gitea -- Improper/incorrect authorization

Youssef Rebahi-Gilbert reports: When Gitea is built and configured for PAM authentication it skips checking authorization completely. Therefore expired accounts and accounts with expired passwords can still login...

Gitea Exposes Private Email Addresses

Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email...

Gitea Improper Input Validation

repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress. Specific Go Packages Affected github.com/go-gitea/gitea/models...

Gitea Remote Code Execution

models/repomirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution...

GHSA-Q47X-6MQQ-4W92 Gitea Improper Input Validation

repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress. Specific Go Packages Affected github.com/go-gitea/gitea/models...

GHSA-HF6F-JQ25-8GQ9 Gitea Remote Code Execution (RCE)

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron...

GHSA-F5FJ-7265-JXHJ Gitea Exposes Private Email Addresses

Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email...

Gitea Remote Code Execution (RCE)

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron...

GHSA-HPMR-PRR2-CQC4 Gitea Remote Code Execution

models/repomirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution...

GHSA-G2QX-6GHW-67HM Denial of Service in Gitea

An issue was discovered in Gitea in which an attacker can trigger a deadlock by initiating a transfer of a repository's ownership from one organization to another...

Denial of Service in Gitea

An issue was discovered in Gitea in which an attacker can trigger a deadlock by initiating a transfer of a repository's ownership from one organization to another...

Session Fixation

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron...

gitea -- password hash quality

The Gitea team reports: This PR refactors and improves the password hashing code within gitea and makes it possible for server administrators to set the password hashing parameters. In addition it takes the opportunity to adjust the settings for pbkdf2 in order to make the hashing a little...

Gitea Licensing Issue Vulnerability

Gitea is a lightweight Go-based git service developed by the Gitea community. Gitea is vulnerable to an authorization issue in versions prior to 1.5.0, which stems from the application's lack of authentication measures or insufficient authentication strength. An attacker could exploit the...

Gitea Input Validation Error Vulnerability

Gitea is a lightweight Go-based git service developed by the Gitea community. Gitea is vulnerable to an input validation error that stems from the product's failure to determine that a request originated from a trusted user, which could be exploited to send an unintended request to the server...

Gitea < 1.5.0 Authentication Bypass Vulnerability

Gitea is prone to an authentication bypass vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

Gitea < 1.4.3 Open Redirect Vulnerability

Gitea is prone to an open redirect vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Gitea Cross-Site Scripting Vulnerability (CNVD-2022-11525)

A cross-site scripting vulnerability exists in Gitea, a Go-based lightweight git service developed by the Gitea community. The vulnerability stems from a mirror setting in the product wiki/issue link that does not effectively handle special characters in the input data. An attacker could execute...

Gitea Cross-Site Request Forgery Vulnerability

Gitea is a lightweight Go-based git service developed by the Gitea community. Gitea suffers from a cross-site request forgery vulnerability, which stems from the product's multiple linked POST requests failing to properly determine that the user originated from a trusted user, and could be...

Gitea < 1.7.0 SSRF Vulnerability

Gitea is prone to a server-side request forgery SSRF vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gitea:gitea";...