CVE-2019-11228

CVE-2019-11228 (Gitea) affects the Go project github.com/go-gitea/gitea. The root cause is improper input validation in repo/setting.go: before SaveAddress, the code does not validate form.MirrorAddress, which can lead to unintended effects. Affected versions are Gitea before 1.7.6 and 1.8.x befo...

CVE-2019-11228

repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress...

gitea -- remote code execution

The Gitea team reports: Prevent remote code execution vulnerability with mirror repo URL settings...

PT-2019-12203 · Gitea +1 · Gitea +1

Name of the Vulnerable Software and Affected Versions: Gitea versions 1.7.0 through 1.7.5 Gitea versions 1.8.0 through 1.8-RC2 Description: The issue arises from the mishandling of mirror repository URL settings in the models/repo mirror.go file, leading to remote code execution. This allows an...

PT-2019-12202 · Go Gitea +1 · Gitea +1

Name of the Vulnerable Software and Affected Versions: Gitea versions 1.7.0 through 1.7.6 Gitea versions 1.8.0 through 1.8-RC2 Description: The issue arises from improper input validation in the form.MirrorAddress before calling the SaveAddress function. This lack of validation can lead to...

FreeBSD : gitea -- XSS vulnerability (a8ba7358-4b02-11e9-9ba0-4c72b94353b5)

Gitea Team reports : Fix potential XSS vulnerability in repository description. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and contributors Redistribution and use in...

Stored Cross-site Scripting (XSS)

github.com/go-gitea/gitea is vulnerable to stored cross-site scripting XSS. It does not escape the description in DescriptionHTML function, allowing the attacker to inject malicious HTML through it...

Gitea 1.7.3 HTML Injection

Gitea 1.7.3 stored HTML injection XSS Information =========== Name: Gitea 1.7.0 - 1.7.3 stored HTML injection Software: Gitea - a self-hosted Git service Homepage: https://gitea.io/ Vulnerability: stored HTML injection Affected: 1.7.0 - 1.7.3 Tested: 1.7.2, 1.7.3 Fixed: 1.7.4 Prerequisites: edit...

gitea -- XSS vulnerability

Gitea Team reports: Fix potential XSS vulnerability in repository description...

Gitea < 1.6.3 Improper Access Control Vulnerability

Gitea is prone to an improper access control vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gitea:gitea"; if...

Improper access control

Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to "any"...

CVE-2019-1000002

Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to "any"...

CVE-2019-1000002

Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to "any"...

CVE-2019-1000002

Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to "any"...

CVE-2019-1000002

CVE-2019-1000002 concerns Gitea

FreeBSD : gitea -- multiple vulnerabilities (41c1cd6f-2645-11e9-b5f1-080027fee39c)

Gitea Team reports : Disable redirect for i18n Only allow local login if password is non-empty Fix go-get URL generation C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and...

PT-2019-11534 · Gitea +1 · Gitea +1

Name of the Vulnerable Software and Affected Versions: Gitea versions 1.7.0 and earlier Description: The issue allows an attacker to execute arbitrary JavaScript in a victim's browser through a Cross Site Scripting XSS attack. This is achieved by having the victim open a specifically crafted URL,...

PT-2022-6563 · Gitea +1 · Gitea +1

Name of the Vulnerable Software and Affected Versions: Gitea versions prior to 1.7.0 Description: A Server Side Request Forgery SSRF issue exists, allowing a remote attacker to exploit the vulnerability using a specially crafted OpenID URL. This can lead to sensitive information about the local...

gitea -- multiple vulnerabilities

Gitea Team reports: Disable redirect for i18n Only allow local login if password is non-empty Fix go-get URL generation...

FreeBSD : gitea -- multiple vulnerabilities (7f6146aa-2157-11e9-9ba0-4c72b94353b5)

Gitea Team reports : Do not display the raw OpenID error in the UI When redirecting clean the path to avoid redirecting to external site Prevent DeleteFilePost doing arbitrary deletion C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the...