Authorization

Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5...

CVE-2022-0870

Server-Side Request Forgery SSRF in GitHub repository gogs/gogs prior to 0.12.5...

CVE-2022-0870

Server-Side Request Forgery SSRF in GitHub repository gogs/gogs prior to 0.12.5...

Server side request forgery (ssrf)

Server-Side Request Forgery SSRF in GitHub repository gogs/gogs prior to 0.12.5...

CVE-2022-0870 Server-Side Request Forgery (SSRF) in gogs/gogs

Server-Side Request Forgery SSRF in GitHub repository gogs/gogs prior to 0.12.5...

CVE-2022-0870

Server-Side Request Forgery SSRF in GitHub repository gogs/gogs prior to 0.12.5...

CVE-2022-0870

Gogs (gogs/gogs) prior to version 0.12.5 is affected by a Server-Side Request Forgery (SSRF) vulnerability in the repository migration logic. The issue enables an attacker to trigger SSRF via the affected migration pathway, with reachable impact limited to information exposure or unauthorized int...

CVE-2022-0870 Server-Side Request Forgery (SSRF) in gogs/gogs

Server-Side Request Forgery SSRF in GitHub repository gogs/gogs prior to 0.12.5...

CVE-2022-0871

CVE-2022-0871 affects Gogs (gogs/gogs) prior to 0.12.5 and is described as Missing Authorization. Connected advisories/documents consistently describe improper PAM authorization handling as the root cause and indicate that updated builds fix the issue, recommending upgrading to 0.12.5 or (for new...

PT-2022-13488 · Gogs · Gogs

Name of the Vulnerable Software and Affected Versions: gogs versions prior to 0.12.5 Description: The issue is related to Server-Side Request Forgery SSRF in the repository migration functionality of gogs. This allows a malicious user to discover services in the internal network. All installation...

CVE-2022-0871 Missing Authorization in gogs/gogs

Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5...

PT-2022-13489 · Gogs · Gogs

Name of the Vulnerable Software and Affected Versions: gogs versions prior to 0.12.5 Description: The issue concerns improper authorization handling in installations that use PAM as authentication sources. Expired PAM accounts and accounts with expired passwords are continued to be seen as valid...

Gogs 安全漏洞

Gogs Go Git Service is a self-service Git hosting service based on the Go language by the GOGS team, which supports creating and migrating public/private repositories, adding and deleting repository collaborators, and so on. A security vulnerability exists in Gogs versions prior to 0.12.5, which...

CVE-2022-0871 Missing Authorization in gogs/gogs

Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5...

CVE-2022-0871

Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5...

Improper Authorization

Description When Gogs is build and configured for PAM authentification it skips checking authorization completely. Therefore expired accounts and accounts with expired passwords can still login. Proof of Concept You can expire an account with chage -E0 and still login. Impact Since disabling an...

Exploit for Session Fixation in Gogs

CVE-2018-18925 Exploitation of CVE-2018-18925 a Remote Code Ex...

Server-Side Request Forgery (SSRF) in gogs/gogs

✍️ Description In 2018, this issue was created to address a SSRF vulnerability in gogs wherein an attacker could have gogs send requests to network-internal hosts - a patch for this was released see diff and no queries about the SSRF issue seem to have been raised again since from what I can tell...

GHSA-9HX4-QM7H-X84J Cross-site Scripting in Gogs

Cross-site scripting XSS vulnerability in models/issue.go in Gogs aka Go Git Service 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown...

Cross-site Scripting in Gogs

Cross-site scripting XSS vulnerability in models/issue.go in Gogs aka Go Git Service 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown...