2925 matches found
UBUNTU-CVE-2019-11576
Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password...
CVE-2019-11576
Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password...
CVE-2019-11576
Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password...
Design/Logic Flaw
Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password...
CVE-2019-11576
Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password...
CVE-2019-11576
Gitea before 1.8.0 is affected by CVE-2019-11576, where accounts that have completed 2FA enrollment can be subjected to a 1FA bypass if the attacker has the user’s credentials, allowing API access without the one-time password. The vulnerability is rooted in 2FA bypass for accounts with active 2F...
CVE-2019-11576
Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password...
CVE-2019-11576
Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password...
CVE-2019-11576: Improper Authentication
Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password...
PT-2019-12388
Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.8.0 Description The issue allows for 1-factor authentication 1FA for user accounts that have completed 2-factor authentication 2FA enrollment. If a user's credentials are known, an attacker could send them to the API...
Gitea < 1.7.6 or < 1.8.0-rc3 Multiple Vulnerabilities
Gitea is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gitea:gitea"; if description...
gitea -- multiple vulnerabilities
Gitea Team reports: This release contains two new security fixes which cannot be backported to the 1.7.0 branch, so it is recommended to update to this version...
FreeBSD : gitea -- remote code execution (b747783f-5fb6-11e9-b2ac-08002705f877)
The Gitea team reports : Prevent remote code execution vulnerability with mirror repo URL settings. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and contributors...
Remote Code Execution (RCE)
github.com/go-gitea/gitea is vulnerable to remote code execution RCE attacks. The vulnerability exists as the value of form.MirrorAddress is not validated, allowing RCE attacks...
CVE-2019-11228
repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress...
CVE-2019-11229
models/repomirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution...
CVE-2019-11228
repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress...
CVE-2019-11229
models/repomirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution...