2953 matches found
gitea -- Fix XSS vulnerabilities
Problem Description: The Wiki page did not sanitize author name the reviewer name on a "dismiss review" comment is also affected the migration page has some spots...
FreeBSD : gitea -- Prevent anonymous container access (bd7592a1-cbfd-11ee-a42a-5404a6f3ca32)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the bd7592a1-cbfd-11ee-a42a-5404a6f3ca32 advisory. - Even with RequireSignInView enabled, anonymous users can use docker pull to fetch public images...
Albabat, Kasseika, Kuiper: New Ransomware Gangs Rise with Rust and Golang
Cybersecurity researchers have detected in the wild yet another variant of the Phobos ransomware family known as Faust. Fortinet FortiGuard Labs, which detailed the latest iteration of the ransomware, said it's being propagated by means of an infection that delivers a Microsoft Excel document .XL...
gitea -- Prevent anonymous container access
Problem Description: Even with RequireSignInView enabled, anonymous users can use docker pull to fetch public images...
GitLab 8.15 < 14.1.7 / 14.2 < 14.2.5 / 14.3 < 14.3.1 (CVE-2021-39867)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigger Server Side Request Forgery SSRF attacks. CVE-2021-39867...
Gitea: Multiple Vulnerabilities
Background Gitea is a painless self-hosted Git service. Description Multiple vulnerabilities have been discovered in Gitea. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known workaround at...
GLSA-202312-13 : Gitea: Multiple Vulnerabilities
The remote host is affected by the vulnerability described in GLSA-202312-13 Gitea: Multiple Vulnerabilities - Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4. CVE-2023-3515 Note that Nessus has not tested for this issue but has instead relied only on the application's...
FreeBSD : gitea -- Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin (b2765c89-a052-11ee-bed2-596753f1a87c)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the b2765c89-a052-11ee-bed2-596753f1a87c advisory. - The Gitea team reports: Update golang.org/x/crypto b2765c89-a052-11ee-bed2-596753f1a87c Note that...
gitea -- Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin
The Gitea team reports: Update golang.org/x/crypto...
Authentication Bypass
gitea is vulnerable to Authentication Bypass. The vulnerability is caused when docker login uses basic authentication, which allows an attacker to bypass 2FA authentication...
WS-2023-0433
Important Cookie without Secure flag in GitHub repository go-gitea/gitea prior to 1.20.5...
FreeBSD : gitea -- block user account creation from blocked email domains (4061a4b2-4fb1-11ee-acc7-0151f07bc899)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4061a4b2-4fb1-11ee-acc7-0151f07bc899 advisory. - The Gitea team reports: check blocklist for emails when adding them to account 4061a4b2-4fb1-11ee-...
gitea -- missing permission checks
The Gitea team reports: Fix missing check Do some missing checks By crafting an API request, attackers can access the contents of issues even though the logged-in user does not have access rights to these issues...
gitea -- block user account creation from blocked email domains
The Gitea team reports: check blocklist for emails when adding them to account...
FreeBSD : gitea -- information disclosure (36a37c92-44b1-11ee-b091-6162c1274384)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 36a37c92-44b1-11ee-b091-6162c1274384 advisory. - The Gitea team reports: Fix API leaking Usermail if not logged in The API should only return the real...
Gitea 1.20.x < 1.20.1 RCE Vulnerability
Gitea is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gitea:gitea";...
Gitea erroneous repo clones
In Gitea through 1.17.1, repo cloning can occur in the migration function...
GHSA-8J3V-68W3-3848 Gitea erroneous repo clones
In Gitea through 1.17.1, repo cloning can occur in the migration function...
