144 matches found
OPENSUSE-SU-2025:14881-1 forgejo-runner-6.2.2-3.1 on GA media
These are all security issues fixed in the forgejo-runner-6.2.2-3.1 package on the GA media of openSUSE Tumbleweed...
Exploit for CVE-2024-45337
Proof of Concept exploit for CVE-2024-45337 === This repository...
FreeBSD : forgejo -- unauthorized user impersonation (25a697de-bca1-11ef-8926-9b4f2d14eb53)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 25a697de-bca1-11ef-8926-9b4f2d14eb53 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's...
FreeBSD : forgejo -- multiple vulnerabilities (5ca064a6-bca1-11ef-8926-9b4f2d14eb53)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 5ca064a6-bca1-11ef-8926-9b4f2d14eb53 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's...
FreeBSD : forgejo -- multiple vulnerabilities (6dcf6fc6-bca0-11ef-8926-9b4f2d14eb53)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 6dcf6fc6-bca0-11ef-8926-9b4f2d14eb53 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's...
forgejo -- multiple vulnerabilities
Problem Description: When Forgejo is configured to run the internal ssh server with server.STARTSSHSERVER=true, it was possible for a registered user to impersonate another user. The rootless container image uses the internal ssh server by default and was vulnerable. A Forgejo instance running fr...
forgejo -- unauthorized user impersonation
Problem Description: When Forgejo is configured to run the internal ssh server with server.STARTSSHSERVER=true, it was possible for a registered user to impersonate another user. The rootless container image uses the internal ssh server by default and was vulnerable. A Forgejo instance running fr...
FreeBSD : forgejo -- multiple vulnerabilities (f07c8f87-8e65-11ef-81b8-659bf0027d16)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the f07c8f87-8e65-11ef-81b8-659bf0027d16 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's...
forgejo -- multiple vulnerabilities
Problem Description: Forgejo generates a token which is used to authenticate web endpoints that are only meant to be used internally, for instance when the SSH daemon is used to push a commit with Git. The verification of this token was not done in constant time and was susceptible to timing...
OPENSUSE-SU-2024:14330-1 forgejo-8.0.3-1.1 on GA media
These are all security issues fixed in the forgejo-8.0.3-1.1 package on the GA media of openSUSE Tumbleweed...
FreeBSD : forgejo -- multiple vulnerabilities (a5e13973-6c75-11ef-858b-23eeba13701a)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a5e13973-6c75-11ef-858b-23eeba13701a advisory. - Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, y...
forgejo -- multiple vulnerabilities
Problem Description: Replace v-html with v-text in search inputbox Upgrade webpack to v5.94.0 as a precaution to mitigate CVE-2024-43788, although we were not yet able to confirm that this can be exploited in Forgejo...
FreeBSD : forgejo -- The scope of application tokens was not verified when writing containers or Conan packages. (eb437e17-66a1-11ef-ac08-75165d18d8d2)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the eb437e17-66a1-11ef-ac08-75165d18d8d2 advisory. The forgejo team reports: The scope of application tokens was not verified when writing containers or...
OPENSUSE-SU-2024:14287-1 forgejo-runner-3.5.1-1.1 on GA media
These are all security issues fixed in the forgejo-runner-3.5.1-1.1 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2024:14050-1 forgejo-7.0.4-1.1 on GA media
These are all security issues fixed in the forgejo-7.0.4-1.1 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2024:13990-1 forgejo-7.0.3-1.1 on GA media
These are all security issues fixed in the forgejo-7.0.3-1.1 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2024:13837-1 forgejo-1.21.10+0-1.1 on GA media
These are all security issues fixed in the forgejo-1.21.10+0-1.1 package on the GA media of openSUSE Tumbleweed...
forgejo -- multiple issues
The forgejo team reports: CVE-2024-24789: The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the...
CVE-2023-49946
In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. This allows remote attackers to read private issues, read private pull requests, delete issues, and perform other unauthorized actions...