CVE-2021-3382

The CVE concerns Gitea versions 1.9.0 through 1.13.1, where a stack buffer overflow vulnerability allows remote attackers to cause a denial of service (crash) via vectors related to a file path. The connected data consistently describe this as a stack-based overflow affecting gitea in that versio...

CVE-2021-3382

Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service crash via vectors related to a file path...

Gitea 缓冲区错误漏洞

Gitea is an open source community-driven clone of Gogs, a lightweight code hosting solution with a backend written in Go under the MIT license. A stack buffer overflow vulnerability exists in gitea versions 1.9.0 through 1.13.1. A remote attacker can exploit this vulnerability to cause a denial o...

PT-2021-20333

Name of the Vulnerable Software and Affected Versions: gitea versions 1.9.0 through 1.13.1 Description: The issue is a stack buffer overflow vulnerability that allows remote attackers to cause a denial of service, resulting in a crash, via vectors related to a file path. Recommendations: For gite...

CVE-2021-3382: Out-of-bounds Write

Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service crash via vectors related to a file path...

gitea:fuzz_markup_post_process: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4788317528915968 Project: gitea Fuzzing Engine: libFuzzer Fuzz Target: fuzzmarkuppostprocess Job Type: libfuzzerasangitea Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00000ebcb0fc Crash State: NULL Sanitizer: address ASAN...

Gitea 1.7.5 Remote Code Execution

Exploit Title: Gitea 1.7.5 - Remote Code Execution Date: 2020-05-11 Exploit Author: 1F98D Original Author: LoRexxar Software Link: https://gitea.io/en-us/ Version: Gitea before 1.7.6 and 1.8.x before 1.8-RC3 Tested on: Debian 9.11 x64 CVE: CVE-2019-11229 References:...

gitea -- multiple vulnerabilities

The Gitea Team reports for release 1.13.3: Turn default hash password algorithm back to pbkdf2 from argon2 until we find a better one The Gitea Team reports for release 1.13.4: Fix issue popups...

gitea -- multiple vulnerabilities

The Gitea Team reports for release 1.13.2: Prevent panic on fuzzer provided string Add secure/httpOnly attributes to the lang cookie...

Gitea 1.7.5 - Remote Code Execution

Exploit Title: Gitea 1.7.5 - Remote Code Execution Date: 2020-05-11 Exploit Author: 1F98D Original Author: LoRexxar Software Link: https://gitea.io/en-us/ Version: Gitea before 1.7.6 and 1.8.x before 1.8-RC3 Tested on: Debian 9.11 x64 CVE: CVE-2019-11229 References:...

FreeBSD : gitea -- multiple vulnerabilities (2739b88b-4b88-11eb-a4c0-08002734b9ed)

The Gitea Team reports for release 1.13.1 : - Hide private participation in Orgs - Fix escaping issue in diff C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2021 Jacques Vidrine and contributo...

gitea:fuzz_markup_post_process: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4921065608445952 Project: gitea Fuzzing Engine: libFuzzer Fuzz Target: fuzzmarkuppostprocess Job Type: libfuzzerasangitea Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00000ce31f18 Crash State: NULL Sanitizer: address ASAN...

gitea -- multiple vulnerabilities

The Gitea Team reports for release 1.13.1: Hide private participation in Orgs Fix escaping issue in diff...

PT-2021-17853 · Gitea +1 · Gitea +1

Name of the Vulnerable Software and Affected Versions: Gitea versions 1.12.x through 1.13.3 Gitea versions 1.1.0 through 1.12.5 Description: The issue allows for cross-site scripting XSS via certain issue data in some situations. It also enables authenticated remote code execution through the git...

FreeBSD : gitea -- multiple vulnerabilities (b99492b2-362b-11eb-9f86-08002734b9ed)

The Gitea Team reports for release 1.13.0 : - Add Allow-/Block-List for Migrate and Mirrors - Prevent git operations for inactive users - Disallow urlencoded new lines in git protocol paths if there is a port - Mitigate Security vulnerability in the git hook feature - Disable DSA ssh keys by...

gitea -- multiple vulnerabilities

The Gitea Team reports for release 1.13.0: Add Allow-/Block-List for Migrate and Mirrors Prevent git operations for inactive users Disallow urlencoded new lines in git protocol paths if there is a port Mitigate Security vulnerability in the git hook feature Disable DSA ssh keys by default Set TLS...

[ASA-202011-26] gitea: insufficient validation

Arch Linux Security Advisory ASA-202011-26 ========================================== Severity: Medium Date : 2020-11-26 CVE-ID : CVE-2020-28991 Package : gitea Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-1299 Summary ======= The package gitea before...

Privilege Escalation

gitea is vulnerable to escalation of privilege. An attacker is able to get a TCP port number through a git protocol path in ParseRemoteAddr in modules/auth/repoform.go...

CVE-2020-28991

Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines with URL encoding in ParseRemoteAddr in modules/auth/repoform.go...

CVE-2020-28991

Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines with URL encoding in ParseRemoteAddr in modules/auth/repoform.go...