2041 matches found
Denial of Service in Gitea
An issue was discovered in Gitea in which an attacker can trigger a deadlock by initiating a transfer of a repository's ownership from one organization to another...
Session Fixation
Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron...
gitea -- password hash quality
The Gitea team reports: This PR refactors and improves the password hashing code within gitea and makes it possible for server administrators to set the password hashing parameters. In addition it takes the opportunity to adjust the settings for pbkdf2 in order to make the hashing a little...
Gitea Licensing Issue Vulnerability
Gitea is a lightweight Go-based git service developed by the Gitea community. Gitea is vulnerable to an authorization issue in versions prior to 1.5.0, which stems from the application's lack of authentication measures or insufficient authentication strength. An attacker could exploit the...
Gitea Input Validation Error Vulnerability
Gitea is a lightweight Go-based git service developed by the Gitea community. Gitea is vulnerable to an input validation error that stems from the product's failure to determine that a request originated from a trusted user, which could be exploited to send an unintended request to the server...
Gitea < 1.4.3 Open Redirect Vulnerability
Gitea is prone to an open redirect vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Gitea < 1.5.0 Authentication Bypass Vulnerability
Gitea is prone to an authentication bypass vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...
Gitea Cross-Site Scripting Vulnerability (CNVD-2022-11525)
A cross-site scripting vulnerability exists in Gitea, a Go-based lightweight git service developed by the Gitea community. The vulnerability stems from a mirror setting in the product wiki/issue link that does not effectively handle special characters in the input data. An attacker could execute...
Gitea Cross-Site Request Forgery Vulnerability
Gitea is a lightweight Go-based git service developed by the Gitea community. Gitea suffers from a cross-site request forgery vulnerability, which stems from the product's multiple linked POST requests failing to properly determine that the user originated from a trusted user, and could be...
Gitea < 1.15.7 Cookies Vulnerability
Gitea is prone to a cookies reuse vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Gitea < 1.7.0 SSRF Vulnerability
Gitea is prone to a server-side request forgery SSRF vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gitea:gitea";...
Gitea < 1.5.1 XSS Vulnerability
Gitea is prone to a cross-site scripting XSS vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...
gitea < 1.11.2 RCE Vulnerability
Gitea is prone to a remote code execution RCE vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...
Gitea < 1.5.2 CSRF Vulnerability
Gitea is prone to a cross-site request forgery CSRF vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...
Gitea Cross-Site Request Forgery Vulnerability (CNVD-2022-11513)
Gitea is a lightweight Go-based git service developed by the Gitea community. Gitea is vulnerable to a cross-site request forgery vulnerability, which stems from the product's OpenID URL not validating the user's identity and could be exploited to cause client-side code execution...
Cross Site Scripting (XSS)
github.com/go-gitea/gitea is vulnerable to cross-site scripting XSS. The vulnerability exists due to the lack of sanitization in the repository settings in the setting.go file allows the attacker to inject and execute arbitrary Javascript via the URL field in the external wiki/issue tracker...
Authentication Bypass
github.com/go-gitea/gitea is vulnerable to authentication bypass. The library allows the TOTP code for two-factor authentication to be submitted correctly more than once enabling remote attackers to abuse the flaw and gain unauthorized privileges...
Session Fixation
github.com/go-gitea/gitea is vulnerable to session fixation. The library does not properly reset the user session after logging out, allowing an attacker to gain privileges via the client-side cookie...
Cross-site Scripting in Gitea
Cross Site Scripting XSS vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field...
