2925 matches found
Authentication flaw
An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once...
CVE-2021-45331
An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once...
CVE-2021-45330
An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and the session remains valid on the server side for reuse...
CVE-2021-45331
An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once...
CVE-2021-45331
The CVE-2021-45331 issue affects Gitea prior to 1.5.0 and is an Authentication Bypass where a malicious user could abuse the TOTP-based 2FA workflow to gain privileges. Root cause is an authentication mechanism flaw that allows submitting a valid TOTP correctly more than once, enabling privilege ...
CVE-2021-45331
An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once...
CVE-2021-45331
An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once...
CVE-2021-45330
An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and the session remains valid on the server side for reuse...
CVE-2021-45330
An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and the session remains valid on the server side for reuse...
CVE-2021-45330
Summary: In Gitea up to 1.15.7, a client-side cookie handling issue leaves sessions reusable on the server, enabling a malicious user to gain privileges. The root cause is inadequate deletion/cleanup of cookies that maintain server-side sessions. Impact is described as privilege gain with high CV...
Remote Code Execution (RCE)
github.com/go-gitea/gitea is vulnerable to remote code execution. The vulnerability exists because of the reliance on protection mechanism of HTTP permission methods, allowing an attacker to bypass intended access restrictions and to perform the malicious operations remotely...
Open Redirect
github.com/go-gitea/gitea is vulnerable to open redirect. A remote attacker is able to redirect a victim to an untrusted web page by supplying a maliciously crafted URL via admin.go and gain access to confidential information...
Cross Site Request Forgery in Gitea
Cross Site Request Forgery CSRF vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests...
GHSA-4WP3-8Q92-MH8W Cross Site Request Forgery in Gitea
Cross Site Request Forgery CSRF vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests...
Gitea displaying raw OpenID error in UI
Gitea is a project to help users set up a self-hosted Git service. Server Side Request Forgery SSRF vulnerability exists in Gitea before 1.7.0 using the OpenID URL. Gitea can leak sensitive information about the local network through the error provided by the UI...
Capture-replay in Gitea
Gitea is a project to help users set up a self-hosted Git service. Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. This could allow a remote malicious user to execute arbitrary code...
GHSA-JRPG-35HW-M4P9 Capture-replay in Gitea
Gitea is a project to help users set up a self-hosted Git service. Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. This could allow a remote malicious user to execute arbitrary code...
GHSA-8H8P-X289-VVQR Gitea displaying raw OpenID error in UI
Gitea is a project to help users set up a self-hosted Git service. Server Side Request Forgery SSRF vulnerability exists in Gitea before 1.7.0 using the OpenID URL. Gitea can leak sensitive information about the local network through the error provided by the UI...