CVE-2019-1000002

Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to "any"...

CVE-2019-1000002

Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to "any"...

CVE-2019-1000002

CVE-2019-1000002 concerns Gitea

CVE-2019-1000002

Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to "any"...

CVE-2019-1000002: Undefined Security Weakness

Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to "any"...

PT-2019-11256

Name of the Vulnerable Software and Affected Versions: Gitea versions 1.6.2 and earlier Description: The issue is related to Incorrect Access Control in the Delete/Edit file functionality, allowing an attacker to delete files outside the repository they have access to. This can be exploited by...

FreeBSD : gitea -- multiple vulnerabilities (41c1cd6f-2645-11e9-b5f1-080027fee39c)

Gitea Team reports : Disable redirect for i18n Only allow local login if password is non-empty Fix go-get URL generation C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and...

PT-2019-11534 · Gitea +1 · Gitea +1

Name of the Vulnerable Software and Affected Versions: Gitea versions 1.7.0 and earlier Description: The issue allows an attacker to execute arbitrary JavaScript in a victim's browser through a Cross Site Scripting XSS attack. This is achieved by having the victim open a specifically crafted URL,...

PT-2022-6563 · Gitea +1 · Gitea +1

Name of the Vulnerable Software and Affected Versions: Gitea versions prior to 1.7.0 Description: A Server Side Request Forgery SSRF issue exists, allowing a remote attacker to exploit the vulnerability using a specially crafted OpenID URL. This can lead to sensitive information about the local...

gitea -- multiple vulnerabilities

Gitea Team reports: Disable redirect for i18n Only allow local login if password is non-empty Fix go-get URL generation...

FreeBSD : gitea -- multiple vulnerabilities (7f6146aa-2157-11e9-9ba0-4c72b94353b5)

Gitea Team reports : Do not display the raw OpenID error in the UI When redirecting clean the path to avoid redirecting to external site Prevent DeleteFilePost doing arbitrary deletion C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the...

gitea -- multiple vulnerabilities

Gitea Team reports: Do not display the raw OpenID error in the UI When redirecting clean the path to avoid redirecting to external site Prevent DeleteFilePost doing arbitrary deletion...

FreeBSD : gitea -- insufficient privilege check (63e36475-119f-11e9-aba7-080027fee39c)

The Gitea project reports : Security - Prevent DeleteFilePost doing arbitrary deletion C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and contributors Redistribution and u...

gitea -- insufficient privilege check

The Gitea project reports: Security Prevent DeleteFilePost doing arbitrary deletion...

FreeBSD : gitea -- privilege escalation, XSS (29d34524-0542-11e9-a444-080027fee39c)

The Gitea project reports : Security - Sanitize uploaded file names - HTMLEncode user added text C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors...

Remote Code Execution (RCE)

github.com/go-gitea/gitea is vulnerable to remote code execution RCE attacks. The vulnerability exists due to the lack of sanitization on file names, where uploading a malicious file allows attacker to become another user and subsequently using hooks to perform RCE attacks...

gitea -- privilege escalation, XSS

The Gitea project reports: Security Sanitize uploaded file names HTMLEncode user added text...

Gitea Detection (HTTP)

HTTP based detection of Gitea. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.141676";...

Gitea < 1.5.3 RCE Vulnerability

Gitea is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gitea:gitea"; if...

Remote Code Execution (RCE)

github.com/go-gitea/gitea is vulnerable to remote code execution RCE attacks. The library does not properly validate session IDs, allowing a malicious user to authenticate as another arbitrary account...