1170 matches found
CVE-2022-0415
Gogs (Go Git Service) before version 0.12.6 is vulnerable to Remote Command Execution via uploading a repository file. The issue allows an attacker to execute arbitrary commands on the server through the repository upload process in gogs/gogs, potentially leading to full system compromise. The fi...
gogs 代码问题漏洞
Gogs Go Git Service is a self-service Git hosting service based on the Go language by the GOGS team, which supports creating and migrating public/private repositories, adding and deleting repository collaborators, and so on. A security vulnerability exists in versions prior to gogs 0.12.6, which...
PT-2022-13166 · Gogs · Gogs
Name of the Vulnerable Software and Affected Versions: gogs versions prior to 0.12.6 Description: The issue allows a malicious user to upload a crafted config file into a repository's .git directory to gain SSH access to the server. This affects all installations with repository upload enabled,...
Gogs < 0.12.5 Multiple Vulnerabilities
Gogs is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribu...
GHSA-GW5H-H6HJ-F56G Gogs vulnerable to improper PAM authorization handling
Impact Expired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use PAM as authentication sources are affected. Patches Expired PAM accounts and accounts with expired passwords are no longer being seen as valid. Users should upgrade to 0.12.5 or th...
Gogs vulnerable to improper PAM authorization handling
Impact Expired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use PAM as authentication sources are affected. Patches Expired PAM accounts and accounts with expired passwords are no longer being seen as valid. Users should upgrade to 0.12.5 or th...
SSRF in repository migration
Impact The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected. Patches Internal network CIDRs are prohibited to be used as repository migration targets. Users should upgrade to...
GHSA-Q347-CG56-PCQ4 SSRF in repository migration
Impact The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected. Patches Internal network CIDRs are prohibited to be used as repository migration targets. Users should upgrade to...
Authorization Bypass
github.com/gogs/gogs is vulnerable to authorization bypass. When gogs is built and configured for PAM authentification, the library does not properly validate the authorization of the accounts, allowing an attacker to access expired accounts...
Server-side Request Forgery (SSRF)
github.com/gogs/gogs is vulnerable to server-side request forgery. An attacker can send malicious requests on behalf of the server into the network-internal hosts through the ParseRemoteAddr function of repo.go...
SSRF in repository migration
Impact The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected. Patches Internal network CIDRs are prohibited to be used as repository migration targets. Users should upgrade to...
Improper Authorization in Gogs
Impact Expired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use PAM as authentication sources are affected. Patches Expired PAM accounts and accounts with expired passwords are no longer being seen as valid. Users should upgrade to 0.12.5 or th...
GHSA-7V5R-R995-Q2X2 SSRF in repository migration
Gogs is a self-hosted Git service. The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected. Internal network CIDRs are prohibited to be used as repository migration targets. Users...
SSRF in repository migration
Gogs is a self-hosted Git service. The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected. Internal network CIDRs are prohibited to be used as repository migration targets. Users...
GHSA-65F3-3278-7M65 Duplicate Advisory: Improper Authorization in Gogs
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gw5h-h6hj-f56g. This link is maintained to preserve external references. Original Description Impact Expired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use...
Improper Authorization in Gogs
Improper Authorization in GitHub repository gogs/gogs prior to 0.12.5...
SSRF in repository migration
Server-Side Request Forgery SSRF in GitHub repository gogs/gogs prior to 0.12.5...
Remote Command Execution in uploading repository file
Description When uploading a file to the repository in Gogs, the treepath parameter is not been validated. The attacker can set treepath=/.git/ to upload file into the .git directory. Rewrite .git/config file and set core.sshCommand, which leads to remote command execution vulnerability. Proof of...
