Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
82 results · page 2 of 2
Jul 4, 2024Gogs through 0.13.0 allows deletion of internal files.CVE-2024-39931 · Other software · gogs · reported by MITRECritical 9.9
Gogs through 0.13.0 allows deletion of internal files.
- Product
- gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsonarsource.com
Jul 4, 2024The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution.CVE-2024-39930 · Other software · gogs · reported by MITRECritical 9.9
The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the built-in SSH server is activated. Windows installations are unaffected.
- Product
- gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsonarsource.com
Oct 25, 2023Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potCVE-2023-46657 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.3
Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token.
- Product
- Jenkins Gogs Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Aug 16, 2023Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of CVE-2023-40349 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.3
Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of jobs.
- Product
- Jenkins Gogs Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Aug 16, 2023The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about the existence of jobs in its output.CVE-2023-40348 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.3
The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about the existence of jobs in its output.
- Product
- Jenkins Gogs Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Feb 25, 2023OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.CVE-2022-2024 · Other software · gogs · reported by security@huntr.devCritical 9.8
OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.
- Product
- gogs/gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover.CVE-2022-32174 · Other software · gogs · reported by vulnerabilitylab@mend.ioCritical 9
In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover.
- Product
- gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Gogs is an open source self-hosted Git service.CVE-2022-31038 · Other software · gogs · reported by GitHubMedium 5.4
Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 `DisplayName` does not filter characters input from users, which leads to an XSS vulnerability when directly displayed in the issue list. This issue has been resolved in commit 155cae1d which sanitizes `DisplayName` prior to display to the user. All users of gogs are advised to upgrade. Users unable to upgrade should check their users' display names for malicious characters.
- Product
- gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Path Traversal in GitHub repository gogs/gogs prior to 0.12.9.CVE-2022-1993 · Other software · gogs · reported by security@huntr.devHigh 8.1
Path Traversal in GitHub repository gogs/gogs prior to 0.12.9.
- Product
- gogs/gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Path Traversal in GitHub repository gogs/gogs prior to 0.12.9.CVE-2022-1992 · Other software · gogs · reported by security@huntr.devCritical 9.1
Path Traversal in GitHub repository gogs/gogs prior to 0.12.9.
- Product
- gogs/gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9.CVE-2022-1986 · Other software · gogs · reported by security@huntr.devCritical 9.8
OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9.
- Product
- gogs/gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Missing input validation in internal/db/repo_editor.go in Gogs before 0.12.8 allows an attacker to execute code remotely.CVE-2021-32546 · Other software · Gogs · reported by MITREHigh 8.8
Missing input validation in internal/db/repo_editor.go in Gogs before 0.12.8 allows an attacker to execute code remotely. An unprivileged attacker (registered user) can overwrite the Git configuration in his repository. This leads to Remote Command Execution, because that configuration can contain an option such as sshCommand, which is executed when a master branch is a remote branch (using an ssh:// URI). The remote branch can also be configured by editing the Git configuration file. One can create a new file in a new repository, using the GUI, with "\" as its name, and then rename this file to .git/config with the custom configuration content (and then save it).
- Product
- Gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2022Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.8.CVE-2022-1285 · Other software · gogs · reported by security@huntr.devMedium 6.5
Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.8.
- Product
- gogs/gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7.CVE-2022-1464 · Other software · gogs · reported by security@huntr.devMedium 5.4
Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account .
- Product
- gogs/gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2022Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.CVE-2022-0415 · Other software · gogs · reported by security@huntr.devHigh 8.8
Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.
- Product
- gogs/gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5.CVE-2022-0871 · Other software · gogs · reported by security@huntr.devCritical 9.1
Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5.
- Product
- gogs/gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5.CVE-2022-0870 · Other software · gogs · reported by security@huntr.devMedium 5.3
Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5.
- Product
- gogs/gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2020The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution.CVE-2020-15867 · Other software · Gogs · reported by MITREHigh 7.2
The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook feature is granted to a user who does not have administrative privileges. NOTE: because this is mentioned in the documentation but not in the UI, it could be considered a "Product UI does not Warn User of Unsafe Actions" issue.
- Product
- Gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comfzi.de
Jun 21, 2020In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check.CVE-2020-14958 · Other software · Gogs · reported by MITREMedium 6.5
In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check.
- Product
- Gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2020Gogs through 0.11.91 allows attackers to violate the admin-specified repo-creation policy due to an internal/db/repo.go race condition.CVE-2020-9329 · Other software · Gogs · reported by MITREMedium 5.9
Gogs through 0.11.91 allows attackers to violate the admin-specified repo-creation policy due to an internal/db/repo.go race condition.
- Product
- Gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2019routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks.CVE-2019-14544 · Other software · Gogs · reported by MITRECritical 9.8
routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks.
- Product
- Gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2019Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permissionCVE-2019-10348 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
- Product
- Jenkins Gogs Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Dec 19, 2018In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessioCVE-2018-20303 · Other software · Gogs · reported by MITREHigh 7.5
In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.
- Product
- Gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2018Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session CVE-2018-18925 · Other software · Gogs · reported by MITRECritical 9.8
Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron.
- Product
- Gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2018In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-CVE-2018-17031 · Other software · Gogs · reported by MITREMedium 6.1
In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent.
- Product
- Gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2018In Gogs 0.11.53, an attacker can use migrate to send arbitrary HTTP GET requests, leading to SSRF.CVE-2018-16409 · Other software · Gogs · reported by MITREHigh 8.6
In Gogs 0.11.53, an attacker can use migrate to send arbitrary HTTP GET requests, leading to SSRF.
- Product
- Gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2018A CSRF vulnerability in the admin panel in Gogs through 0.11.53 allows remote attackers to execute admin operations via a crafted issue / link.CVE-2018-15193 · Other software · Gogs · reported by MITREHigh 8.8
A CSRF vulnerability in the admin panel in Gogs through 0.11.53 allows remote attackers to execute admin operations via a crafted issue / link.
- Product
- Gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2018An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services.CVE-2018-15192 · Other software · Gitea · reported by MITREHigh 8.6
An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2018Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via an initial /\ sCVE-2018-15178 · Other software · Gogs · reported by MITREMedium 6.1
Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via an initial /\ substring in the user/login redirect_to parameter, related to the function isValidRedirect in routes/user/auth.go.
- Product
- Gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2014Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arCVE-2014-8683 · Other software · Gogits · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown.
- Product
- Gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgogs.iopacketstormsecurity.com
Nov 21, 2014Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQLCVE-2014-8682 · Other software · Gogits · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go.
- Product
- Gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgogs.iopacketstormsecurity.com
Nov 21, 2014SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before 0.5.6.1025 Beta allows remoCVE-2014-8681 · Other software · Gogits · reported by MITREHigh 7.5
SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before 0.5.6.1025 Beta allows remote attackers to execute arbitrary SQL commands via the label parameter to user/repos/issues.
- Product
- Gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgogs.iopacketstormsecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.