1990 matches found
CVE-2022-1928 Cross-site Scripting (XSS) - Stored in go-gitea/gitea
Cross-site Scripting XSS - Stored in GitHub repository go-gitea/gitea prior to 1.16.9...
CVE-2022-1928
CVE-2022-1928 affects go-gitea/gitea up to version 1.16.9, with stored Cross-site Scripting in user-facing content. The vulnerability is caused by unfiltered/pdf content handling that allows attacker-supplied data to be stored and later rendered in a web page, enabling XSS. Multiple connected sou...
Gitea 跨站脚本漏洞
Gitea is a lightweight Go-based git service developed by the Gitea community. cross-site scripting vulnerabilities exist in versions of Gitea prior to 1.16.9. No detailed vulnerability details are currently available...
PT-2022-14196 · Gitea +1 · Gitea +1
Name of the Vulnerable Software and Affected Versions: gitea versions prior to 1.16.9 Description: The issue is related to Stored Cross-site Scripting XSS in the GitHub repository go-gitea/gitea. This occurs via unfiltered pdfs. Recommendations: For versions prior to 1.16.9, update to version...
GHSA-Q98C-RQX7-7GHF Improper handling of untrusted branches in Gitea Jenkins Plugin
Jenkins Gitea Plugin prior to 1.1.2 did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted...
Improper handling of untrusted branches in Gitea Jenkins Plugin
Jenkins Gitea Plugin prior to 1.1.2 did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted...
Reposaur - The Open Source Compliance Tool For Development Platforms
Reposaur is the open sourcecompliance tool for development platforms. Audit, verify and report on your data and configurations easily with pre-defined and/or custom policies. Supports GitHub. GitLab, BitBucket and Gitea support soon. Getting Started Have you ever felt like you don't know what's...
GHSA-5RH7-6GFJ-MC87 Gitea XSS Vulnerability
Gitea 1.7.0 and earlier is affected by: Cross Site Scripting XSS. The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically...
Gitea XSS Vulnerability
Gitea 1.7.0 and earlier is affected by: Cross Site Scripting XSS. The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically...
Gitea XSS Vulnerability in Repository Description
Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting XSS. The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page...
GHSA-HQX2-J33X-9FC4 Gitea XSS Vulnerability in Repository Description
Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting XSS. The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page...
Gitea Allows 1FA Even for 2FA-Enrolled Accounts
Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password...
GHSA-3393-R4P5-VHQH Gitea Allows 1FA Even for 2FA-Enrolled Accounts
Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password...
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Gitea 1.7.0 and earlier is affected by: Cross Site Scripting XSS. The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically...
Gitea XSS Vulnerability in Repository Description
Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting XSS. The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page...
Gitea Allows 1FA Even for 2FA-Enrolled Accounts
Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password...
Exploit for Improper Encoding or Escaping of Output in Gitea
🍵 CVE-2022-30781 Gitea repository migration remote command exe...
Gitea < 1.16.7 Privilege Escalation Vulnerability
Gitea is prone to a privilege escalation vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...
Remote Code Execution (RCE)
github.com/go-gitea/gitea is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of the newPullRequest function in the giteauploader.go file allowing an attacker to inject maliciously crafted script into the system...