114 matches found
Fedora 42 : forgejo (2025-bac4da5419)
The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-bac4da5419 advisory. This is an upstream security and bugfix release. Please refer to the upstream release notes for versions 12.0.2 and 12.0.3 for details about changes...
[SECURITY] Fedora 43 Update: forgejo-12.0.2-1.fc43
Forgejo pronounced /for=CB=88d=CD=A1=CA=92e.jo/ is a lightweight software f orge. Use it to host git repositories, track their issues and allow people to contribute to them!...
Fedora 43 : forgejo (2025-210aed9692)
The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-210aed9692 advisory. This is an upstream bugfix release. Please refer to the upstream release notes for details about changes in this version. Tenable has extracted the preceding...
OPENSUSE-SU-2025:15389-1 forgejo-longterm-11.0.3-1.1 on GA media
These are all security issues fixed in the forgejo-longterm-11.0.3-1.1 package on the GA media of openSUSE Tumbleweed...
CVE-2023-49946
In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. This allows remote attackers to read private issues, read private pull requests, delete issues, and perform other unauthorized actions...
CVE-2023-49947
Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication...
forgejo-10.0.3-2.1 on GA media (moderate)
forgejo-10.0.3-2.1 on GA media Announcement ID: openSUSE-SU-2025:15001-1 Rating: moderate Cross-References: CVE-2025-3445 CVSS scores: CVE-2025-3445 SUSE : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be...
OPENSUSE-SU-2025:15001-1 forgejo-10.0.3-2.1 on GA media
These are all security issues fixed in the forgejo-10.0.3-2.1 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2025:14919-1 forgejo-10.0.3-1.1 on GA media
These are all security issues fixed in the forgejo-10.0.3-1.1 package on the GA media of openSUSE Tumbleweed...
forgejo-runner-6.2.2-3.1 on GA media (moderate)
forgejo-runner-6.2.2-3.1 on GA media Announcement ID: openSUSE-SU-2025:14881-1 Rating: moderate Cross-References: CVE-2025-22869 CVSS scores: CVE-2025-22869 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-22869 SUSE : 8.2...
OPENSUSE-SU-2025:14881-1 forgejo-runner-6.2.2-3.1 on GA media
These are all security issues fixed in the forgejo-runner-6.2.2-3.1 package on the GA media of openSUSE Tumbleweed...
Exploit for CVE-2024-45337
Proof of Concept exploit for CVE-2024-45337 === This repository...
FreeBSD : forgejo -- unauthorized user impersonation (25a697de-bca1-11ef-8926-9b4f2d14eb53)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 25a697de-bca1-11ef-8926-9b4f2d14eb53 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's...
FreeBSD : forgejo -- multiple vulnerabilities (5ca064a6-bca1-11ef-8926-9b4f2d14eb53)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 5ca064a6-bca1-11ef-8926-9b4f2d14eb53 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's...
FreeBSD : forgejo -- multiple vulnerabilities (6dcf6fc6-bca0-11ef-8926-9b4f2d14eb53)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 6dcf6fc6-bca0-11ef-8926-9b4f2d14eb53 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's...
forgejo -- unauthorized user impersonation
Problem Description: When Forgejo is configured to run the internal ssh server with server.STARTSSHSERVER=true, it was possible for a registered user to impersonate another user. The rootless container image uses the internal ssh server by default and was vulnerable. A Forgejo instance running fr...
forgejo -- multiple vulnerabilities
Problem Description: When Forgejo is configured to run the internal ssh server with server.STARTSSHSERVER=true, it was possible for a registered user to impersonate another user. The rootless container image uses the internal ssh server by default and was vulnerable. A Forgejo instance running fr...
FreeBSD : forgejo -- multiple vulnerabilities (f07c8f87-8e65-11ef-81b8-659bf0027d16)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the f07c8f87-8e65-11ef-81b8-659bf0027d16 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's...
forgejo -- multiple vulnerabilities
Problem Description: Forgejo generates a token which is used to authenticate web endpoints that are only meant to be used internally, for instance when the SSH daemon is used to push a commit with Git. The verification of this token was not done in constant time and was susceptible to timing...