18 matches found
CVE-2022-31038
Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 DisplayName does not filter characters input from users, which leads to an XSS vulnerability when directly displayed in the issue list. This issue has been resolved in commit 155cae1d which sanitizes DisplayName...
CVE-2024-39931
Gogs through 0.13.0 allows deletion of internal files...
EUVD-2021-0961
Malware in sbrugna...
Gogs allows deletion of internal files which leads to remote command execution
Summary Due to the insufficient patch for the CVE-2024-39931, it's still possible to delete files under the .git directory and achieve remote command execution. Details In the patch for CVE-2024-39931, the following check is added:...
CVE-2022-2024
OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11...
GHSA-QF5V-RP47-55GG Path Traversal in file update API in gogs
Impact The malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. Patches Writing files outside repository Git directory has been prohibited via the repository file update API https://github.com/gogs/gogs/pull/7859. Users should upgrade to 0.13...
Path Traversal in file update API in gogs
Impact The malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. Patches Writing files outside repository Git directory has been prohibited via the repository file update API https://github.com/gogs/gogs/pull/7859. Users should upgrade to 0.13...
GHSA-R7J8-5H9C-F6FX Remote Command Execution in file editing in gogs
Impact The malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server. Patches Editing symlink while changing the file name has been prohibited via the repository web editor https://github.com/gogs/gogs/pull/7857. Users should upgrade to 0.13...
CVE-2024-54148
Gogs is an open source self-hosted Git service. A malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server. The vulnerability is fixed in 0.13.1...
CVE-2024-39931
Gogs through 0.13.0 allows deletion of internal files...
CVE-2024-39933
Gogs through 0.13.0 allows argument injection during the tagging of a new release...
CVE-2024-39932
Gogs through 0.13.0 allows argument injection during the previewing of changes...
CVE-2024-39932
CVE-2024-39932 (Gogs) : Gogs
Insecure Permissions in Gogs
In Gogs 0.11.91, MakeEmailPrimary in models/usermail.go lacks a "not the owner of the email" check...
GHSA-4C7M-VV47-7C69 Insecure Permissions in Gogs
In Gogs 0.11.91, MakeEmailPrimary in models/usermail.go lacks a "not the owner of the email" check...
CVE-2020-14958
In Gogs 0.11.91, MakeEmailPrimary in models/usermail.go lacks a "not the owner of the email" check...
Race condition
Gogs through 0.11.91 allows attackers to violate the admin-specified repo-creation policy due to an internal/db/repo.go race condition...
CVE-2019-14544
routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks...