532
description: CWE-532: Insertion of Sensitive Information into Log File
Affected products: vendor: VMware
product: VMware Tanzu Application Service for VMs
default_status: unaffected
vendor: VMware
product: Isolation segment
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-07-26T05:41:23.643Z
CVE-2023-20892 VMware vCenter Server heap-overflow vulnerability
The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit heap-overflow vulnerability to execute arbitrary code on the underlying operating system that hosts vCenter Server.
Affected products: vendor: VMware
product: VMware vCenter Server (vCenter Server)
default_status: unaffected
vendor: VMware
product: VMware Cloud Foundation (vCenter Server)
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-06-22T11:47:19.390Z
CVE-2023-20893 
The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit this issue to execute arbitrary code on the underlying operating system that hosts vCenter Server.
Affected products: vendor: VMware
product: VMware vCenter Server (vCenter Server)
default_status: unaffected
vendor: VMware
product: VMware Cloud Foundation (vCenter Server)
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-06-22T11:52:32.771Z
CVE-2023-20894 
The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bound write by sending a specially crafted packet leading to memory corruption.
Affected products: vendor: VMware
product: VMware vCenter Server (vCenter Server)
default_status: unaffected
vendor: VMware
product: VMware Cloud Foundation (vCenter Server)
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-06-22T11:54:04.383Z
CVE-2023-20895 
The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger a memory corruption vulnerability which may bypass authentication.
Affected products: vendor: VMware
product: VMware vCenter Server (vCenter Server)
default_status: unaffected
vendor: VMware
product: VMware Cloud Foundation (vCenter Server)
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-06-22T11:57:15.954Z
CVE-2023-20896 
The VMware vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds read by sending a specially crafted packet leading to denial-of-service of certain services (vmcad, vmdird, and vmafdd).
Affected products: vendor: VMware
product: VMware vCenter Server (vCenter Server)
default_status: unaffected
vendor: VMware
product: VMware Cloud Foundation (vCenter Server)
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-06-22T12:00:45.390Z
CVE-2023-20897 
Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted.
Problem types: description: DOS in minion return.
Affected products: vendor: n/a
product: Salt
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2023-09-05T10:56:33.183Z
CVE-2023-20898 
Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash.
Problem types: description: Git Providers can read from the wrong environment because they get the same cache directory base name.
Affected products: vendor: n/a
product: Salt
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
version: 3.1
Published: 2023-09-05T10:59:10.439Z
CVE-2023-20899 
VMware SD-WAN (Edge) contains a bypass authentication vulnerability. An unauthenticated attacker can download the Diagnostic bundle of the application under VMware SD-WAN Management.
Problem types: description: Bypass Authentication
Affected products: vendor: n/a
product: VMware SD-WAN (Edge)
default_status: unaffected
Published: 2023-07-06T22:29:19.852Z
CVE-2023-20900 
A malicious actor that has been granted  Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged  Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .
Problem types: description: SAML Token Signature Bypass vulnerability
Affected products: vendor: n/a
product: VMware Tools
default_status: unaffected
vendor: n/a
product: VMware Tools
default_status: unaffected
vendor: n/a
product: VMware Tools (open-vm-tools)
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-08-31T09:45:43.130Z
CVE-2023-20902 Timing attack risk in Harbor
A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below,  Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to 
create jobs/stop job tasks and retrieve job task information.



Problem types: description: In the Harbor jobservice container, the comparison of secrets in the authenticator type is prone to timing attacks.
Affected products: vendor: Harbor
product: Project
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Thanks to Porcupiney Hairs for reporting this issue.
Published: 2023-11-09T00:36:25.369Z