Server side request forgery (ssrf)

Server-Side Request Forgery SSRF in GitHub repository gogs/gogs prior to 0.12.8...

CVE-2022-1285

Server-Side Request Forgery SSRF in GitHub repository gogs/gogs prior to 0.12.8...

CVE-2022-1285 Server-Side Request Forgery (SSRF) in gogs/gogs

Server-Side Request Forgery SSRF in GitHub repository gogs/gogs prior to 0.12.8...

CVE-2022-1285

Gogs SSRF CVE-2022-1285 affects gogs/gogs prior to 0.12.8, exploitable via webhook handling that can reveal internal services. Root cause: server-side request forgery in webhook URL processing. Impact: potential exposure of internal network topology and services; documentation notes internal-reso...

CVE-2022-1285 Server-Side Request Forgery (SSRF) in gogs/gogs

Server-Side Request Forgery SSRF in GitHub repository gogs/gogs prior to 0.12.8...

CVE-2022-1285: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF in GitHub repository gogs/gogs prior to 0.12.8...

Gogs 代码问题漏洞

Gogs Go Git Service is a Go-based self-service Git hosting service from the GOGS team that supports creating and migrating public/private repositories, adding and removing repository collaborators, etc. A server-side request forgery vulnerability exists in versions prior to Gogs 0.12.8, for which...

CVE-2021-32546

CVE-2021-32546 affects Gogs before 0.12.8 due to missing input validation in internal/db/repo_editor.go, enabling remote code execution. An unprivileged, registered user can overwrite a repository’s Git configuration (e.g., via GUI-created file named with a backslash and renaming to .git/config),...

CVE-2021-32546

Missing input validation in internal/db/repoeditor.go in Gogs before 0.12.8 allows an attacker to execute code remotely. An unprivileged attacker registered user can overwrite the Git configuration in his repository. This leads to Remote Command Execution, because that configuration can contain a...

CVE-2021-32546: Undefined Security Weakness

Missing input validation in internal/db/repoeditor.go in Gogs before 0.12.8 allows an attacker to execute code remotely. An unprivileged attacker registered user can overwrite the Git configuration in his repository. This leads to Remote Command Execution, because that configuration can contain a...

PT-2022-10085 · Gogs · Gogs

Name of the Vulnerable Software and Affected Versions: Gogs versions prior to 0.12.8 Description: The issue is caused by missing input validation in internal/db/repo editor.go, allowing an attacker to execute code remotely. An unprivileged attacker can overwrite the Git configuration in their...

GHSA-FF28-F46G-R9G8 Cross-site Scripting in Gogs

Impact The malicious user is able to upload a crafted SVG file as the issue attachment to archive XSS. All installations allow uploading SVG text/xml files as issue attachments non-default are affected. Patches Correctly setting the Content Security Policy for the serving endpoint. Users should...

Cross-site Scripting in Gogs

Impact The malicious user is able to upload a crafted SVG file as the issue attachment to archive XSS. All installations allow uploading SVG text/xml files as issue attachments non-default are affected. Patches Correctly setting the Content Security Policy for the serving endpoint. Users should...

Jenkins Gogs Plugin stored credentials in plain text

Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins controller. These credentials could be viewed by users with Extended Read permission, or access to the Jenkins controller file system. Gogs Plugin now stores credentials encrypted...

GHSA-Q736-RGCP-Q443 Jenkins Gogs Plugin stored credentials in plain text

Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins controller. These credentials could be viewed by users with Extended Read permission, or access to the Jenkins controller file system. Gogs Plugin now stores credentials encrypted...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public, any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account...

Gogs File Upload Command Injection (CVE-2022-0415)

A command injection vulnerability exists in Gogs File Upload. Successful exploitation of this vulnerability could result in code execution on the affected system...

GHSA-FG3X-RWQ9-74CW Gogs and Gitea SSRF Vulnerability

An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services...

Gogs and Gitea SSRF Vulnerability

An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services...

Gogs XSS Vulnerability

In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent...