Open Redirect

github.com/go-gitea/gitea is vulnerable to open redirect attacks. The vulnerability exists due to the lack of checking on the redirected URL, allowing redirection to external sites...

PT-2018-3871

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.4.3 Description The issue is related to an open redirect vulnerability, which allows an attacker to redirect users to an untrusted site via internal URLs. This can be exploited by a remote attacker to redirect users t...

Cross-Site Scripting (XSS)

github.com/go-gitea/gitea is susceptible to cross-site scripting XSS attacks. The search query and wiki page title parameters are not escaped properly, allowing an attacker to inject and execute arbitrary code through it...

gitea -- TOTP passcode reuse

The Gitea project reports: TOTP passcodes can be reused...

Information Disclosure

github.com/go-gitea/gitea is vulnerable to information disclosure. The vulnerability exists due to the lack of sanitization of sensitive information, such as passwords, in the logs of a mirrored sync...

Cross-site Scripting (XSS)

github.com/go-gitea/gitea is susceptible to cross-site scripting XSS attacks. An attack can be launched by inputing malicious script through the Name parameter since it is not sanitized properly...

Unauthorized Modification Of Data

github.com/go-gitea/gitea is vulnerable to unauthorized deletion of user emails. A malicious user can modify the HTTP post requests to delete another user's email...

Timing Attacks

github.com/go-gitea/gitea is vulnerable to timing attacks. This vulnerability is caused because the passwords are not compared in constant time, allowing malicious users to guess the valid passwords based on the time that a comparison takes...