2959 matches found
Linux Distros Unpatched Vulnerability : CVE-2022-38183
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any...
Linux Distros Unpatched Vulnerability : CVE-2021-45325
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Server Side Request Forgery SSRF vulneraility exists in Gitea before 1.7.0 using the OpenID URL. CVE-2021-45325 Note that Nessus relies on the presence of the...
Linux Distros Unpatched Vulnerability : CVE-2019-1010314
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting XSS. The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The...
Linux Distros Unpatched Vulnerability : CVE-2021-45329
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross Site Scripting XSS vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field. CVE-2021-45329...
Linux Distros Unpatched Vulnerability : CVE-2021-45326
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross Site Request Forgery CSRF vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests...
Linux Distros Unpatched Vulnerability : CVE-2018-18926
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the...
io.jenkins.blueocean:blueocean-git-pipeline (>=1.2.0-beta-5, <=1.2.4), org.jenkins-ci.plugins:bitbucket-approval-filter (1.0.0) +16 more potentially affected by CVE-2025-58458 via org.jenkins-ci.plugins:git-client (2.5.0)
org.jenkins-ci.plugins:git-client MAVEN version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - io.jenkins.blueocean:blueocean-git-pipeline =1.2.0-beta-5, =2.2.3, =0.1.1, =3.5.0, =1.0.1,...
Linux Distros Unpatched Vulnerability : CVE-2021-39867
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigger Server Side Reque...
CVE-2025-54864
Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be...
CVE-2025-54864
Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be...
CVE-2025-54864 Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins
Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be...
CVE-2025-54864 Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins
Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be...
CVE-2025-54864 Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins
Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be...
PT-2025-32685 · Hydra · Hydra
Name of the Vulnerable Software and Affected Versions: Hydra versions prior to commit f7bda02 Description: Hydra is a continuous integration service for Nix based projects. The /api/push-github and /api/push-gitea API endpoints were called by their respective forges without HTTP Basic...
CVE-2025-54864: Missing Authentication for Critical Function
Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be...
CVE-2025-47907 vulnerabilities
Vulnerabilities for packages: cloudnative-pg, fulcio, victoriametrics-cluster, restic, vt-cli, gotestsum, grpcurl, apko, step-ca, sftpgo-plugin-kms, tflint, logstash, amass, kubescape, trivy, helm-operator, caddy, ghaudit, temporal, aws-node-termination-handler, kubecolor, aws-nuke, nri-mysql,...
GHSA-J5PM-7495-QMR3 vulnerabilities
Vulnerabilities for packages: cloudnative-pg, fulcio, victoriametrics-cluster, restic, vt-cli, gotestsum, grpcurl, apko, step-ca, sftpgo-plugin-kms, tflint, logstash, amass, kubescape, trivy, helm-operator, caddy, ghaudit, temporal, aws-node-termination-handler, kubecolor, aws-nuke, nri-mysql,...
Cryptojacking Campaign Exploits DevOps APIs Using Off-the-Shelf Tools from GitHub
Cybersecurity researchers have discovered a new cryptojacking campaign that's targeting publicly accessible DevOps web servers such as those associated with Docker, Gitea, and HashiCorp Consul and Nomad to illicitly mine cryptocurrencies. Cloud security firm Wiz, which is tracking the activity...
