CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 02/06/2022 |
| CVE-2022-1285 | MITTEL6.5 | Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.8. | 01/06/2022 |
| CVE-2022-1464 | MITTEL5.4 | Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account . | 05/05/2022 |
| CVE-2022-0415 | HOCH8.8 | Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6. | 21/03/2022 |
| GHSA-q347-cg56-pcq4 | MITTEL5.0 | SSRF in repository migration | 14/03/2022 |
| CVE-2022-0871 | KRITISCH9.1 | Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5. | 11/03/2022 |
| CVE-2022-0870 | MITTEL5.3 | Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5. | 11/03/2022 |
| CVE-2020-14958 | MITTEL6.5 | In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check. | 21/06/2020 |
| CVE-2019-14544 | KRITISCH9.8 | routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks. | 02/08/2019 |
| CVE-2018-20303 | HOCH7.5 | In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925. | 20/12/2018 |
| CVE-2018-17031 | MITTEL6.1 | In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent. | 14/09/2018 |
| CVE-2018-15192 | HOCH8.6 | An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services. | 08/08/2018 |
| CVE-2018-15178 | MITTEL6.1 | Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via an initial /\ substring in the user/login redirect_to parameter, related to the function isValidRedirect in routes/user/auth.go. | 08/08/2018 |
| CVE-2014-8683 | MITTEL4.3 | Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown. | 21/11/2014 |
| CVE-2014-8682 | HOCH7.5 | Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly han | 21/11/2014 |
| CVE-2014-8681 | HOCH7.5 | SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before 0.5.6.1025 Beta allows remote attackers to execute arbitrary SQL commands via the label parameter to user/repos/issues. | 21/11/2014 |