gitea -- multiple vulnerabilities

The Gitea Team reports for release 1.13.3: Turn default hash password algorithm back to pbkdf2 from argon2 until we find a better one The Gitea Team reports for release 1.13.4: Fix issue popups...

Gitea 1.7.5 Remote Code Execution

Exploit Title: Gitea 1.7.5 - Remote Code Execution Date: 2020-05-11 Exploit Author: 1F98D Original Author: LoRexxar Software Link: https://gitea.io/en-us/ Version: Gitea before 1.7.6 and 1.8.x before 1.8-RC3 Tested on: Debian 9.11 x64 CVE: CVE-2019-11229 References:...

Gitea 1.7.5 - Remote Code Execution

Exploit Title: Gitea 1.7.5 - Remote Code Execution Date: 2020-05-11 Exploit Author: 1F98D Original Author: LoRexxar Software Link: https://gitea.io/en-us/ Version: Gitea before 1.7.6 and 1.8.x before 1.8-RC3 Tested on: Debian 9.11 x64 CVE: CVE-2019-11229 References:...

FreeBSD : gitea -- multiple vulnerabilities (2739b88b-4b88-11eb-a4c0-08002734b9ed)

The Gitea Team reports for release 1.13.1 : - Hide private participation in Orgs - Fix escaping issue in diff C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2021 Jacques Vidrine and contributo...

gitea -- multiple vulnerabilities

The Gitea Team reports for release 1.13.1: Hide private participation in Orgs Fix escaping issue in diff...

PT-2021-17853 · Gitea +1 · Gitea +1

Name of the Vulnerable Software and Affected Versions: Gitea versions 1.12.x through 1.13.3 Gitea versions 1.1.0 through 1.12.5 Description: The issue allows for cross-site scripting XSS via certain issue data in some situations. It also enables authenticated remote code execution through the git...

FreeBSD : gitea -- multiple vulnerabilities (b99492b2-362b-11eb-9f86-08002734b9ed)

The Gitea Team reports for release 1.13.0 : - Add Allow-/Block-List for Migrate and Mirrors - Prevent git operations for inactive users - Disallow urlencoded new lines in git protocol paths if there is a port - Mitigate Security vulnerability in the git hook feature - Disable DSA ssh keys by...

gitea -- multiple vulnerabilities

The Gitea Team reports for release 1.13.0: Add Allow-/Block-List for Migrate and Mirrors Prevent git operations for inactive users Disallow urlencoded new lines in git protocol paths if there is a port Mitigate Security vulnerability in the git hook feature Disable DSA ssh keys by default Set TLS...

[ASA-202011-26] gitea: insufficient validation

Arch Linux Security Advisory ASA-202011-26 ========================================== Severity: Medium Date : 2020-11-26 CVE-ID : CVE-2020-28991 Package : gitea Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-1299 Summary ======= The package gitea before...

Privilege Escalation

gitea is vulnerable to escalation of privilege. An attacker is able to get a TCP port number through a git protocol path in ParseRemoteAddr in modules/auth/repoform.go...

CVE-2020-28991

Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines with URL encoding in ParseRemoteAddr in modules/auth/repoform.go...

CVE-2020-28991

Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines with URL encoding in ParseRemoteAddr in modules/auth/repoform.go...

Path traversal

Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines with URL encoding in ParseRemoteAddr in modules/auth/repoform.go...

CVE-2020-28991

Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines with URL encoding in ParseRemoteAddr in modules/auth/repoform.go...

CVE-2020-28991

Gitea 0.9.99 through 1.12.x before 1.12.6 is vulnerable due to ParseRemoteAddr handling of a git protocol path containing a TCP port and encoded newlines, enabling partial SSRF. The issue affects the gitea repository server implementation and can be triggered by crafted Git URLs. Upstream fix: up...

PT-2020-17077 · Gitea +1 · Gitea +1

Name of the Vulnerable Software and Affected Versions: Gitea versions 0.9.99 through 1.12.x before 1.12.6 Description: The issue arises from the failure to prevent a git protocol path that specifies a TCP port number and also contains newlines with URL encoding in ParseRemoteAddr in...

FreeBSD : gitea -- multiple vulnerabilities (55facdb0-2c24-11eb-9aac-08002734b9ed)

The Gitea Team reports for release 1.12.6 : - Prevent git operations for inactive users - Disallow urlencoded new lines in git protocol paths if there is a port C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database :...

Gitea Security Vulnerabilities

Gitea is a lightweight Go-based git service developed by the Gitea community. A security vulnerability exists in Gitea versions 0.9.99 through 1.12.x series prior to 1.12.6, which stems from will not prevent the git protocol path from specifying a TCP port number and also contains line breaks wit...

gitea -- multiple vulnerabilities

The Gitea Team reports for release 1.12.6: Prevent git operations for inactive users Disallow urlencoded new lines in git protocol paths if there is a port...

Gitea >= 1.1.0, <= 1.12.5 RCE Vulnerability

Gitea is prone to a remote code execution RCE vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...