2925 matches found
Improper credentials masking in gitea
gitea support authentication with Gitea personal access tokens. In gitea 1.4.4 and earlier, the implementation of these tokens did not support credentials masking. This can expose Gitea personal access tokens in the build log, e.g., when printed as part of repository URLs. gitea 1.4.5 adds suppor...
CVE-2022-46685
In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them through the build log...
CVE-2022-46685: Cleartext Transmission of Sensitive Information
In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them through the build log...
CVE-2022-46685
In Jenkins Gitea Plugin, versions 1.4.4 and earlier did not mask Gitea personal access tokens, potentially exposing credentials in build logs. The issue is documented across multiple feeds (NVD, Red Hat, OSV, GHSA) with the same root cause and scope: credentials masking was not supported, enablin...
Metasploit Weekly Wrap-Up
Pre-authenticated Remote Code Execution in VMware NSX Manager using XStream CVE-2021-39144 There’s nothing quite like a pre-authenticated remote code execution vulnerability in a piece of enterprise software. This week, community contributor h00die-gr3y added a module that targets VMware NSX...
Gitea Git Fetch Remote Code Execution Exploit
This Metasploit module exploits the Git fetch command in the Gitea repository migration process to allow for remote command execution on the system. This vulnerability affect Gitea versions prior to 1.16.7. This module requires Metasploit: https://metasploit.com/download Current source:...
Gitea Git Fetch Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Gitea Git Fetch Remote Code Execution', 'Description' = %q This module exploits Git fetch command in Gitea repository migration process that lead...
Gitea: Multiple Vulnerabilities
Background Gitea is a painless self-hosted Git service. Description Multiple vulnerabilities have been discovered in Gitea. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known workaround at...
GLSA-202210-14 : Gitea: Multiple Vulnerabilities
The remote host is affected by the vulnerability described in GLSA-202210-14 Gitea: Multiple Vulnerabilities - Cross-site Scripting XSS - Stored in GitHub repository go-gitea/gitea prior to 1.16.9. CVE-2022-1928 - An attacker may cause a denial of service by crafting an Accept-Language header whi...
gitea -- multiple issues
The Gitea team reports: Do not allow Ghost access to limited visible user/org Fix package access for admins and inactive users...
CVE-2022-42968
A flaw was found in Gitea. The self-hosted Git service does not sanitize and escape refs in the git backend. This issue could allow an attacker to craft arguments for the git commands, which will be mishandled...
Gitea < 1.17.3 Privilege Escalation Vulnerability
Gitea is prone to a privilege escalation vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...
Cross-Site Scripting (XSS)
github.com/go-gitea/gitea is vulnerable to cross-site scripting. The vulnerability is due to arguments in command.go given to git commands not being properly handled which allows an attacker to inject and execute arbitrary scripts...
Gitea vulnerable to Argument Injection
Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled...
GHSA-W8XW-7CRF-H23X Gitea vulnerable to Argument Injection
Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled...
CVE-2022-42968
Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled...
Command injection
Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled...
CVE-2022-42968
Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled...
