CVE-2019-11556

CVE-2019-11556 affects Pagure prior to 5.6, enabling a cross-site scripting (XSS) flaw in the templates/blame.html blame view. Public advisories (openSUSE/Mageia) confirm patches in Pagure updates (openSUSE-2020-1765, MGASA-2021-0206) that fix the XSS vulnerability. CVSS metrics: CVSS v2 base 4.3...

CVE-2024-4982

CVE-2024-4982 affects Pagure server. The credential leakage/secret exposure arises from a directory traversal vulnerability in the view_issue_raw_file() path handling, caused by insufficient input sanitization. This can allow a remote attacker to read arbitrary server files. Public advisories (Ub...

CVE-2016-1000037

CVE-2016-1000037 is a Pagure XSS issue in the file attachment endpoint. The connected sources describe a cross-site scripting vulnerability caused by insufficient validation of client-side data in the web application, enabling potential execution of client-side code. Affected software is Pagure (...

CVE-2024-4981

The CVE-2024-4981 issue affects Pagure server and is described across multiple advisories as a vulnerability where a repository containing symbolic links can cause the server to reveal content outside the intended repository. Root cause per Debian advisory: _update_file_in_git() follows symbolic ...

CVE-2019-7628

Pagure 5.2 leaks API keys by emailing them to users due to a TLS-trusting CS mail path and insecure API token expiration reminder cron job in files/api_key_expire_mail.py. The issue enables MITM reading of emails and potential account compromise, with the root cause identified as the API key expi...

CVE-2017-1002151

Summary (CVE-2017-1002151) : Pagure 3.3.0 and earlier is vulnerable due to a failure to properly authorize, enabling an attacker to access (browse) private repositories. The credible details from connected documents indicate this is a repository hosting/web service vulnerability arising from impr...

CVE-2016-1000007

The connected records confirm a concrete vulnerability: Pagure 2.2.1 contains a Cross-Site Scripting (XSS) flaw specifically in the raw file endpoint. The NVD entry CVE-2016-1000007 documents this XSS issue, and CNVD also references Pagure 2.2.1 XSS in the same context. Public references in these...