2038 matches found
FreeBSD : gitea -- multiple vulnerabilities (733afd81-01cf-11ec-aec9-0800273f11ea)
The Gitea Team reports for release 1.14.6 : - Bump github.com/markbates/goth from v1.67.1 to v1.68.0 16538 16540 - Switch to maintained JWT lib 16532 16535 - Upgrade to latest version of golang-jwt as forked for 1.14 16590 16607 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...
Exploit for Cross-site Scripting in Gitea
CVE-2021-28378 Details about this CVE herehttps://www.cved...
gitea -- multiple vulnerabilities
The Gitea Team reports for release 1.14.6: Bump github.com/markbates/goth from v1.67.1 to v1.68.0 16538 16540 Switch to maintained JWT lib 16532 16535 Upgrade to latest version of golang-jwt as forked for 1.14 16590 16607...
FreeBSD : gitea -- multiple vulnerabilities (943d23b6-e65e-11eb-ad30-0800273f11ea)
The Gitea Team reports for release 1.14.5 : - Hide mirror passwords on repo settings page 16022 16355 - Update bluemonday to v1.0.15 16379 16380 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML databa...
FreeBSD : gitea -- multiple vulnerabilities (0e561c06-d13a-11eb-92be-0800273f11ea)
The Gitea Team reports for release 1.14.3 : - Encrypt migration credentials at rest 15895 16187 - Only check access tokens if they are likely to be tokens 16164 16171 - Add missing SameSite settings for the ilikegitea cookie 16037 16039 - Fix setting of SameSite on cookies 15989 15991 %NASLMINLEV...
Denial Of Service (DoS)
github.com/go-gitea/gitea and x/net/html of github.com/golang/go are vulnerable to Denial Of Service DoS. An infinite loop is caused when an attacker sends a malicious input to ParseFragment...
gitea -- multiple vulnerabilities
The Gitea Team reports for release 1.14.5: Hide mirror passwords on repo settings page 16022 16355 Update bluemonday to v1.0.15 16379 16380...
gitea -- multiple vulnerabilities
The Gitea Team reports for release 1.14.3: Encrypt migration credentials at rest 15895 16187 Only check access tokens if they are likely to be tokens 16164 16171 Add missing SameSite settings for the ilikegitea cookie 16037 16039 Fix setting of SameSite on cookies 15989 15991...
Path Traversal
gitea is vulnerable to path traversal. The vulnerability exists due to the parameter "file = .. /" encoded in base64...
gitea -- multiple vulnerabilities
The Gitea Team reports for release 1.15.0: Encrypt LDAP bind password in db with SECRETKEY 15547 Remove random password in Dockerfiles 15362 Upgrade to the latest version of golang-jwt and increase minimum go to 1.15 16590 16606 Correctly create of git-daemon-export-ok files 16508 16514 Don't sho...
FreeBSD : gitea -- multiple vulnerabilities (8ba23a62-997d-11eb-9f0e-0800278d94f0)
The Gitea Team reports for release 1.13.7 : - Update to bluemonday-1.0.6 - Clusterfuzz found another way C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2021 Jacques Vidrine and contributors...
FreeBSD : gitea -- multiple vulnerabilities (094fb2ec-9aa3-11eb-83cb-0800278d94f0)
The Gitea Team reports for release 1.14.0 : - Validate email in external authenticator registration form - Ensure validation occurs on clone addresses too C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database :...
Metasploit Wrap-Up
Spilling the Gitea We have two modules coming in from cdelafuente-r7 targeting CVE-2020-14144 for both the Gitea and Gogs self-hosted Git services. Both modules are similar: they take advantage of a user’s ability to create Git hooks by authenticating with the web interface, creating a dummy...
PT-2022-9911 · Gitea +1 · Gitea +1
Name of the Vulnerable Software and Affected Versions: Gitea versions prior to 1.13.6 Description: The issue allows Directory Traversal via a crafted URL, specifically affecting the avatar middleware. Recommendations: For versions prior to 1.13.6, update to version 1.13.6 or later to resolve the...
Gitea Git Hooks Remote Code Execution Exploit
This Metasploit module leverages an insecure setting to get remote code execution on the target OS in the context of the user running Gitea. This is possible when the current user is allowed to create git hooks, which is the default for administrative users. For non-administrative users, the...
Gitea Git Hooks Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Gitea Git Hooks Remote Code Execution', 'Description' = %q This module leverages an insecure setting to get remote code execution on the target O...
gitea -- multiple vulnerabilities
The Gitea Team reports for release 1.13.7: Update to bluemonday-1.0.6 Clusterfuzz found another way...
FreeBSD : gitea -- multiple vulnerabilities (c4d2f950-8c27-11eb-a3ae-0800278d94f0)
The Gitea Team reports for release 1.13.6 : - Fix bug on avatar middleware - Fix another clusterfuzz identified issue C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2021 Jacques Vidrine and...
FreeBSD : gitea -- quoting in markdown text (1431a25c-8a70-11eb-bd16-0800278d94f0)
The Gitea Team reports for release 1.13.5 : - Update to goldmark 1.3.3 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2021 Jacques Vidrine and contributors Redistribution and use in source VuX...