Gogs Git Hooks Remote Code Execution

This module leverages an insecure setting to get remote code execution on the target OS in the context of the user running Gogs. This is possible when the current user is allowed to create git hooks, which is the default for administrative users. For non-administrative users, the permission needs...

Gogs has an unspecified vulnerability

Gogs Go Git Service is a Go-based self-service Git hosting service , which supports creating and migrating public/private repositories , adding and removing repository collaborators and so on. A security vulnerability exists in MakeEmailPrimary in the models/usermail.go file in Gogs version...

CVE-2020-14958

In Gogs 0.11.91, MakeEmailPrimary in models/usermail.go lacks a "not the owner of the email" check...

CVE-2020-14958

In Gogs 0.11.91, MakeEmailPrimary in models/usermail.go lacks a "not the owner of the email" check...

Design/Logic Flaw

In Gogs 0.11.91, MakeEmailPrimary in models/usermail.go lacks a "not the owner of the email" check...

CVE-2020-14958

CVE-2020-14958 affects Gogs 0.11.91. The issue is in the MakeEmailPrimary function (models/user_mail.go) where there is no check to ensure the requester is not the owner of the email, i.e., ownership verification is missing. This implies potential improper permissions when selecting a primary ema...

CVE-2020-14958

In Gogs 0.11.91, MakeEmailPrimary in models/usermail.go lacks a "not the owner of the email" check...

CVE-2020-14958: Improper Preservation of Permissions

In Gogs 0.11.91, MakeEmailPrimary in models/usermail.go lacks a "not the owner of the email" check...

Cross-Site Scripting (XSS)

github.com/gogs/gogs is vulnerable to cross-site scripting XSS. The x-content-type-options header value is not configured to nosniff, which causes the user's browser to perform mime-type sniffing when viewing a raw file. This can lead to arbitrary execution of Javascript in a raw file...

Gogs < 0.12 Multiple Vulnerabilities

Gogs is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribu...

Gogs Competitive Conditions Problem Vulnerability

Gogs Go Git Service is a Go-based self-service Git hosting service , which supports creating and migrating public/private repositories , adding and removing repository collaborators and so on. A security vulnerability exists in the internal/db/repo.go file in Gogs 0.11.91 and earlier versions. An...

CVE-2020-9329

Gogs through 0.11.91 allows attackers to violate the admin-specified repo-creation policy due to an internal/db/repo.go race condition...

CVE-2020-9329

Gogs through 0.11.91 allows attackers to violate the admin-specified repo-creation policy due to an internal/db/repo.go race condition...

Race condition

Gogs through 0.11.91 allows attackers to violate the admin-specified repo-creation policy due to an internal/db/repo.go race condition...

CVE-2020-9329

Gogs through 0.11.91 allows attackers to violate the admin-specified repo-creation policy due to an internal/db/repo.go race condition...

CVE-2020-9329

Gogs (Go Git Service) up to version 0.11.91 is affected by a race condition in internal/db/repo.go that allows an attacker to bypass the admin-defined repository-creation policy. The vulnerability enables creation of repositories beyond the configured limits, leveraging a race condition. Exploita...

CVE-2020-9329: Concurrent Execution using Shared Resource with Improper Synchronization

Gogs through 0.11.91 allows attackers to violate the admin-specified repo-creation policy due to an internal/db/repo.go race condition...

Jenkins Gogs Cleartext Storage of Credentials Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Jenkins Gogs. Authentication is required to exploit this vulnerability. The specific flaw exists within the Gogs plugin. The issue results from storing credentials in plaintext. An attacker ca...

Missing Permission Checks

github.com/gogs/gogs is vulnerable to missing permission checks. The function RegisterRoutes in routes/api/v1/api.g does not invoke the reqAdmin method to perform permission checks for deploy keys, collaborators, and hooks...

Gogs < 0.11.86 Directory Traversal Vulnerability

Gogs is prone to a directory traversal vulnerability. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...