1316 matches found
Jenkins Plugin Gogs 安全漏洞
Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...
PT-2023-27406 · Jenkins · Jenkins Gogs Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Gogs Plugin versions 1.0.15 and earlier Description: The Jenkins Gogs Plugin improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of jobs. The plugin provides a webhook...
CVE-2023-40349: Improper Initialization
Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of jobs...
PT-2023-27405 · Jenkins · Jenkins Gogs Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Gogs Plugin versions 1.0.15 and earlier Description: The webhook endpoint in Jenkins Gogs Plugin provides unauthenticated attackers with information about the existence of jobs in its output. This endpoint, located at "/gogs-webhook",...
Unsafe default behavior and information disclosure in gogs-webhook webhook
gogs-webhook provides a webhook endpoint at /gogs-webhook that can be used to trigger builds of jobs. In gogs-webhook 1.0.15 and earlier, an option to specify a Gogs secret for this webhook is provided, but not enabled by default. This allows unauthenticated attackers to trigger builds of jobs...
PT-2023-9256
Name of the Vulnerable Software and Affected Versions Gogs versions 0.13.0 and earlier Description The built-in SSH server of Gogs allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending ...
PT-2023-9257 · Gogs · Gogs
Name of the Vulnerable Software and Affected Versions: Gogs versions 0.13.0 and earlier Description: The issue allows an attacker to delete or modify arbitrary files on a vulnerable Gogs server. This can be exploited by a remote attacker. Unprivileged user accounts can execute arbitrary commands ...
OS Command Injection
github.com/gogs/gogs is vulnerable to OS Command Injection. The vulnerability exists because the isRepositoryGitPath function of repoeditor.go does not properly check the git path on case-insensitive file systems, which allows an attacker to upload malicious file configs into the system...
Gogs OS Command Injection vulnerability
Impact The malicious user is able to update a crafted config file into repository's .git directory in combination with crafted file deletion to gain SSH access to the server on case-insensitive file systems. All installations with repository upload enabled default on case-insensitive file systems...
GHSA-PFVH-P8QP-9WW9 Gogs OS Command Injection vulnerability
Impact The malicious user is able to update a crafted config file into repository's .git directory in combination with crafted file deletion to gain SSH access to the server on case-insensitive file systems. All installations with repository upload enabled default on case-insensitive file systems...
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11...
CVE-2022-2024
OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11...
Command injection
OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11...
CVE-2022-2024 OS Command Injection in gogs/gogs
OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11...
PT-2023-12641 · Gogs · Gogs
Name of the Vulnerable Software and Affected Versions: gogs/gogs versions prior to 0.12.11 Description: The issue allows a malicious user to update a crafted config file into a repository's .git directory, in combination with crafted file deletion, to gain SSH access to the server on...
CVE-2022-2024 OS Command Injection in gogs/gogs
OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11...
CVE-2022-2024 OS Command Injection in gogs/gogs
OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11...
CVE-2022-2024
Vulnerability summary (CVE-2022-2024) : Gogs (gogs/gogs) versions prior to 0.12.11 are affected by an OS Command Injection in the repository file upload path. The issue arises when a crafted config file is placed into a repository’s .git directory during uploads, enabling remote command execution...
Gogs 操作系统命令注入漏洞
Gogs Go Git Service is a Go-based self-service Git hosting service from the GOGS team that supports creating and migrating public/private repositories, adding and removing repository collaborators, and more. An operating system command injection vulnerability exists in Gogs versions prior to...