Filtered by vendor Gogs Subscriptions
Filtered by product Gogs Subscriptions
Total 30 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2020-14958 1 Gogs 1 Gogs 2024-11-21 6.5 Medium
In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check.
CVE-2019-14544 1 Gogs 1 Gogs 2024-11-21 N/A
routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks.
CVE-2018-20303 1 Gogs 1 Gogs 2024-11-21 N/A
In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.
CVE-2018-18925 1 Gogs 1 Gogs 2024-11-21 N/A
Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron.
CVE-2018-17031 1 Gogs 1 Gogs 2024-11-21 N/A
In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent.
CVE-2018-16409 1 Gogs 1 Gogs 2024-11-21 N/A
In Gogs 0.11.53, an attacker can use migrate to send arbitrary HTTP GET requests, leading to SSRF.
CVE-2018-15193 1 Gogs 1 Gogs 2024-11-21 N/A
A CSRF vulnerability in the admin panel in Gogs through 0.11.53 allows remote attackers to execute admin operations via a crafted issue / link.
CVE-2018-15192 2 Gitea, Gogs 2 Gitea, Gogs 2024-11-21 N/A
An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services.
CVE-2018-15178 1 Gogs 1 Gogs 2024-11-21 N/A
Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via an initial /\ substring in the user/login redirect_to parameter, related to the function isValidRedirect in routes/user/auth.go.
CVE-2022-1884 2 Gogs, Microsoft 2 Gogs, Windows 2024-11-19 10 Critical
A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server. The vulnerability arises due to improper validation of the `tree_path` parameter during file uploads. An attacker can set `tree_path=.git.` to upload a file into the .git directory, allowing them to write or rewrite the `.git/config` file. If the `core.sshCommand` is set, this can lead to remote command execution.