gogs.io/gogs vulnerabilities (Go)
77 vulnerabilities.
-
gogs.io/gogsGo Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS 5.4 Medium -
gogs.io/gogsGo Gogs: Unauthenticated Organization Teams Information Disclosure via API 5.5 Medium -
gogs.io/gogsGo Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion) 5.5 Medium -
gogs.io/gogsGo Gogs: Path Traversal in organization name results in RCE through Git hooks 10.0 Critical -
gogs.io/gogsGo Gogs: LFS dedupe path leaks private repo content across tenants 7.1 High -
gogs.io/gogsGo Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym 9.0 Critical -
gogs.io/gogsGo Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion 7.1 High -
gogs.io/gogsGo In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a... 7.1 High -
gogs.io/gogsGo Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES 6.8 Medium -
gogs.io/gogsGo Gogs: Write-level collaborators can mutate admin-only repository settings via API 7.1 High -
gogs.io/gogsGo Gogs: DOM-based XSS via Milestone Name on New Issue Page 4.8 Medium -
gogs.io/gogsGo Gogs: RCE via git rebase --exec argument injection in pull request merge 9.9 Critical -
gogs.io/gogsGo Gogs: Migration Redirect Bypass Leads to Internal Repository Theft 8.7 High -
gogs.io/gogsGo Gogs: Privilege Escalation via Collaboration Access Mode Validation 5.5 Medium -
gogs.io/gogsGo Gogs: Open Redirect via redirect_to in Gogs 5.4 Medium -
gogs.io/gogsGo Gogs: Ability to import local repositories via Mirror Settings 8.1 High -
gogs.io/gogsGo Gogs: CSRF Leading to Organization Owner Takeover 8.8 High -
gogs.io/gogsGo Gogs: Missing Authorization in Attachment Download 7.5 High -
gogs.io/gogsGo Gogs: Stored XSS in `.ipynb` Preview 8.9 High -
gogs.io/gogsGo Gogs: DoS in rendering issue index pattern 3.5 Low -
gogs.io/gogsGo Gogs: SSRF in webhook deliveries 8.3 High -
gogs.io/gogsGo Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers 7.7 High -
gogs.io/gogsGo Gogs: Denial of Service in repository/wiki file listing web pages 4.9 Medium -
gogs.io/gogsGo Gogs: XSS in .ipynb files renderer due to outdated notebookjs 8.5 High -
gogs.io/gogsGo Gogs: Overwriting critical files results in a denial of service 8.5 High -
gogs.io/gogsGo Gogs: DOM-based XSS via milestone selection 7.3 High -
gogs.io/gogsGo Gogs: Access tokens get exposed through URL params in API requests 6.9 Medium -
gogs.io/gogsGo Gogs: Stored XSS in branch and wiki views through author and committer names 6.9 Medium -
gogs.io/gogsGo Gogs: Release tag option injection in release deletion 8.8 High -
gogs.io/gogsGo Gogs: Cross-repository LFS object overwrite via missing content hash verification 9.3 Critical -
gogs.io/gogsGo Gogs: Stored XSS via data URI in issue comments 8.7 High -
gogs.io/gogsGo Gogs allows unauthenticated file uploads 6.9 Medium -
gogs.io/gogsGo Gogs has a Protected Branch Deletion Bypass in Web Interface 7.1 High -
gogs.io/gogsGo Gogs Authorization Bypass Allows Cross-Repository Label Modification 5.3 Medium -
gogs.io/gogsGo Gogs Allows Cross-Repository Comment Deletion via DeleteComment 5.1 Medium -
gogs.io/gogsGo Gogs has authorization bypass in repository deletion API 5.7 Medium -
gogs.io/gogsGo Gogs vulnerable to Stored XSS via Mermaid diagrams 7.3 High -
gogs.io/gogsGo Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update 7.2 High -
gogs.io/gogsGo Gogs has arbitrary file read/write via path traversal in Git hook editing 6.5 Medium -
gogs.io/gogsGo Gogs user can update repository content with read-only permission 6.5 Medium -
gogs.io/gogsGo Gogs is Vulnerable to Denial of Service 6.5 Medium -
gogs.io/gogsGo Gogs Vulnerable to 2FA Bypass via Recovery Code 7.7 High -
gogs.io/gogsGo Gogs's update .git/config file allows remote command execution 9.3 Critical -
gogs.io/gogsGo File overwrite in file update API in Gogs 8.7 High -
gogs.io/gogsGo Gogs stored XSS in PDF renderer 6.3 Medium -
gogs.io/gogsGo Gogs deletion of internal files allows remote command execution 10.0 Critical -
gogs.io/gogsGo Gogs has a Path Traversal in file update API 8.7 High -
gogs.io/gogsGo Gogs has a Path Traversal in file editing UI 8.7 High -
gogs.io/gogsGo Remote Code Execution in Gogs 8.8 High -
gogs.io/gogsGo Duplicate Advisory: Gogs allows argument injection during the tagging of a new release 7.7 High - Show olderLoading…