Design/Logic Flaw

Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email...

CVE-2018-1000803

Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email...

CVE-2018-1000803

Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email...

CVE-2018-1000803

The CVE refers to Gitea prior to v1.5.1, where a CWE-200 information-disclosure flaw allows exposure of users’ private email addresses. According to connected sources, the issue can be triggered via the “Watch a repository” email-notification flow, causing emails to include recipients’ addresses ...

CVE-2018-1000803

Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email...

PT-2018-9528 · Gitea · Gitea

Name of the Vulnerable Software and Affected Versions: Gitea versions prior to 1.5.1 Description: The issue results in the exposure of users' private email addresses. This can be exploited by watching a repository to receive email notifications, which contain the other recipients even if they hav...

gitea -- multiple vulnerabilities

Gitea project reports: CSRF Vulnerability on API. Enforce token on api routes...

FreeBSD : Information disclosure - Gitea leaks email addresses (7c750960-b129-11e8-9fcd-080027f43a02)

The Gitea project reports : Privacy Gitea leaks hidden email addresses 4417 A fix has been implemented in Gitea 1.5.1. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and...

FreeBSD : gitea -- TOTP passcode reuse (bcf56a42-9df8-11e8-afb0-589cfc0f81b0)

The Gitea project reports : TOTP passcodes can be reused. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors Redistribution and use in source VuXML and...

Server side request forgery (ssrf)

An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services...

CVE-2018-15192

An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services...

CVE-2018-15192

An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services...

CVE-2018-15192

CVE-2018-15192 is an SSRF vulnerability in the webhook handling of Gitea (up to 1.5.0-rc2) and Gogs (up to 0.11.53) . The issue arises when webhook URLs are processed, allowing an attacker to trigger requests from the vulnerable server to internal (intranet) services. Multiple sources describe th...

CVE-2018-15192

An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services...

PT-2018-12939 · Gogs +1 · Gogs +1

Name of the Vulnerable Software and Affected Versions: Gitea versions through 1.5.0-rc2 Gogs versions through 0.11.53 Description: A Server-Side Request Forgery SSRF issue in webhooks affects Gitea and Gogs, allowing remote attackers to access intranet services. Recommendations: For Gitea version...

Information disclosure - Gitea leaks email addresses

The Gitea project reports: Privacy Gitea leaks hidden email addresses 4417 A fix has been implemented in Gitea 1.5.1...

Gitea 1.4.0 - Remote Code Execution

Gitea 1.4.0 - Remote Code Execution pip install PyJWT requests pip install dulwich==0.19.0 from requests import Request, Session, get, post import jwt import time import base64 import os import re import time import threading import random import string import urlparse import urllib from dulwich...

Gitea 1.4.0 - Remote Code Execution

pip install PyJWT requests pip install dulwich==0.19.0 from requests import Request, Session, get, post import jwt import time import base64 import os import re import time import threading import random import string import urlparse import urllib from dulwich import porcelain print "Gitea 1.4.0"...

Open Redirect

github.com/go-gitea/gitea is vulnerable to open redirect attacks. The vulnerability exists due to the lack of checking on the redirected URL, allowing redirection to external sites...

PT-2018-3871

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.4.3 Description The issue is related to an open redirect vulnerability, which allows an attacker to redirect users to an untrusted site via internal URLs. This can be exploited by a remote attacker to redirect users t...