11367 matches found
Path Traversal in Git HTTP endpoints in Gogs
Impact The malicious user is able to craft HTTP requests to access unauthorized Git directories. All installations with are affected. Patches Path cleaning has accommodated for Git HTTP endpoints. Users should upgrade to 0.12.9 or the latest 0.13.0+dev. Workarounds N/A References...
GHSA-6VCC-V9VW-G2X5 Path Traversal in Git HTTP endpoints in Gogs
Impact The malicious user is able to craft HTTP requests to access unauthorized Git directories. All installations with are affected. Patches Path cleaning has accommodated for Git HTTP endpoints. Users should upgrade to 0.12.9 or the latest 0.13.0+dev. Workarounds N/A References...
CVE-2022-31038 XSS vulnerability in repository issue list in Gogs
Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 DisplayName does not filter characters input from users, which leads to an XSS vulnerability when directly displayed in the issue list. This issue has been resolved in commit 155cae1d which sanitizes DisplayName...
CVE-2022-31038 XSS vulnerability in repository issue list in Gogs
Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 DisplayName does not filter characters input from users, which leads to an XSS vulnerability when directly displayed in the issue list. This issue has been resolved in commit 155cae1d which sanitizes DisplayName...
CVE-2022-31038 XSS vulnerability in repository issue list in Gogs
Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 DisplayName does not filter characters input from users, which leads to an XSS vulnerability when directly displayed in the issue list. This issue has been resolved in commit 155cae1d which sanitizes DisplayName...
Path Traversal in Git HTTP endpoints in Gogs
Impact The malicious user is able to craft HTTP requests to access unauthorized Git directories. All installations with are affected. Patches Path cleaning has accommodated for Git HTTP endpoints. Users should upgrade to 0.12.9 or the latest 0.13.0+dev. Workarounds N/A References...
PT-2022-14238 · Gogs · Gogs
Name of the Vulnerable Software and Affected Versions: gogs/gogs versions prior to 0.12.9 Description: The issue allows a malicious user to update a crafted config file into the repository's .git directory, combined with crafted file deletion, to gain SSH access to the server. This affects all...
Exploit for Expression Language Injection in Atlassian Confluence_Data_Center
Confluence RCE CVE-2022-26134 Exploit Detection Pre-requ...
Exploit for Expression Language Injection in Atlassian Confluence_Data_Center
Confluence RCE CVE-2022-26134 Exploit Detection Pre-requ...
OS Command Injection
gitsome is vulnerable to os command injection. The vulnerability exists when initializing an unsupported git repository which allows an attacker to inject and execute arbitrary commands via crafted tag names of the repository...
Remote Code Execution (RCE)
github.com/gogs/gogs is vulnerable to remote code execution. The vulnerability exists in the isRepositoryGitPath function in repoeditor.go due to a lack of input validation in git configuration which allows an attacker to upload and execute malicious code...
OS Command Injection in gitsome
OS Command Injection vulnerability in bbultman gitsome through 0.2.3 allows attackers to execute arbitrary commands via a crafted tag name of the target git repository...
GHSA-9V73-X562-WV5X OS Command Injection in gitsome
OS Command Injection vulnerability in bbultman gitsome through 0.2.3 allows attackers to execute arbitrary commands via a crafted tag name of the target git repository...
Path Traversal vulnerability on the endpoint '/info/refs'
Summary It seems "gogs" suffers from a Path Traversal which may lead a malicious user to access another legitimate user's git config files or issue a couple of git commands on its behalf. Steps to reproduce and Proof of Concept 1. I created two users sim4n6 and sim4n62. 2. From sim4n6 dashboard...
CVE-2021-32546
Missing input validation in internal/db/repoeditor.go in Gogs before 0.12.8 allows an attacker to execute code remotely. An unprivileged attacker registered user can overwrite the Git configuration in his repository. This leads to Remote Command Execution, because that configuration can contain a...
CVE-2021-32546
Missing input validation in internal/db/repoeditor.go in Gogs before 0.12.8 allows an attacker to execute code remotely. An unprivileged attacker registered user can overwrite the Git configuration in his repository. This leads to Remote Command Execution, because that configuration can contain a...
CVE-2021-34081
OS Command Injection vulnerability in bbultman gitsome through 0.2.3 allows attackers to execute arbitrary commands via a crafted tag name of the target git repository...
CVE-2021-34081
OS Command Injection vulnerability in bbultman gitsome through 0.2.3 allows attackers to execute arbitrary commands via a crafted tag name of the target git repository...
