Cross-site Scripting (XSS)

github.com/go-gitea/gitea is vulnerable to cross-site scripting. An attacker is able to inject and execute arbitrary Javascript in the user's browser via the issuePopup function in contextpopup.js in some situations...

CVE-2021-28378

Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations...

CVE-2021-28378

Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations...

CVE-2021-28378

Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations...

CVE-2021-28378

Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations...

Cross site scripting

Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations...

CVE-2021-28378

CVE-2021-28378 affects Gitea 1.12.x and 1.13.x up to (but not including) 1.13.4. The issue is a client-side XSS vulnerability triggered when rendering issue/PR references that are injected in popup UI via the inline ref-issue links; insufficient escaping of fields like label.name, issue.title, an...

CVE-2021-28378

Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations...

CVE-2021-28378

Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations...

Gitea 跨站脚本漏洞

Gitea is a lightweight Go-based git service developed by the Gitea community. A security vulnerability exists in Gitea 1.12.x and 1.13.x before 1.13.4 that allows XSS via issue-specific data under certain circumstances...

gitea -- multiple vulnerabilities

The Gitea Team reports for release 1.14.0: Validate email in external authenticator registration form Ensure validation occurs on clone addresses too...

FreeBSD : gitea -- multiple vulnerabilities (502ba001-7ffa-11eb-911c-0800278d94f0)

The Gitea Team reports for release 1.13.3 : - Turn default hash password algorithm back to pbkdf2 from argon2 until we find a better one The Gitea Team reports for release 1.13.4 : - Fix issue popups C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Gitea 1.12.5 Remote Code Execution

Exploit Title: Gitea 1.12.5 - Remote Code Execution Authenticated Date: 17 Feb 2020 Exploit Author: Podalirius PoC demonstration article: https://podalirius.net/articles/exploiting-cve-2020-14144-gitea-authenticated-remote-code-execution/ Vendor Homepage: https://gitea.io/ Software Link:...

Gitea 1.12.5 - Remote Code Execution (Authenticated) Exploit

Exploit Title: Gitea 1.12.5 - Remote Code Execution Authenticated Exploit Author: Podalirius PoC demonstration article: https://podalirius.net/articles/exploiting-cve-2020-14144-gitea-authenticated-remote-code-execution/ Vendor Homepage: https://gitea.io/ Software Link: https://dl.gitea.io/...

Gitea 1.12.5 - Remote Code Execution (Authenticated)

Exploit Title: Gitea 1.12.5 - Remote Code Execution Authenticated Date: 17 Feb 2020 Exploit Author: Podalirius PoC demonstration article: https://podalirius.net/en/articles/exploiting-cve-2020-14144-gitea-authenticated-remote-code-execution/ Vendor Homepage: https://gitea.io/ Software Link:...

Gitea 1.9.0 < 1.13.2 DoS Vulnerability

Gitea is prone to a denial of service DoS vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

Gitea 0.9.99 < 1.12.6 RCE Vulnerability

Gitea is prone to a remote code execution RCE vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

Denial Of Service (DoS)

github.com/go-gitea/gitea is vulnerable to denial of service DoS. The vulnerability exists through a stack buffer overflow that occurs from the usage of filepath...

FreeBSD : gitea -- multiple vulnerabilities (cdb10765-6879-11eb-a7d8-08002734b9ed)

The Gitea Team reports for release 1.13.2 : - Prevent panic on fuzzer provided string - Add secure/httpOnly attributes to the lang cookie C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2021...

Gitea Stack Buffer Overflow Vulnerability

Gitea is an open source community-driven clone of Gogs, a lightweight code hosting solution with a backend written in Go under the MIT license. A stack buffer overflow vulnerability exists in gitea versions 1.9.0 through 1.13.1. A remote attacker can exploit this vulnerability to cause a denial o...