CVE-2021-39867

In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigger Server Side Request Forgery SSRF attacks...

CVE-2021-39867

CVE-2021-39867 affects GitLab CE/EE since v8.15, due to a DNS rebinding vulnerability in the Gitea Importer that can enable Server-Side Request Forgery (SSRF). Impact is partial confidentiality/integrity and network-exposed risk; no exploitation details are provided beyond the SSRF description. R...

PT-2021-22714 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.15 and later Description: A DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigger Server Side Request Forgery SSRF attacks. This issue allows an attacker to potentially access interna...

GitLab 代码问题漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug list, and more. A code issue vulnerability exists in GitLab, which stems...

Cross-site Scripting in Gitea

Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations...

GHSA-G95P-88P4-76CM Cross-site Scripting in Gitea

Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations...

FreeBSD : gitea -- multiple vulnerabilities (d3180f02-031e-11ec-875f-0800273f11ea)

The Gitea Team reports for release 1.15.0 : - Encrypt LDAP bind password in db with SECRETKEY 15547 - Remove random password in Dockerfiles 15362 - Upgrade to the latest version of golang-jwt and increase minimum go to 1.15 16590 16606 - Correctly create of git-daemon-export-ok files 16508 16514 ...

FreeBSD : gitea -- multiple vulnerabilities (733afd81-01cf-11ec-aec9-0800273f11ea)

The Gitea Team reports for release 1.14.6 : - Bump github.com/markbates/goth from v1.67.1 to v1.68.0 16538 16540 - Switch to maintained JWT lib 16532 16535 - Upgrade to latest version of golang-jwt as forked for 1.14 16590 16607 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Exploit for Cross-site Scripting in Gitea

CVE-2021-28378 Details about this CVE herehttps://www.cved...

gitea -- multiple vulnerabilities

The Gitea Team reports for release 1.14.6: Bump github.com/markbates/goth from v1.67.1 to v1.68.0 16538 16540 Switch to maintained JWT lib 16532 16535 Upgrade to latest version of golang-jwt as forked for 1.14 16590 16607...

FreeBSD : gitea -- multiple vulnerabilities (943d23b6-e65e-11eb-ad30-0800273f11ea)

The Gitea Team reports for release 1.14.5 : - Hide mirror passwords on repo settings page 16022 16355 - Update bluemonday to v1.0.15 16379 16380 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML databa...

FreeBSD : gitea -- multiple vulnerabilities (0e561c06-d13a-11eb-92be-0800273f11ea)

The Gitea Team reports for release 1.14.3 : - Encrypt migration credentials at rest 15895 16187 - Only check access tokens if they are likely to be tokens 16164 16171 - Add missing SameSite settings for the ilikegitea cookie 16037 16039 - Fix setting of SameSite on cookies 15989 15991 %NASLMINLEV...

Denial Of Service (DoS)

github.com/go-gitea/gitea and x/net/html of github.com/golang/go are vulnerable to Denial Of Service DoS. An infinite loop is caused when an attacker sends a malicious input to ParseFragment...

gitea -- multiple vulnerabilities

The Gitea Team reports for release 1.14.5: Hide mirror passwords on repo settings page 16022 16355 Update bluemonday to v1.0.15 16379 16380...

gitea -- multiple vulnerabilities

The Gitea Team reports for release 1.14.3: Encrypt migration credentials at rest 15895 16187 Only check access tokens if they are likely to be tokens 16164 16171 Add missing SameSite settings for the ilikegitea cookie 16037 16039 Fix setting of SameSite on cookies 15989 15991...

Path Traversal

gitea is vulnerable to path traversal. The vulnerability exists due to the parameter "file = .. /" encoded in base64...

gitea -- multiple vulnerabilities

The Gitea Team reports for release 1.15.0: Encrypt LDAP bind password in db with SECRETKEY 15547 Remove random password in Dockerfiles 15362 Upgrade to the latest version of golang-jwt and increase minimum go to 1.15 16590 16606 Correctly create of git-daemon-export-ok files 16508 16514 Don't sho...

FreeBSD : gitea -- multiple vulnerabilities (8ba23a62-997d-11eb-9f0e-0800278d94f0)

The Gitea Team reports for release 1.13.7 : - Update to bluemonday-1.0.6 - Clusterfuzz found another way C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2021 Jacques Vidrine and contributors...

FreeBSD : gitea -- multiple vulnerabilities (094fb2ec-9aa3-11eb-83cb-0800278d94f0)

The Gitea Team reports for release 1.14.0 : - Validate email in external authenticator registration form - Ensure validation occurs on clone addresses too C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database :...