CVE-2019-11556

CVE-2019-11556 affects Pagure prior to 5.6, enabling a cross-site scripting (XSS) flaw in the templates/blame.html blame view. Public advisories (openSUSE/Mageia) confirm patches in Pagure updates (openSUSE-2020-1765, MGASA-2021-0206) that fix the XSS vulnerability. CVSS metrics: CVSS v2 base 4.3...

CVE-2019-11556

Pagure before 5.6 allows XSS via the templates/blame.html blame view...

CVE-2019-11556

Pagure before 5.6 allows XSS via the templates/blame.html blame view...

PT-2020-9195 · Pagure +1 · Pagure +1

Name of the Vulnerable Software and Affected Versions: Pagure versions prior to 5.6 Description: The issue allows for XSS via the templates/blame.html blame view. Recommendations: For versions prior to 5.6, update to version 5.6 or later to resolve the issue...

Pagure Cross-Site Scripting Vulnerability (CNVD-2020-17195)

Pagure is a Git repository written in Python to provide Web services. Pagure suffers from a cross-site scripting vulnerability. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerability to execute client-side cod...

CVE-2016-1000037

Pagure: XSS possible in file attachment endpoint...

CVE-2016-1000037

Pagure: XSS possible in file attachment endpoint...

Default credentials

Pagure: XSS possible in file attachment endpoint...

CVE-2016-1000037

Pagure: XSS possible in file attachment endpoint...

CVE-2016-1000037

CVE-2016-1000037 is a Pagure XSS issue in the file attachment endpoint. The connected sources describe a cross-site scripting vulnerability caused by insufficient validation of client-side data in the web application, enabling potential execution of client-side code. Affected software is Pagure (...

CVE-2016-1000037

Pagure: XSS possible in file attachment endpoint...

go-toolset:rhel8 security update

go-toolset 1.11.5-2 - Include patch to fix CVE-2019-9741 - Resolves: rhbz1690443 golang 1.11.5-2 - Include patch to fix CVE-2019-9741 - Resolves: rhbz1690443 1.11.5-2 - Switch to pagure fork for Go FIPS...

Fedora Update for pagure FEDORA-2019-4e72b179e4

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora 29 : pagure (2019-4e72b179e4)

Update to Pagure 5.3, which includes the fix for CVE-2019-7628. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

[SECURITY] Fedora 29 Update: pagure-5.3-1.fc29

Pagure is a light-weight git-centered forge based on pygit2. Currently, Pagure offers a web-interface for git repositories, a ticket system and possibilities to create new projects, fork existing ones and create/merge pull-requests across or within projects...

Design/Logic Flaw

Pagure 5.2 leaks API keys by e-mailing them to users. Few e-mail servers validate TLS certificates, so it is easy for man-in-the-middle attackers to read these e-mails and gain access to Pagure on behalf of other users. This issue is found in the API token expiration reminder cron job in...

CVE-2019-7628

Pagure 5.2 leaks API keys by e-mailing them to users. Few e-mail servers validate TLS certificates, so it is easy for man-in-the-middle attackers to read these e-mails and gain access to Pagure on behalf of other users. This issue is found in the API token expiration reminder cron job in...

CVE-2019-7628

Pagure 5.2 leaks API keys by e-mailing them to users. Few e-mail servers validate TLS certificates, so it is easy for man-in-the-middle attackers to read these e-mails and gain access to Pagure on behalf of other users. This issue is found in the API token expiration reminder cron job in...

CVE-2019-7628

Pagure 5.2 leaks API keys by emailing them to users due to a TLS-trusting CS mail path and insecure API token expiration reminder cron job in files/api_key_expire_mail.py. The issue enables MITM reading of emails and potential account compromise, with the root cause identified as the API key expi...

CVE-2019-7628

Pagure 5.2 leaks API keys by e-mailing them to users. Few e-mail servers validate TLS certificates, so it is easy for man-in-the-middle attackers to read these e-mails and gain access to Pagure on behalf of other users. This issue is found in the API token expiration reminder cron job in...