GHSA-8MM6-WMPP-MMM3 Duplicate Advisory: Gogs allows argument injection during the tagging of a new release

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m27m-h5gj-wwmg. This link is maintained to preserve external references. Original Description Gogs through 0.13.0 allows argument injection during the tagging of a new release. This vulnerability is still unfixe...

Duplicate Advisory: Gogs allows argument injection during the previewing of changes

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9pp6-wq8c-3w2c. This link is maintained to preserve external references. Original Description Gogs through 0.13.0 allows argument injection during the previewing of changes...

Duplicate Advisory: Gogs allows argument injection during the tagging of a new release

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m27m-h5gj-wwmg. This link is maintained to preserve external references. Original Description Gogs through 0.13.0 allows argument injection during the tagging of a new release. This vulnerability is still unfixe...

GHSA-P69R-V3H4-RJ4F Duplicate Advisory: github.com/gogs/gogs affected by CVE-2024-39930

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vm62-9jw3-c8w3. This link is maintained to preserve external references. Original Description The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote co...

CVE-2024-39933

Gogs through 0.13.0 allows argument injection during the tagging of a new release...

CVE-2024-39932

Gogs through 0.13.0 allows argument injection during the previewing of changes...

CVE-2024-39932

Gogs through 0.13.0 allows argument injection during the previewing of changes...

CVE-2024-39933

Gogs through 0.13.0 allows argument injection during the tagging of a new release...

CVE-2024-39930

The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the built-in SSH server is activated...

CVE-2024-39932

Gogs through 0.13.0 allows argument injection during the previewing of changes...

CVE-2024-39933

CVE-2024-39933 affects the Gogs project (up to version 0.13.0). The issue is described as argument injection during the tagging of a new release, with a known patching path: upgrade to 0.13.1 or the latest 0.14.0+dev to mitigate. The connected advisories corroborate this as a Gogs vulnerability a...

CVE-2024-39933

Gogs through 0.13.0 allows argument injection during the tagging of a new release...

CVE-2024-39930

The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the built-in SSH server is activated...

CVE-2024-39933

Gogs through 0.13.0 allows argument injection during the tagging of a new release...

CVE-2024-39930

CVE-2024-39930 affects the built-in SSH server in Gogs up to version 0.13.0, where argument injection in internal/ssh/ssh.go can lead to remote code execution when an authenticated user opens an SSH session and sends a malicious --split-string env request (Windows builds are unaffected). Public d...

CVE-2024-39933

Gogs through 0.13.0 allows argument injection during the tagging of a new release...

CVE-2024-39932

Gogs through 0.13.0 allows argument injection during the previewing of changes...

CVE-2024-39930

The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the built-in SSH server is activated...

CVE-2024-39932

Gogs through 0.13.0 allows argument injection during the previewing of changes...

CVE-2024-39930

The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the built-in SSH server is activated...