1316 matches found
CVE-2018-15193
A CSRF vulnerability in the admin panel in Gogs through 0.11.53 allows remote attackers to execute admin operations via a crafted issue / link...
CVE-2018-15178
Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via an initial /\ substring in the user/login redirectto parameter, related to the function isValidRedirect in routes/user/auth.go...
CVE-2018-15178
Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via an initial /\ substring in the user/login redirectto parameter, related to the function isValidRedirect in routes/user/auth.go...
Open redirect
Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via an initial /\ substring in the user/login redirectto parameter, related to the function isValidRedirect in routes/user/auth.go...
PT-2018-12939 · Gogs +1 · Gogs +1
Name of the Vulnerable Software and Affected Versions: Gitea versions through 1.5.0-rc2 Gogs versions through 0.11.53 Description: A Server-Side Request Forgery SSRF issue in webhooks affects Gitea and Gogs, allowing remote attackers to access intranet services. Recommendations: For Gitea version...
CVE-2018-15193: Cross-Site Request Forgery (CSRF)
A CSRF vulnerability in the admin panel in Gogs through 0.11.53 allows remote attackers to execute admin operations via a crafted issue / link...
CVE-2018-15178
Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via an initial /\ substring in the user/login redirectto parameter, related to the function isValidRedirect in routes/user/auth.go...
CVE-2018-15192: Server-Side Request Forgery (SSRF)
An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services...
CVE-2018-15178
Gogs Open Redirect CVE-2018-15178 affects Gogs prior to 0.12. The issue is an open redirect via the user/login redirect_to parameter, related to isValidRedirect in routes/user/auth.go, enabling attackers to redirect users to arbitrary sites and potentially enable phishing. Connected sources corro...
PT-2018-12926 · Gogs · Gogs
Name of the Vulnerable Software and Affected Versions: Gogs versions prior to 0.12 Description: The issue allows remote attackers to redirect users to arbitrary websites, potentially leading to phishing attacks. This is achieved via an initial / substring in the redirect to parameter. The...
CVE-2018-15178: URL Redirection to Untrusted Site
Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via an initial /\ substring in the user/login redirectto parameter, related to the function isValidRedirect in routes/user/auth.go...
gogs -- open redirect vulnerability
bluecatli Tencent's Xuanwu Lab reports: The function isValidRedirect in gogs/routes/user/auth.go is used in login action to validate if url is on the same site. If the Location header startswith /, it will be transformed to // by browsers...
Cross-Site Scripting
github.com/gogits/gogs is vulnerable to cross-site scripting XSS. The branch names aren't sanitized, allowing an attacker to inject and execute arbitrary code...
Information Disclosure
github.com/gogits/gogs is vulnerable to arbitrary webhook retrieval. GetWebhookByID allows a user to access webhooks from other users' private repositories because it does not check the corresponding repoid when retreiving webhooks...
Cross-site Scripting (XSS)
github.com/gogits/gogs is vulnerable to cross-site scripting XSS attacks. The attacks can be triggered because a user can change their username to anything other than an empty string. This allows them to enter code which may be executed...
Cross-site Scripting (XSS)
github.com/gogits/gogs is vulnerable to cross-site scripting XSS attacks. The library's wiki templates do not sanitize user input, allowing a malicious user to inject and execute arbitrary code...
SQL Injection
github.com/gogits/gogs is vulnerable to SQL injection attacks. These attacks are possible through the label parameter given to the GetIssues function in models/issue.go...
Unauthorised Release Deletion
github.com/gogits/gogs is vulnerable to unauthorised release deletions. A malicious user can delete another user's repository releases by modifying a post request...
Cross-site Scripting (XSS)
github.com/gogits/gogs is vulnerable to cross-site scripting XSS attacks. The library does not sanitize markdown before rendering it, allowing an attacker to execute arbitrary code via markdown comments...