2032 matches found
CVE-2019-10330
Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted...
CVE-2019-10330
Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted...
CVE-2019-10330
Summary: CVE-2019-10330 affects the Jenkins Gitea Plugin, versions 1.1.1 and earlier. The root cause is that the plugin did not implement trusted revisions, enabling attackers without commit access to the Git repository to modify Jenkinsfiles, even when Jenkins treated them as untrusted. Impact: ...
PT-2019-11730 · Jenkins · Jenkins Git Plugin
Name of the Vulnerable Software and Affected Versions: Jenkins Gitea Plugin versions 1.1.1 and earlier Description: The issue allows attackers without commit access to the Git repository to change Jenkinsfiles, even if Jenkins is configured to consider them untrusted. This is due to the lack of...
FreeBSD : gitea -- multiple vulnerabilities (a1de4ae9-6fda-11e9-9ba0-4c72b94353b5)
Gitea Team reports : This release contains two new security fixes which cannot be backported to the 1.7.0 branch, so it is recommended to update to this version. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database ...
Gitea < 1.8.0 2FA Bypass Vulnerability
Gitea is prone to a two factor authentication bypass vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gitea:gitea";...
Design/Logic Flaw
Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password...
CVE-2019-11576
Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password...
CVE-2019-11576
Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password...
UBUNTU-CVE-2019-11576
Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password...
CVE-2019-11576
Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password...
CVE-2019-11576
Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password...
CVE-2019-11576
Gitea before 1.8.0 is affected by CVE-2019-11576, where accounts that have completed 2FA enrollment can be subjected to a 1FA bypass if the attacker has the user’s credentials, allowing API access without the one-time password. The vulnerability is rooted in 2FA bypass for accounts with active 2F...
Gitea < 1.7.6 or < 1.8.0-rc3 Multiple Vulnerabilities
Gitea is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gitea:gitea"; if description...
gitea -- multiple vulnerabilities
Gitea Team reports: This release contains two new security fixes which cannot be backported to the 1.7.0 branch, so it is recommended to update to this version...
FreeBSD : gitea -- remote code execution (b747783f-5fb6-11e9-b2ac-08002705f877)
The Gitea team reports : Prevent remote code execution vulnerability with mirror repo URL settings. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and contributors...
Remote Code Execution (RCE)
github.com/go-gitea/gitea is vulnerable to remote code execution RCE attacks. The vulnerability exists as the value of form.MirrorAddress is not validated, allowing RCE attacks...
CVE-2019-11228
repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress...