PT-2022-13624

Name of the Vulnerable Software and Affected Versions gitea versions prior to 1.16.5 Description The issue is related to an Open Redirect on login in the GitHub repository go-gitea/gitea. Recommendations For versions prior to 1.16.5, update to version 1.16.5 or later to resolve the issue...

CVE-2022-1058: URL Redirection to Untrusted Site

Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5...

gitea -- Open Redirect on login

Andrew Thornton reports: When a location containing backslashes is presented, the existing protections against open redirect are bypassed, because browsers will convert adjacent forward and backslashes within the location to double forward slashes...

Gitea < 1.13.6 Multiple Vulnerabilities

Gitea is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Path Traversal in Gitea

The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL...

GHSA-H3Q4-VMW4-CPR5 Path Traversal in Gitea

The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL...

Gitea Directory Traversal Vulnerability

Gitea is an open source community-driven clone of Gogs, a popular Git self-hosted service. A directory traversal vulnerability exists on Gitea that can be exploited by an attacker to allow the avatar middleware in Gitea to allow directory traversal via a crafted URL...

Path Traversal in Gitea

The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL...

CVE-2021-29134

The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL...

CVE-2021-29134

The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL...

CVE-2021-29134

The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL...

Directory traversal

The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL...

CVE-2021-29134

The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL...

CVE-2021-29134

The CVE-2021-29134 entry relates to Gitea prior to v1.13.6, where the avatar middleware is susceptible to Directory Traversal via a crafted URL. Affected component: avatar middleware in Gitea; root cause: improper handling of path components enables traversal to arbitrary files. Impact: potential...

CVE-2021-29134

The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL...

CVE-2021-29134

The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL...

Gitea 路径遍历漏洞

Gitea is an open source community-driven clone of Gogs, a popular Git self-hosted service. A directory traversal vulnerability exists on Gitea that can be exploited by an attacker to allow the avatar middleware in Gitea to allow directory traversal via a crafted URL...

CVE-2021-29134: Improper Limitation of a Pathname to a Restricted Directory

The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL...

Gitea < 1.16.4 Improper Authorization Vulnerability

Gitea is prone to an improper authorization vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; yo...

Arbitrary file deletion in Gitea

Description When user delete the LFS data in Gitea, the oid parameter is not been validated. The attacker can make an oid whose prefix is .... to traverse directory and delete any files on the server. Proof of Concept Create a repository on Gitea. e.g. foo/bar Send a POST request with your Gitea...