Cross-Site Scripting (XSS)

github.com/go-gitea/gitea is susceptible to cross-site scripting XSS attacks. The search query and wiki page title parameters are not escaped properly, allowing an attacker to inject and execute arbitrary code through it...

gitea -- TOTP passcode reuse

The Gitea project reports: TOTP passcodes can be reused...

Information Disclosure

github.com/go-gitea/gitea is vulnerable to information disclosure. The vulnerability exists due to the lack of sanitization of sensitive information, such as passwords, in the logs of a mirrored sync...

Cross-site Scripting (XSS)

github.com/go-gitea/gitea is susceptible to cross-site scripting XSS attacks. An attack can be launched by inputing malicious script through the Name parameter since it is not sanitized properly...

Unauthorized Modification Of Data

github.com/go-gitea/gitea is vulnerable to unauthorized deletion of user emails. A malicious user can modify the HTTP post requests to delete another user's email...

Timing Attacks

github.com/go-gitea/gitea is vulnerable to timing attacks. This vulnerability is caused because the passwords are not compared in constant time, allowing malicious users to guess the valid passwords based on the time that a comparison takes...