80 matches found
cve-2026-22874-gitea-ssrf-allowlist
CVE-2026-22874 — Incomplete SSRF protection in Gitea webhook and migration allow-list Technical writeup and references for CVE-2026-22874 GHSA-2r5c-gw76-rh3w: an incomplete SSRF allow-list in Gitea's webhook delivery and repository migration, fixed in Gitea 1.26.3. I independently reported this...
domain-protect
domain-protect Domain Protect es ahora un proyecto OWASP trasladado a: github.com/domain-protect/domain-protect...
raider
已弃用仓库 Raider 已成为一个 OWASP 项目，因此开发将迁移到他们的 GitHub 账户。...
CVE-2022-30781
🍵 CVE-2022-30781 Exploit de ejecución remota de comandos en la migración de repositorios de Gitea. Cómo usar 1. Ejecuta un servidor HTTP del sistema de archivos con los archivos de este repositorio. 2. Edita el comando a ejecutar en api/v1/repos/e99/exp/pulls/1/index.html L96. 3. Migra el...
CVE-2026-82556
A flaw was found in Forgejo. A remote attacker could exploit a server-side request forgery SSRF vulnerability by manipulating the net.LookupIP function within the Repository Migration Handler. This could allow the attacker to force the server to make requests to arbitrary network resources,...
CVE-2026-82556
A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/ismigrateallowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiate...
CVE-2026-82556
Forgejo up to 15.0.4 is affected by a server-side request forgery (SSRF) vulnerability in the Repository Migration Handler . The root cause is the use of net.LookupIP in services/migrations/allowlist/is_migrate_allowed.go, where a remote attacker with low privileges can perform a manipulation to ...
EUVD-2026-68278
A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/ismigrateallowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiate...
CVE-2026-82556 Forgejo Repository Migration is_migrate_allowed.go net.LookupIP server-side request forgery
A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/ismigrateallowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiate...
CVE-2026-69104
An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue...
EUVD-2026-65521
An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue...
CVE-2026-69104
JFrog Artifactory (self-managed) is affected by an insufficient permission enforcement flaw in repository migration operations . An authenticated user with low privileges can initiate migration operations on repositories for which they lack the required permissions, potentially leading to informa...
CVE-2026-58442
Repository migration SSRF via multi-answer DNS allow-list bypass...
CVE-2026-58442 Repository migration SSRF via multi-answer DNS allow-list bypass
Repository migration SSRF via multi-answer DNS allow-list bypass...
CVE-2026-58442 Repository migration SSRF via multi-answer DNS allow-list bypass
Repository migration SSRF via multi-answer DNS allow-list bypass...
CVE-2026-58442
CVE-2026-58442 affects Gitea and is described as a repository migration SSRF through a multi-answer DNS allow‑list bypass. The root cause is an allow‑list bypass during repository migrations that could enable SSRF to internal destinations. The CVSS 3.1 data indicates a medium base score (6.5) wit...
CVE-2026-58442 Repository migration SSRF via multi-answer DNS allow-list bypass
Repository migration SSRF via multi-answer DNS allow-list bypass...
...[ More ]
A proof of concept exploit for a server-side request forgery vulnerability in Gitea version 1.26.4. The vulnerability affects repository migration functionality and results from insufficient validation of pull request patch URLs. Although Gitea validates the original migration URL against its...
SUSE CVE-2026-52805
Gogs is an open source self-hosted Git service. Prior to 0.14.3, a Server-Side Request Forgery SSRF vulnerability exists in the repository migration functionality. The application validates only the initially submitted URL hostname, but git clone --mirror follows HTTP redirects. An authenticated...