raider

Repository DEPRECATO Raider è diventato un progetto OWASP, quindi lo sviluppo si sposterà sul loro account Github...

CVE-2022-30781

🍵 CVE-2022-30781 Exploit de execução remota de comando na migração de repositório Gitea. Como usar 1. Execute um servidor de sistema de arquivos HTTP com os arquivos deste repositório. 2. Edite o comando a ser executado em api/v1/repos/e99/exp/pulls/1/index.html L96. 3. Migre o repositório remoto...

CVE-2026-69104

An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue...

CVE-2026-69104

JFrog Artifactory (self-managed) is affected by an insufficient permission enforcement flaw in repository migration operations . An authenticated user with low privileges can initiate migration operations on repositories for which they lack the required permissions, potentially leading to informa...

EUVD-2026-65521

An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue...

domain-protect

domain-protect Domain Protect è ora un progetto OWASP spostato su: github.com/domain-protect/domain-protect...

cve-2026-22874-gitea-ssrf-allowlist

CVE-2026-22874 — Protezione SSRF incompleta nella lista di permessi di webhook e migrazione di Gitea Descrizione tecnica e riferimenti per CVE-2026-22874 GHSA-2r5c-gw76-rh3w: una lista di permessi SSRF incompleta nella consegna dei webhook e nella migrazione dei repository di Gitea, corretta in...

CVE-2026-58442

Repository migration SSRF via multi-answer DNS allow-list bypass...

CVE-2026-58442

CVE-2026-58442 affects Gitea and is described as a repository migration SSRF through a multi-answer DNS allow‑list bypass. The root cause is an allow‑list bypass during repository migrations that could enable SSRF to internal destinations. The CVSS 3.1 data indicates a medium base score (6.5) wit...

CVE-2026-58442 Repository migration SSRF via multi-answer DNS allow-list bypass

Repository migration SSRF via multi-answer DNS allow-list bypass...

CVE-2026-58442 Repository migration SSRF via multi-answer DNS allow-list bypass

Repository migration SSRF via multi-answer DNS allow-list bypass...

CVE-2026-58442 Repository migration SSRF via multi-answer DNS allow-list bypass

Repository migration SSRF via multi-answer DNS allow-list bypass...

...[ More ]

A proof of concept exploit for a server-side request forgery vulnerability in Gitea version 1.26.4. The vulnerability affects repository migration functionality and results from insufficient validation of pull request patch URLs. Although Gitea validates the original migration URL against its...

SUSE CVE-2026-52805

Gogs is an open source self-hosted Git service. Prior to 0.14.3, a Server-Side Request Forgery SSRF vulnerability exists in the repository migration functionality. The application validates only the initially submitted URL hostname, but git clone --mirror follows HTTP redirects. An authenticated...

GO-2026-6058 Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass in gitea.dev

Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass in gitea.dev...

GO-2026-6027 Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration in gitea.dev

Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration in gitea.dev...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the handling of outbound HTTP requests for webhooks, repository migration, and OpenID sign-in due to insufficient filtering of non-routable and internal IP address ranges. An attacker can access...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the handling of outbound HTTP requests for webhooks, repository migration, and OpenID sign-in due to insufficient filtering of non-routable and internal IP address ranges. An attacker can access...

Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass

Summary Gitea's repository migration URL validation can be bypassed when a migration hostname resolves to multiple IP addresses. The validation logic accepts the destination if any resolved IP is allowed, even if another resolved IP is loopback, private, or otherwise blocked. The later git clone...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration. An attacker can access internal network resources by supplying a specially crafted DNS hostname that resolves to both allowed and blocked IP addresses, causing the validation...