PT-2019-11747 · Jenkins · Jenkins Gogs Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Gogs Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted form in job config.xml files on the Jenkins master or controller. These credentials can be accessed by users with...

Directory traversal

In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925...

CVE-2018-20303

In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925...

CVE-2018-20303

In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925...

CVE-2018-20303

In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925...

CVE-2018-20303

Gogs (Go Git Service) contains a directory traversal vulnerability in the file-upload path (pkg/tool/path.go) prior to version 0.11.82.1218 that can allow an attacker to create files under data/sessions on the server. The issue is documented as CVE-2018-20303 and is related to CVE-2018-18925 in b...

PT-2018-15303 · Gogs · Gogs

Name of the Vulnerable Software and Affected Versions: Gogs versions prior to 0.11.82.1218 Description: A directory traversal issue exists in the file-upload functionality, allowing an attacker to create a file under data/sessions on the server. Recommendations: For versions prior to 0.11.82.1218...

Gogs Directory Traversal Vulnerability

Gogs aka Go Git Service is a Go-based self-service Git hosting service developed by the Gogs team, which supports creating and migrating public/private repositories, adding and removing repository collaborators and so on. A directory traversal vulnerability exists in the file upload function of t...

Cross Site Request Forgery (CSRF)

github.com/gogs/gog is vulnerable to cross-site request forgery CSRF attack. The library does not properly validate the token for user sign-in process, allowing a malicious user to launch a cross-site request forgery attack...

Gogs < 0.11.79 Multiple Vulnerabilities

Gogs is prone to multiple vulnerabilities. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribu...

Gogs Remote Code Execution Vulnerability

Gogs aka Go Git Service is a Go-based self-service Git hosting service developed by the Gogs team, which supports creating and migrating public/private repositories, adding and removing repository collaborators and so on. A security vulnerability exists in Gogs version 0.11.66, which can be...

Remote Code Execution (RCE)

github.com/gogs/gogs is vulnerable to remote code execution RCE attacks. The vulnerability exists due to the ability to forge a session-file in file.go, allowing unauthenticated users to obtain an admin session, and subsequently allowing remote code to be injected...

CVE-2018-18925

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron...

CVE-2018-18925

Gogs 0.11.66 is vulnerable to remote code execution due to improper validation of session IDs, demonstrated by a ".." session-file forgery in the file.go session provider. The issue stems from session handling in the Macaron-based go-macaron/session code, allowing an attacker to map a crafted ses...

CVE-2018-18925

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron...

Design/Logic Flaw

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron...

CVE-2018-18925

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron...

PT-2018-14725 · Go Gitea · Gogs

Name of the Vulnerable Software and Affected Versions: Gogs version 0.11.66 Description: The issue allows remote code execution due to improper validation of session IDs. This can be exploited through a ".." session-file forgery in the file session provider, specifically in the file.go file. The...

CVE-2018-17031

In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent...

Design/Logic Flaw

In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent...