2925 matches found
gitea:fuzz_markdown_render_raw: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=5726263340826624 Project: gitea Fuzzing Engine: libFuzzer Fuzz Target: fuzzmarkdownrenderraw Job Type: libfuzzerasangitea Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xffffffffffffffff Crash State: NULL Sanitizer: address ASAN...
PT-2022-9911 · Gitea +1 · Gitea +1
Name of the Vulnerable Software and Affected Versions: Gitea versions prior to 1.13.6 Description: The issue allows Directory Traversal via a crafted URL, specifically affecting the avatar middleware. Recommendations: For versions prior to 1.13.6, update to version 1.13.6 or later to resolve the...
gitea -- multiple vulnerabilities
The Gitea Team reports for release 1.13.7: Update to bluemonday-1.0.6 Clusterfuzz found another way...
Gitea Git Hooks Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Gitea Git Hooks Remote Code Execution', 'Description' = %q This module leverages an insecure setting to get remote code execution on the target O...
Gitea Git Hooks Remote Code Execution Exploit
This Metasploit module leverages an insecure setting to get remote code execution on the target OS in the context of the user running Gitea. This is possible when the current user is allowed to create git hooks, which is the default for administrative users. For non-administrative users, the...
FreeBSD : gitea -- multiple vulnerabilities (c4d2f950-8c27-11eb-a3ae-0800278d94f0)
The Gitea Team reports for release 1.13.6 : - Fix bug on avatar middleware - Fix another clusterfuzz identified issue C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2021 Jacques Vidrine and...
FreeBSD : gitea -- quoting in markdown text (1431a25c-8a70-11eb-bd16-0800278d94f0)
The Gitea Team reports for release 1.13.5 : - Update to goldmark 1.3.3 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2021 Jacques Vidrine and contributors Redistribution and use in source VuX...
gitea -- multiple vulnerabilities
The Gitea Team reports for release 1.13.6: Fix bug on avatar middleware Fix another clusterfuzz identified issue...
gitea -- quoting in markdown text
The Gitea Team reports for release 1.13.5: Update to goldmark 1.3.3...
gitea:fuzz_markdown_render_raw: Null-dereference READ in pthread_create
Detailed Report: https://oss-fuzz.com/testcase?key=5667361895088128 Project: gitea Fuzzing Engine: libFuzzer Fuzz Target: fuzzmarkdownrenderraw Job Type: libfuzzerasangitea Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate...
Gitea 1.12.0 < 1.13.4 XSS Vulnerability
Gitea is prone to a cross-site scripting XSS vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...
Cross-site Scripting (XSS)
github.com/go-gitea/gitea is vulnerable to cross-site scripting. An attacker is able to inject and execute arbitrary Javascript in the user's browser via the issuePopup function in contextpopup.js in some situations...
CVE-2021-28378
Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations...
CVE-2021-28378
Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations...
Cross site scripting
Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations...
CVE-2021-28378
Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations...
CVE-2021-28378
Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations...
CVE-2021-28378
CVE-2021-28378 affects Gitea 1.12.x and 1.13.x up to (but not including) 1.13.4. The issue is a client-side XSS vulnerability triggered when rendering issue/PR references that are injected in popup UI via the inline ref-issue links; insufficient escaping of fields like label.name, issue.title, an...
