1316 matches found
GHSA-PX5R-FQJ6-R2F8 Gogs XSS Vulnerability
In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent...
GHSA-9HXG-W7QF-HH93 Gogs Directory Traversal
In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925...
Gogs Directory Traversal
In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925...
Gogs < 0.12.7 XSS Vulnerability
Gogs is prone to a cross-site scripting XSS vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; yo...
Cross-Site Scripting (XSS)
github.com/gogs/gogs is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in the runWeb function of web.go, allowing an attacker to inject and execute malicious javascript...
CVE-2022-1464
Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account...
CVE-2022-1464
Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account...
CVE-2022-1464 Stored xss bug in gogs/gogs
Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account...
CVE-2022-1464
Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account...
CVE-2022-1464
CVE-2022-1464 concerns a stored XSS in Gogs (Go Git Service) prior to version 0.12.7. The vulnerability arises when users upload or view report attachments in a public repository; opening an attachment can execute arbitrary JavaScript in the victim’s account. Public notes indicate the issue is tr...
Gogs 跨站脚本漏洞
Gogs Go Git Service is a Go-based self-service Git hosting service from the GOGS team that supports creating and migrating public/private repositories, adding and removing repository collaborators, and more. A security vulnerability exists in Gogs versions prior to 0.12.7, which stems from the la...
FreeBSD : gogs -- XSS in issue attachments (647ac600-cc70-11ec-9cfc-10c37b4ac2ea)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 647ac600-cc70-11ec-9cfc-10c37b4ac2ea advisory. - The gogs project reports: Repository issues page allows HTML attachments with arbitrary JS code...
CVE-2022-1464: Improper Neutralization of Input During Web Page Generation
Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account...
PT-2022-13907 · Gogs · Gogs
Name of the Vulnerable Software and Affected Versions: gogs/gogs versions prior to 0.12.7 Description: The issue is a stored XSS bug in the gogs/gogs GitHub repository. This bug allows the execution of any JavaScript code in a victim's account. The vulnerability is triggered when a user opens an...
gogs -- XSS in issue attachments
The gogs project reports: Repository issues page allows HTML attachments with arbitrary JS code...
FULL read SSRF
Description there is two bypass method for previous fixes of SSRF in gogs The first is to utilize SSRF attack with a DNS rebinding feature. The second is to use redirection to a localhost URL. Proof of Concept 1- go to the webhooks section and create a gogs webhook. 2- enter an URL that redirects...
GHSA-5GJH-5J4F-CPWV Unrestricted Upload of File with Dangerous Type in Gogs
Impact The malicious user is able to upload a crafted config file into repository's .git directory with to gain SSH access to the server. All installations with repository upload enabled default are affected. Patches Repository file uploads are prohibited to its .git directory. Users should upgra...
Unrestricted Upload of File with Dangerous Type in Gogs
Impact The malicious user is able to upload a crafted config file into repository's .git directory with to gain SSH access to the server. All installations with repository upload enabled default are affected. Patches Repository file uploads are prohibited to its .git directory. Users should upgra...
Gogs < 0.12.6 RCE Vulnerability
Gogs is prone to a remote code execution RCE vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...