gitea -- privilege escalation, XSS

The Gitea project reports: Security Sanitize uploaded file names HTMLEncode user added text...

Gitea Detection (HTTP)

HTTP based detection of Gitea. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.141676";...

Gitea < 1.5.3 RCE Vulnerability

Gitea is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gitea:gitea"; if...

Remote Code Execution (RCE)

github.com/go-gitea/gitea is vulnerable to remote code execution RCE attacks. The library does not properly validate session IDs, allowing a malicious user to authenticate as another arbitrary account...

CVE-2018-18926

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron...

CVE-2018-18926

CVE-2018-18926: Gitea prior to 1.5.4 is vulnerable to remote code execution due to improper validation of session IDs in the go-macaron/session handling. Affected product is Gitea (Go-based repository server); the root cause is session management logic in Macaron. Public references consistently d...

CVE-2018-18926

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron...

CVE-2018-18926

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron...

UBUNTU-CVE-2018-18926

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron...

CVE-2018-18926

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron...

Remote code execution

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron...

PT-2018-14726 · Go · Gitea

Name of the Vulnerable Software and Affected Versions: Gitea versions prior to 1.5.4 Description: The issue allows remote code execution due to improper validation of session IDs, specifically related to session ID handling in the go-macaron/session code for Macaron. Recommendations: For versions...

FreeBSD : gitea -- remote code exeution (deb4f633-de1d-11e8-a9fb-080027f43a02)

The Gitea project reports : This release contains critical security fix for vulnerability that could potentially allow for authorized users to do remote code execution. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML...

gitea -- remote code exeution

The Gitea project reports: This release contains critical security fix for vulnerability that could potentially allow for authorized users to do remote code execution...

FreeBSD : gitea -- multiple vulnerabilities (cb539d4e-cd68-11e8-8819-00e04c1ea73d)

Gitea project reports : CSRF Vulnerability on API. Enforce token on api routes. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors Redistribution and use in...

Design/Logic Flaw

Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email...

CVE-2018-1000803

Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email...

CVE-2018-1000803

Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email...

CVE-2018-1000803

Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email...

CVE-2018-1000803

The CVE refers to Gitea prior to v1.5.1, where a CWE-200 information-disclosure flaw allows exposure of users’ private email addresses. According to connected sources, the issue can be triggered via the “Watch a repository” email-notification flow, causing emails to include recipients’ addresses ...