80 matches found
domain-protect
domain-protect Domain Protect は現在 OWASP プロジェクト 移動先: github.com/domain-protect/domain-protect...
CVE-2022-30781
🍵 CVE-2022-30781 Gitea repository migration remote command execution exploit. How to use 1. Run an HTTP filesystem server with the files in this repository. 2. Edit the command to be exeucted in api/v1/repos/e99/exp/pulls/1/index.html L96. 3. Migrate remote repository with URL http:///e99/exp on...
cve-2026-22874-gitea-ssrf-allowlist
CVE-2026-22874 — Incomplete SSRF protection in Gitea webhook and migration allow-list Technical writeup and references for CVE-2026-22874 GHSA-2r5c-gw76-rh3w: an incomplete SSRF allow-list in Gitea's webhook delivery and repository migration, fixed in Gitea 1.26.3. I independently reported this...
raider
DEPRECATED Repository Raider has become an OWASP project, so the development will move to their Github account...
CVE-2026-82556
A flaw was found in Forgejo. A remote attacker could exploit a server-side request forgery SSRF vulnerability by manipulating the net.LookupIP function within the Repository Migration Handler. This could allow the attacker to force the server to make requests to arbitrary network resources,...
CVE-2026-82556
A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/ismigrateallowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiate...
CVE-2026-82556
Forgejo up to 15.0.4 is affected by a server-side request forgery (SSRF) vulnerability in the Repository Migration Handler . The root cause is the use of net.LookupIP in services/migrations/allowlist/is_migrate_allowed.go, where a remote attacker with low privileges can perform a manipulation to ...
EUVD-2026-68278
A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/ismigrateallowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiate...
CVE-2026-82556 Forgejo Repository Migration is_migrate_allowed.go net.LookupIP server-side request forgery
A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/ismigrateallowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiate...
CVE-2026-69104
An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue...
EUVD-2026-65521
An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue...
CVE-2026-69104
JFrog Artifactory (self-managed) is affected by an insufficient permission enforcement flaw in repository migration operations . An authenticated user with low privileges can initiate migration operations on repositories for which they lack the required permissions, potentially leading to informa...
CVE-2026-58442
Repository migration SSRF via multi-answer DNS allow-list bypass...
CVE-2026-58442
CVE-2026-58442 affects Gitea and is described as a repository migration SSRF through a multi-answer DNS allow‑list bypass. The root cause is an allow‑list bypass during repository migrations that could enable SSRF to internal destinations. The CVSS 3.1 data indicates a medium base score (6.5) wit...
CVE-2026-58442 Repository migration SSRF via multi-answer DNS allow-list bypass
Repository migration SSRF via multi-answer DNS allow-list bypass...
CVE-2026-58442 Repository migration SSRF via multi-answer DNS allow-list bypass
Repository migration SSRF via multi-answer DNS allow-list bypass...
CVE-2026-58442 Repository migration SSRF via multi-answer DNS allow-list bypass
Repository migration SSRF via multi-answer DNS allow-list bypass...
...[ More ]
A proof of concept exploit for a server-side request forgery vulnerability in Gitea version 1.26.4. The vulnerability affects repository migration functionality and results from insufficient validation of pull request patch URLs. Although Gitea validates the original migration URL against its...
SUSE CVE-2026-52805
Gogs is an open source self-hosted Git service. Prior to 0.14.3, a Server-Side Request Forgery SSRF vulnerability exists in the repository migration functionality. The application validates only the initially submitted URL hostname, but git clone --mirror follows HTTP redirects. An authenticated...