Known Vulnerabilities for products from Gogs
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Gogs".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2022-32174 json | In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeov... | 9 - CRITICAL | 2022-10-11 | 2023-11-07 |
| CVE-2022-31038 json | Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 `DisplayName` does not filter characters ... | 5.4 - MEDIUM | 2022-06-09 | 2022-06-17 |
| CVE-2022-2024 json | OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11. | 9.8 - CRITICAL | 2023-02-25 | 2023-03-09 |
| CVE-2022-1993 json | Path Traversal in GitHub repository gogs/gogs prior to 0.12.9. | 8.1 - HIGH | 2022-06-09 | 2022-06-15 |
| CVE-2022-1992 json | Path Traversal in GitHub repository gogs/gogs prior to 0.12.9. | 9.1 - CRITICAL | 2022-06-09 | 2022-06-15 |
| CVE-2022-1986 json | OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9. | 9.8 - CRITICAL | 2022-06-09 | 2022-06-15 |
| CVE-2022-1464 json | Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when ... | 5.4 - MEDIUM | 2022-05-05 | 2022-05-13 |
| CVE-2022-1285 json | Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.8. | 6.5 - MEDIUM | 2022-06-01 | 2022-06-08 |
| CVE-2022-0871 json | Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5. | 9.1 - CRITICAL | 2022-03-11 | 2023-06-29 |
| CVE-2022-0870 json | Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5. | 5.3 - MEDIUM | 2022-03-11 | 2022-03-22 |
| CVE-2022-0415 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 8.8 - HIGH | 2022-03-21 | 2022-03-25 |
| CVE-2021-32546 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 8.8 - HIGH | 2022-06-02 | 2022-06-09 |
| CVE-2020-15867 json | The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege es... | 7.2 - HIGH | 2020-10-16 | 2022-04-26 |
| CVE-2020-14958 json | In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check. | 6.5 - MEDIUM | 2020-06-21 | 2020-06-26 |
| CVE-2020-9329 json | Gogs through 0.11.91 allows attackers to violate the admin-specified repo-creation policy due to an internal/db/repo.go race ... | 5.9 - MEDIUM | 2020-02-21 | 2020-02-25 |
| CVE-2019-14544 json | routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks. | 9.8 - CRITICAL | 2019-08-02 | 2020-08-24 |
| CVE-2018-20303 json | In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker... | 7.5 - HIGH | 2018-12-20 | 2019-01-31 |
| CVE-2018-18925 json | Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." sessio... | 9.8 - CRITICAL | 2018-11-04 | 2019-01-29 |
| CVE-2018-17031 json | In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated b... | 6.1 - MEDIUM | 2018-09-14 | 2018-11-07 |
| CVE-2018-16409 json | In Gogs 0.11.53, an attacker can use migrate to send arbitrary HTTP GET requests, leading to SSRF. | 8.6 - HIGH | 2018-09-03 | 2018-11-06 |
Known software with vulnerabilities from Gogs
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Gogs | Gogs | 0.10 |