openSUSE 15 Security Update : gitea-tea (openSUSE-SU-2025:0094-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025:0094-1 advisory. - gitea-te: update newer dependencies to fix security issues boo1235367 boo1239493 boo1234598 Tenable has extracted the preceding description blo...

OPENSUSE-SU-2025:0094-1 Security update for gitea-tea

This update for gitea-tea fixes the following issues: - gitea-te: update newer dependencies to fix security issues boo1235367 boo1239493 boo1234598...

Security update for gitea-tea (moderate)

openSUSE Security Update: Security update for gitea-tea Announcement ID: openSUSE-SU-2025:0094-1 Rating: moderate References: 1234598 1235367 1239493 Cross-References: CVE-2024-45337 CVE-2024-45338 CVE-2025-22869 CVSS scores: CVE-2024-45337 SUSE: 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H...

Gitea 1.24.0 - HTML Injection

Exploit Title: Gitea 1.24.0 - HTML Injection Date: 2025-03-09 Exploit Author: Mikail KOCADAĞ Vendor Homepage: https://gitea.com Software Link: https://dl.gitea.io/gitea/1.24.0/ Version: 1.24.0 Tested on: Windows 10, Linux Ubuntu 22.04 CVE : N/A Vulnerability Description: In Gitea 1.24.0, the...

Gitea 1.24.0+dev HTML Injection / Cross Site Scripting

Gitea version 1.24.0+dev suffers from an html injection vulnerability that can allow for cross site scripting. Title: Gitea 1.24.0+dev HTML Injection Vulnerability Description: Gitea version 1.24.0+dev-355-g74c8e95e87 is vulnerable to an HTML Injection vulnerability. The issue arises due to...

CVE-2022-1058

Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5...

Exploit for CVE-2024-45337

Proof of Concept exploit for CVE-2024-45337 === This repository...

FreeBSD : gitea -- multiple vulnerabilities (6ea20f0c-bca3-11ef-8926-9b4f2d14eb53)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 6ea20f0c-bca3-11ef-8926-9b4f2d14eb53 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's...

FreeBSD : gitea -- Fix misuse of PublicKeyCallback (38e6f778-bca3-11ef-8926-9b4f2d14eb53)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 38e6f778-bca3-11ef-8926-9b4f2d14eb53 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's...

FreeBSD : gitea -- multiple vulnerabilities (453cd84e-bca4-11ef-8926-9b4f2d14eb53)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 453cd84e-bca4-11ef-8926-9b4f2d14eb53 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's...

gitea -- Fix misuse of PublicKeyCallback

Problem Description: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto...

GHSA-V778-237X-GJRC vulnerabilities

Vulnerabilities for packages: q, pulumi-language-dotnet, filebrowser, openbao-k8s, go-discover, kubernetes-dashboard-web, newrelic-nri-statsd, kubeflow-pipelines, flux-kustomize-controller, kargo, kyverno-notation-aws, restic, mailpit, snyk-cli, jitsucom-bulker, scorecard, osv-scanner,...

gitea -- multiple vulnerabilities

Problem Description: Fix delete branch perm checking Upgrade crypto library...

Server Side Request Forgery (SSRF)

Gitea and Gogs are vulnerable to Server Side Request Forgery SSRF. The vulnerability is due to insufficient input sanitization or filtering of webhook URLs, which allows attackers to send malicious requests that exploit the SSRF flaw and gain access to internal services...

FreeBSD : gitea -- token missing access control for packages (79b1f4ee-860a-11ef-b2dc-cbccbf25b7ea)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 79b1f4ee-860a-11ef-b2dc-cbccbf25b7ea advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's...

gitea -- token missing access control for packages

Problem Description: Fix bug when a token is given public only...

Cross Site Request Forgery (CSRF)

github.com/go-gitea/gitea is vulnerable to Cross Site Request Forgery CSRF. The vulnerability is due to the lack of proper validation and protection mechanisms in the API routes of Gitea, allows unauthorized state-altering POST requests to be executed by attackers on behalf of authenticated users...

Privilege Escalation

code.gitea.io/gitea is vulnerable to Privilege Escalation. The vulnerability is due to the absence of proper permission checks in Gitea, which allows attackers to assign issues to projects without verifying whether they have the necessary access rights...

FreeBSD : gitea -- multiple issues (f5d0cfe7-6ba6-11ef-858b-23eeba13701a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the f5d0cfe7-6ba6-11ef-858b-23eeba13701a advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's...

Gitea 1.22.0 Cross Site Scripting

Exploit Title: Stored XSS in Gitea Date: 27/08/2024 Exploit Authors: Catalin Iovita & Alexandru Postolache Vendor Homepage: https://github.com/go-gitea/gitea Version: 1.22.0 Tested on: Linux 5.15.0-107, Go 1.23.0 CVE: CVE-2024-6886 Vulnerability Description Gitea 1.22.0 is vulnerable to a Stored...