Remote Code Execution (RCE)

gogs.io/gogs is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper handling of command-line arguments within the bundled ssh implementation internal/ssh/ssh.go. An attacker can exploit the vulnerability by sending a malicious --split-string env request through an SSH...

GHSA-HF29-9HFH-W63J Duplicate Advisory: Gogs allows argument injection during the previewing of changes

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9pp6-wq8c-3w2c. This link is maintained to preserve external references. Original Description Gogs through 0.13.0 allows argument injection during the previewing of changes...

GHSA-8MM6-WMPP-MMM3 Duplicate Advisory: Gogs allows argument injection during the tagging of a new release

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m27m-h5gj-wwmg. This link is maintained to preserve external references. Original Description Gogs through 0.13.0 allows argument injection during the tagging of a new release. This vulnerability is still unfixe...

Duplicate Advisory: Gogs allows argument injection during the tagging of a new release

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m27m-h5gj-wwmg. This link is maintained to preserve external references. Original Description Gogs through 0.13.0 allows argument injection during the tagging of a new release. This vulnerability is still unfixe...

Duplicate Advisory: Gogs allows argument injection during the previewing of changes

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9pp6-wq8c-3w2c. This link is maintained to preserve external references. Original Description Gogs through 0.13.0 allows argument injection during the previewing of changes...

GHSA-P69R-V3H4-RJ4F Duplicate Advisory: github.com/gogs/gogs affected by CVE-2024-39930

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vm62-9jw3-c8w3. This link is maintained to preserve external references. Original Description The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote co...

Duplicate Advisory: Gogs allows deletion of internal files

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-ccqv-43vm-4f3w. This link is maintained to preserve external references. Original Description Gogs through 0.13.0 allows deletion of internal files...

GHSA-2VGJ-3PVG-XH4W Duplicate Advisory: Gogs allows deletion of internal files

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-ccqv-43vm-4f3w. This link is maintained to preserve external references. Original Description Gogs through 0.13.0 allows deletion of internal files...

Duplicate Advisory: github.com/gogs/gogs affected by CVE-2024-39930

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vm62-9jw3-c8w3. This link is maintained to preserve external references. Original Description The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote co...

CVE-2024-39933

Gogs through 0.13.0 allows argument injection during the tagging of a new release...

CVE-2024-39932

Gogs through 0.13.0 allows argument injection during the previewing of changes...

CVE-2024-39931

Gogs through 0.13.0 allows deletion of internal files...

CVE-2024-39932

Gogs through 0.13.0 allows argument injection during the previewing of changes...

CVE-2024-39930

The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the built-in SSH server is activated...

CVE-2024-39933

Gogs through 0.13.0 allows argument injection during the tagging of a new release...

CVE-2024-39931

Gogs through 0.13.0 allows deletion of internal files...

CVE-2024-39932

Gogs through 0.13.0 allows argument injection during the previewing of changes...

CVE-2024-39932

CVE-2024-39932 (Gogs) : Gogs

CVE-2024-39933

CVE-2024-39933 affects the Gogs project (up to version 0.13.0). The issue is described as argument injection during the tagging of a new release, with a known patching path: upgrade to 0.13.1 or the latest 0.14.0+dev to mitigate. The connected advisories corroborate this as a Gogs vulnerability a...

CVE-2024-39931

CVE-2024-39931 affects Gogs (up to version 0.13.0). The vulnerability allows deletion of files under the .git directory, enabling remote command execution with the RUN_USER privileges. Impact is described as unprivileged users being able to access and alter code hosted on the same instance. Publi...