gogs.io/gogs

Gogs has an Open Redirect via redirect_to in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion) in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has the ability to import local repositories via Mirror Settings in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has DOM-based XSS via Milestone Name on New Issue Page in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs Missing Authorization in Attachment Download in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: Overwriting critical files results in a denial of service in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.0.

Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs Vulnerable to CSRF Leading to Organization Owner Takeover in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs's write-level collaborators can mutate admin-only repository settings via API in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has Stored XSS in .ipynb Preview in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has a Migration Redirect Bypass that Leads to Internal Repository Theft in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has SSRF in webhook deliveries in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has Path Traversal in organization name that results in RCE through Git hooks in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: XSS in .ipynb files renderer due to outdated notebookjs in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via API in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: LFS dedupe path leaks private repo content across tenants in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has a Denial of Service in repository/wiki file listing web pages in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs's password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has DoS in rendering issue index pattern in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: Cross-repository LFS object overwrite via missing content hash verification in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.2.

Gogs: Stored XSS in branch and wiki views through author and committer names in gogs.io/gogs

Gogs: DOM-based XSS via milestone selection in gogs.io/gogs

Gogs: Stored XSS via data URI in issue comments in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.2.

Gogs: Release tag option injection in release deletion in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.2.

Gogs: Access tokens get exposed through URL params in API requests in gogs.io/gogs

Gogs has an Authorization Bypass Allows Cross-Repository Label Modification in Gogs in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.0.

Gogs has a Protected Branch Deletion Bypass in Web Interface in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.1.

Gogs Allows Cross-Repository Comment Deletion via DeleteComment in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.0.

Unauthenticated File Upload in Gogs in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.1.

Gogs user can update repository content with read-only permission in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs vulnerable to Stored XSS via Mermaid diagrams in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs Vulnerable to 2FA Bypass via Recovery Code in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs has arbitrary file read/write via Path Traversal in Git hook editing in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs vulnerable to arbitrary file deletion via Path Traversal in wiki page update in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs has authorization bypass in repository deletion API in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs's update .git/config file allows remote command execution in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs has a Denial of Service issue in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs vulnerable to a bypass of CVE-2024-55947 in gogs.io/gogs

Unpatched Remote Code Execution in Gogs in gogs.io/gogs

Gogs vulnerable to Cross-site Scripting in gogs.io/gogs

Gogs has an Open Redirect via redirect_to in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion) in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has the ability to import local repositories via Mirror Settings in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has DOM-based XSS via Milestone Name on New Issue Page in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs Missing Authorization in Attachment Download in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: Overwriting critical files results in a denial of service in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.0.

Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs Vulnerable to CSRF Leading to Organization Owner Takeover in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs's write-level collaborators can mutate admin-only repository settings via API in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has Stored XSS in .ipynb Preview in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has a Migration Redirect Bypass that Leads to Internal Repository Theft in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has SSRF in webhook deliveries in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has Path Traversal in organization name that results in RCE through Git hooks in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: XSS in .ipynb files renderer due to outdated notebookjs in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via API in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: LFS dedupe path leaks private repo content across tenants in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has a Denial of Service in repository/wiki file listing web pages in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs's password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has DoS in rendering issue index pattern in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: Cross-repository LFS object overwrite via missing content hash verification in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.2.

Gogs: Stored XSS in branch and wiki views through author and committer names in gogs.io/gogs

Gogs: DOM-based XSS via milestone selection in gogs.io/gogs

Gogs: Stored XSS via data URI in issue comments in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.2.

Gogs: Release tag option injection in release deletion in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.2.

Gogs: Access tokens get exposed through URL params in API requests in gogs.io/gogs

Gogs has an Authorization Bypass Allows Cross-Repository Label Modification in Gogs in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.0.

Gogs has a Protected Branch Deletion Bypass in Web Interface in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.1.

Gogs Allows Cross-Repository Comment Deletion via DeleteComment in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.0.

Unauthenticated File Upload in Gogs in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.1.

Gogs user can update repository content with read-only permission in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs vulnerable to Stored XSS via Mermaid diagrams in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs Vulnerable to 2FA Bypass via Recovery Code in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs has arbitrary file read/write via Path Traversal in Git hook editing in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs vulnerable to arbitrary file deletion via Path Traversal in wiki page update in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs has authorization bypass in repository deletion API in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs's update .git/config file allows remote command execution in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs has a Denial of Service issue in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs vulnerable to a bypass of CVE-2024-55947 in gogs.io/gogs

Gogs allows deletion of internal files which leads to remote command execution in gogs.io/gogs

Unpatched Remote Code Execution in Gogs in gogs.io/gogs

Gogs vulnerable to Cross-site Scripting in gogs.io/gogs

Gogs has an Open Redirect via redirect_to in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion) in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has the ability to import local repositories via Mirror Settings in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has DOM-based XSS via Milestone Name on New Issue Page in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs Missing Authorization in Attachment Download in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: Overwriting critical files results in a denial of service in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.0.

Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs Vulnerable to CSRF Leading to Organization Owner Takeover in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs's write-level collaborators can mutate admin-only repository settings via API in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has Stored XSS in .ipynb Preview in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has a Migration Redirect Bypass that Leads to Internal Repository Theft in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has SSRF in webhook deliveries in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has Path Traversal in organization name that results in RCE through Git hooks in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: XSS in .ipynb files renderer due to outdated notebookjs in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via API in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: LFS dedupe path leaks private repo content across tenants in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has a Denial of Service in repository/wiki file listing web pages in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs's password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has DoS in rendering issue index pattern in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: Cross-repository LFS object overwrite via missing content hash verification in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.2.

Gogs: Stored XSS in branch and wiki views through author and committer names in gogs.io/gogs

Gogs: DOM-based XSS via milestone selection in gogs.io/gogs

Gogs: Stored XSS via data URI in issue comments in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.2.

Gogs: Release tag option injection in release deletion in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.2.

Gogs: Access tokens get exposed through URL params in API requests in gogs.io/gogs

Gogs has an Authorization Bypass Allows Cross-Repository Label Modification in Gogs in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.0.

Gogs has a Protected Branch Deletion Bypass in Web Interface in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.1.

Gogs Allows Cross-Repository Comment Deletion via DeleteComment in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.0.

Unauthenticated File Upload in Gogs in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.1.

Gogs user can update repository content with read-only permission in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs vulnerable to Stored XSS via Mermaid diagrams in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs Vulnerable to 2FA Bypass via Recovery Code in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs has arbitrary file read/write via Path Traversal in Git hook editing in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs vulnerable to arbitrary file deletion via Path Traversal in wiki page update in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs has authorization bypass in repository deletion API in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs's update .git/config file allows remote command execution in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs has a Denial of Service issue in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs vulnerable to a bypass of CVE-2024-55947 in gogs.io/gogs

Gogs XSS allowed by stored call in PDF renderer in gogs.io/gogs

Gogs allows deletion of internal files which leads to remote command execution in gogs.io/gogs

Unpatched Remote Code Execution in Gogs in gogs.io/gogs

Gogs vulnerable to Cross-site Scripting in gogs.io/gogs

Gogs has an Open Redirect via redirect_to in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion) in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has the ability to import local repositories via Mirror Settings in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has DOM-based XSS via Milestone Name on New Issue Page in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs Missing Authorization in Attachment Download in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: Overwriting critical files results in a denial of service in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.0.

Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs Vulnerable to CSRF Leading to Organization Owner Takeover in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs's write-level collaborators can mutate admin-only repository settings via API in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has Stored XSS in .ipynb Preview in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has a Migration Redirect Bypass that Leads to Internal Repository Theft in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has SSRF in webhook deliveries in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has Path Traversal in organization name that results in RCE through Git hooks in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: XSS in .ipynb files renderer due to outdated notebookjs in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via API in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: LFS dedupe path leaks private repo content across tenants in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has a Denial of Service in repository/wiki file listing web pages in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs's password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has DoS in rendering issue index pattern in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: Cross-repository LFS object overwrite via missing content hash verification in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.2.

Gogs: Stored XSS in branch and wiki views through author and committer names in gogs.io/gogs

Gogs: DOM-based XSS via milestone selection in gogs.io/gogs

Gogs: Stored XSS via data URI in issue comments in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.2.

Gogs: Release tag option injection in release deletion in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.2.

Gogs: Access tokens get exposed through URL params in API requests in gogs.io/gogs

Gogs has an Authorization Bypass Allows Cross-Repository Label Modification in Gogs in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.0.

Gogs has a Protected Branch Deletion Bypass in Web Interface in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.1.

Gogs Allows Cross-Repository Comment Deletion via DeleteComment in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.0.

Unauthenticated File Upload in Gogs in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.1.

Gogs user can update repository content with read-only permission in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs vulnerable to Stored XSS via Mermaid diagrams in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs Vulnerable to 2FA Bypass via Recovery Code in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs has arbitrary file read/write via Path Traversal in Git hook editing in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs vulnerable to arbitrary file deletion via Path Traversal in wiki page update in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs has authorization bypass in repository deletion API in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs's update .git/config file allows remote command execution in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs has a Denial of Service issue in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs vulnerable to a bypass of CVE-2024-55947 in gogs.io/gogs

Gogs XSS allowed by stored call in PDF renderer in gogs.io/gogs

Gogs allows deletion of internal files which leads to remote command execution in gogs.io/gogs

Unpatched Remote Code Execution in Gogs in gogs.io/gogs

Gogs vulnerable to Cross-site Scripting in gogs.io/gogs

Gogs has an Open Redirect via redirect_to in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion) in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has the ability to import local repositories via Mirror Settings in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has DOM-based XSS via Milestone Name on New Issue Page in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs Missing Authorization in Attachment Download in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: Overwriting critical files results in a denial of service in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.0.

Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs Vulnerable to CSRF Leading to Organization Owner Takeover in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs's write-level collaborators can mutate admin-only repository settings via API in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has Stored XSS in .ipynb Preview in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has a Migration Redirect Bypass that Leads to Internal Repository Theft in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has SSRF in webhook deliveries in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has Path Traversal in organization name that results in RCE through Git hooks in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: XSS in .ipynb files renderer due to outdated notebookjs in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via API in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: LFS dedupe path leaks private repo content across tenants in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has a Denial of Service in repository/wiki file listing web pages in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs's password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has DoS in rendering issue index pattern in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: Cross-repository LFS object overwrite via missing content hash verification in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.2.

Gogs: Stored XSS in branch and wiki views through author and committer names in gogs.io/gogs

Gogs: DOM-based XSS via milestone selection in gogs.io/gogs

Gogs: Stored XSS via data URI in issue comments in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.2.

Gogs: Release tag option injection in release deletion in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.2.

Gogs: Access tokens get exposed through URL params in API requests in gogs.io/gogs

Gogs has an Authorization Bypass Allows Cross-Repository Label Modification in Gogs in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.0.

Gogs has a Protected Branch Deletion Bypass in Web Interface in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.1.

Gogs Allows Cross-Repository Comment Deletion via DeleteComment in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.0.

Unauthenticated File Upload in Gogs in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.1.

Gogs user can update repository content with read-only permission in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs vulnerable to Stored XSS via Mermaid diagrams in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs Vulnerable to 2FA Bypass via Recovery Code in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs has arbitrary file read/write via Path Traversal in Git hook editing in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs vulnerable to arbitrary file deletion via Path Traversal in wiki page update in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs has authorization bypass in repository deletion API in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs's update .git/config file allows remote command execution in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs has a Denial of Service issue in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs vulnerable to a bypass of CVE-2024-55947 in gogs.io/gogs

Gogs XSS allowed by stored call in PDF renderer in gogs.io/gogs

Gogs allows deletion of internal files which leads to remote command execution in gogs.io/gogs

Unpatched Remote Code Execution in Gogs in gogs.io/gogs

Gogs vulnerable to Cross-site Scripting in gogs.io/gogs

Gogs has an Open Redirect via redirect_to in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion) in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has the ability to import local repositories via Mirror Settings in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has DOM-based XSS via Milestone Name on New Issue Page in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs Missing Authorization in Attachment Download in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: Overwriting critical files results in a denial of service in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.0.

Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs Vulnerable to CSRF Leading to Organization Owner Takeover in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs's write-level collaborators can mutate admin-only repository settings via API in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has Stored XSS in .ipynb Preview in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has a Migration Redirect Bypass that Leads to Internal Repository Theft in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has SSRF in webhook deliveries in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has Path Traversal in organization name that results in RCE through Git hooks in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: XSS in .ipynb files renderer due to outdated notebookjs in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via API in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: LFS dedupe path leaks private repo content across tenants in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has a Denial of Service in repository/wiki file listing web pages in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs's password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs has DoS in rendering issue index pattern in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gogs: Cross-repository LFS object overwrite via missing content hash verification in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.2.

Gogs: Stored XSS in branch and wiki views through author and committer names in gogs.io/gogs

Gogs: DOM-based XSS via milestone selection in gogs.io/gogs

Gogs: Stored XSS via data URI in issue comments in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.2.

Gogs: Release tag option injection in release deletion in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.2.

Gogs: Access tokens get exposed through URL params in API requests in gogs.io/gogs

Gogs has an Authorization Bypass Allows Cross-Repository Label Modification in Gogs in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.0.

Gogs has a Protected Branch Deletion Bypass in Web Interface in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.1.

Gogs Allows Cross-Repository Comment Deletion via DeleteComment in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.0.

Unauthenticated File Upload in Gogs in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.1.

Gogs user can update repository content with read-only permission in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs vulnerable to Stored XSS via Mermaid diagrams in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs Vulnerable to 2FA Bypass via Recovery Code in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs has arbitrary file read/write via Path Traversal in Git hook editing in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs vulnerable to arbitrary file deletion via Path Traversal in wiki page update in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs has authorization bypass in repository deletion API in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs's update .git/config file allows remote command execution in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs has a Denial of Service issue in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Gogs vulnerable to a bypass of CVE-2024-55947 in gogs.io/gogs

Gogs XSS allowed by stored call in PDF renderer in gogs.io/gogs

Gogs allows deletion of internal files which leads to remote command execution in gogs.io/gogs

Path Traversal in file update API in gogs in gogs.io/gogs

Remote Command Execution in file editing in gogs in gogs.io/gogs

Impact

When the built-in SSH server is enabled ([server] START_SSH_SERVER = true), unprivileged user accounts with at least one SSH key can execute arbitrary commands on the Gogs instance with the privileges of the user specified by RUN_USER in the configuration. It allows attackers to access and alter any users' code hosted on the same instance.

Patches

The env command sent to the internal SSH server has been changed to be a passthrough (https://github.com/gogs/gogs/pull/7868), i.e. the feature is effectively removed. Users should upgrade to 0.13.1 or the latest 0.14.0+dev.

Workarounds

Disable the use of built-in SSH server on operating systems other than Windows.

References

https://www.cve.org/CVERecord?id=CVE-2024-39930

Impact

Unprivileged user accounts can write to arbitrary files on the filesystem. We could demonstrate its exploitation to force a re-installation of the instance, granting administrator rights. It allows accessing and altering any user's code hosted on the same instance.

Patches

Unintended Git options has been ignored for diff preview (https://github.com/gogs/gogs/pull/7871). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.

Workarounds

No viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.

References

https://www.cve.org/CVERecord?id=CVE-2024-39932

Impact

Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUN_USER in the configuration. It allows attackers to access and alter any users' code hosted on the same instance.

Patches

Deletion of .git files has been prohibited (https://github.com/gogs/gogs/pull/7870). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.

Workarounds

No viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.

References

https://www.cve.org/CVERecord?id=CVE-2024-39931

Impact

Unprivileged user accounts with at least one SSH key can read arbitrary files on the system. For instance, they could leak the configuration files that could contain database credentials ([database] *) and [security] SECRET_KEY. Attackers could also exfiltrate TLS certificates, other users' repositories, and the Gogs database when the SQLite driver is enabled.

Patches

Unintended Git options has been ignored for creating tags (https://github.com/gogs/gogs/pull/7872). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.

Workarounds

No viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.

References

https://www.cve.org/CVERecord?id=CVE-2024-39933

Unpatched Remote Code Execution in Gogs in gogs.io/gogs