CVE-2022-31038 XSS vulnerability in repository issue list in Gogs

Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 DisplayName does not filter characters input from users, which leads to an XSS vulnerability when directly displayed in the issue list. This issue has been resolved in commit 155cae1d which sanitizes DisplayName...

CVE-2021-32546

Missing input validation in internal/db/repoeditor.go in Gogs before 0.12.8 allows an attacker to execute code remotely. An unprivileged attacker registered user can overwrite the Git configuration in his repository. This leads to Remote Command Execution, because that configuration can contain a...

Gogs has an unspecified vulnerability

Gogs Go Git Service is a Go-based self-service Git hosting service , which supports creating and migrating public/private repositories , adding and removing repository collaborators and so on. A security vulnerability exists in MakeEmailPrimary in the models/usermail.go file in Gogs version...

Gogs Competitive Conditions Problem Vulnerability

Gogs Go Git Service is a Go-based self-service Git hosting service , which supports creating and migrating public/private repositories , adding and removing repository collaborators and so on. A security vulnerability exists in the internal/db/repo.go file in Gogs 0.11.91 and earlier versions. An...

PT-2019-13743 · Gogs · Gogs

Name of the Vulnerable Software and Affected Versions: Gogs version 0.11.86 Description: The issue concerns insecure permissions in Gogs, specifically affecting routes related to deploy keys, collaborators, and hooks. This is due to a lack of permission checks in the routes/api/v1/api.go file...

CVE-2018-16409

In Gogs 0.11.53, an attacker can use migrate to send arbitrary HTTP GET requests, leading to SSRF...

PT-2014-8683 · Gogs · Gogs

Name of the Vulnerable Software and Affected Versions: Gogs versions 0.3.1-9 through 0.5.x before 0.5.8 Description: The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the text parameter to the...