1170 matches found
Gogs Git Hooks Remote Code Execution Exploit
This Metasploit module leverages an insecure setting to get remote code execution on the target OS in the context of the user running Gogs. This is possible when the current user is allowed to create git hooks, which is the default for administrative users. For non-administrative users, the...
Gogs >= 0.5.5, <= 0.12.3 RCE Vulnerability
Gogs is prone to a remote code execution RCE vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...
Remote Code Execution (RCE)
github.com/gogs/gogs is vulnerable to remote code execution RCE. The vulnerability exists through git hooks which are enabled by default...
Gogs OS Command Injection Vulnerability
Gogs Go Git Service is a Go-based self-service Git hosting service , which supports creating and migrating public/private repositories , adding and removing repository collaborators and so on. An operating system command injection vulnerability exists in the git hook feature of Gogs versions 1.1....
CVE-2020-15867
The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook feature is granted to a user who does not have administrative privileges. NOTE: because this is mentioned in the documentation but not in th...
CVE-2020-15867
The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook feature is granted to a user who does not have administrative privileges. NOTE: because this is mentioned in the documentation but not in th...
Privilege escalation
The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook feature is granted to a user who does not have administrative privileges. NOTE: because this is mentioned in the documentation but not in th...
CVE-2020-15867
The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook feature is granted to a user who does not have administrative privileges. NOTE: because this is mentioned in the documentation but not in th...
CVE-2020-15867
Gogs 0.5.5–0.12.2 is vulnerable to authenticated remote code execution via the git hooks feature. The root cause is that privileged users can create git hooks (post-receive) and trigger code execution; non-admin users require explicit permission. The issue is exploitable through the web interface...
CVE-2020-15867
The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook feature is granted to a user who does not have administrative privileges. NOTE: because this is mentioned in the documentation but not in th...
Gogs has an unspecified vulnerability
Gogs Go Git Service is a Go-based self-service Git hosting service , which supports creating and migrating public/private repositories , adding and removing repository collaborators and so on. A security vulnerability exists in MakeEmailPrimary in the models/usermail.go file in Gogs version...
CVE-2020-14958
In Gogs 0.11.91, MakeEmailPrimary in models/usermail.go lacks a "not the owner of the email" check...
CVE-2020-14958
In Gogs 0.11.91, MakeEmailPrimary in models/usermail.go lacks a "not the owner of the email" check...
Design/Logic Flaw
In Gogs 0.11.91, MakeEmailPrimary in models/usermail.go lacks a "not the owner of the email" check...
CVE-2020-14958
CVE-2020-14958 affects Gogs 0.11.91. The issue is in the MakeEmailPrimary function (models/user_mail.go) where there is no check to ensure the requester is not the owner of the email, i.e., ownership verification is missing. This implies potential improper permissions when selecting a primary ema...
CVE-2020-14958
In Gogs 0.11.91, MakeEmailPrimary in models/usermail.go lacks a "not the owner of the email" check...
Cross-Site Scripting (XSS)
github.com/gogs/gogs is vulnerable to cross-site scripting XSS. The x-content-type-options header value is not configured to nosniff, which causes the user's browser to perform mime-type sniffing when viewing a raw file. This can lead to arbitrary execution of Javascript in a raw file...
Gogs < 0.12 Multiple Vulnerabilities
Gogs is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribu...
Gogs Competitive Conditions Problem Vulnerability
Gogs Go Git Service is a Go-based self-service Git hosting service , which supports creating and migrating public/private repositories , adding and removing repository collaborators and so on. A security vulnerability exists in the internal/db/repo.go file in Gogs 0.11.91 and earlier versions. An...