Gitea erroneous repo clones

In Gitea through 1.17.1, repo cloning can occur in the migration function...

Server Side Request Forgery (SSRF)

GitLab CE/EE is vulnerable to Server Side Request Forgery SSRF attacks. The vulnerability is due to DNS rebinding in the Gitea importer, which can be exploited by an attacker to trigger SSRF...

Jenkins plugins Multiple Vulnerabilities (2022-12-07)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. CVE-2022-46682 - Jenki...

FreeBSD : gitea -- Disallow dangerous URL schemes (ab0bab3c-2927-11ee-8608-07b8d3947721)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ab0bab3c-2927-11ee-8608-07b8d3947721 advisory. - The Gitea team reports: Disallow javascript, vbscript and data data uri images still work url schemes...

Open Redirect

github.com/go-gitea/gitea is vulnerable to Open Redirect. The vulnerability exists due to improper path sanitization in the RedirectToFirst function, which allows an attacker to pass a crafted POST request, redirecting the victim to a malicious site...

Gitea Input Validation Error Vulnerability (CNVD-2023-60472)

Gitea is a lightweight Go-based git service developed by the Gitea community. An input validation error vulnerability exists in Gitea versions prior to 1.19.4, which stems from improper input validation of the program. An attacker can exploit this vulnerability to obtain sensitive information...

FreeBSD : gitea -- avoid open HTTP redirects (8ea24413-1b15-11ee-9331-570525adb7f1)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 8ea24413-1b15-11ee-9331-570525adb7f1 advisory. - The Gitea team reports: If redirectto parameter has set value starting with \example.com redirect wil...

code.gitea.io/gitea Open Redirect vulnerability

Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4. This is most likely a post-auth redirect plus it is a POST based request scenario, so less likely that can be exploited or chained with other bugs that can cause phishing or credential theft...

GHSA-CF6V-9J57-V6R6 code.gitea.io/gitea Open Redirect vulnerability

Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4. This is most likely a post-auth redirect plus it is a POST based request scenario, so less likely that can be exploited or chained with other bugs that can cause phishing or credential theft...

CVE-2023-3515

Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4...

CVE-2023-3515 Open Redirect in go-gitea/gitea

Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4...

CVE-2023-3515 Open Redirect in go-gitea/gitea

Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4...

CVE-2023-3515

CVE-2023-3515 is an Open Redirect in go-gitea/gitea prior to 1.19.4. The issue involves a redirect mechanism (redirect_to) that can cause a 302 redirect to an untrusted site, enabling potential user redirection to a malicious domain. Affected product: Gitea (Git service) with the vulnerable path ...

PT-2023-25169 · Gitea +1 · Gitea +1

Name of the Vulnerable Software and Affected Versions: gitea versions prior to 1.19.4 Description: The issue is an Open Redirect vulnerability in the GitHub repository go-gitea/gitea. This vulnerability is most likely a post-auth redirect and is a POST-based request scenario, making it less likel...

Gitea 输入验证错误漏洞

Gitea is a lightweight Go-based git service developed by the Gitea community. An input validation error vulnerability exists in Gitea versions prior to 1.19.4, which stems from improper input validation of the program. An attacker can exploit this vulnerability to obtain sensitive information...

gitea -- Disallow dangerous URL schemes

The Gitea team reports: Disallow javascript, vbscript and data data uri images still work url schemes even if all other schemes are allowed...

gitea -- avoid open HTTP redirects

The Gitea team reports: If redirectto parameter has set value starting with \example.com redirect will be created with header Location: /\example.com that will redirect to example.com domain...

gitea -- multiple issues

The Gitea team reports: Test if container blob is accessible before mounting. Set type="password" on all authtoken fields Seen when migrating from other hosting platforms. Prevents exposing the token to screen capture/cameras/eyeballs. Prevents the browser from saving the value in its autocomplet...

gitea -- information disclosure

The Gitea team reports: Fix API leaking Usermail if not logged in The API should only return the real Mail of a User, if the caller is logged in. The check do to this don't work. This PR fixes this. This not really a security issue, but can lead to Spam...

The vulnerability of the Git repository management system Gitea’s interface allows a attacker to perform a CSRF attack.

The vulnerability of the Git repository management system Gitea relates to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to execute a CSRF attack by sending specially crafted POST requests...