CVE-2023-3515 Open Redirect in go-gitea/gitea

Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4...

CVE-2023-3515

CVE-2023-3515 is an Open Redirect in go-gitea/gitea prior to 1.19.4. The issue involves a redirect mechanism (redirect_to) that can cause a 302 redirect to an untrusted site, enabling potential user redirection to a malicious domain. Affected product: Gitea (Git service) with the vulnerable path ...

CVE-2023-3515 Open Redirect in go-gitea/gitea

Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4...

PT-2023-25169 · Gitea +1 · Gitea +1

Name of the Vulnerable Software and Affected Versions: gitea versions prior to 1.19.4 Description: The issue is an Open Redirect vulnerability in the GitHub repository go-gitea/gitea. This vulnerability is most likely a post-auth redirect and is a POST-based request scenario, making it less likel...

CVE-2023-3515: URL Redirection to Untrusted Site

Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4...

Gitea 输入验证错误漏洞

Gitea is a lightweight Go-based git service developed by the Gitea community. An input validation error vulnerability exists in Gitea versions prior to 1.19.4, which stems from improper input validation of the program. An attacker can exploit this vulnerability to obtain sensitive information...

gitea -- Disallow dangerous URL schemes

The Gitea team reports: Disallow javascript, vbscript and data data uri images still work url schemes even if all other schemes are allowed...

gitea -- avoid open HTTP redirects

The Gitea team reports: If redirectto parameter has set value starting with \example.com redirect will be created with header Location: /\example.com that will redirect to example.com domain...

gitea -- multiple issues

The Gitea team reports: Test if container blob is accessible before mounting. Set type="password" on all authtoken fields Seen when migrating from other hosting platforms. Prevents exposing the token to screen capture/cameras/eyeballs. Prevents the browser from saving the value in its autocomplet...

gitea -- information disclosure

The Gitea team reports: Fix API leaking Usermail if not logged in The API should only return the real Mail of a User, if the caller is logged in. The check do to this don't work. This PR fixes this. This not really a security issue, but can lead to Spam...

The vulnerability of the Git repository management system Gitea, related to insufficient validation of incoming requests, allows a hacker to execute an SSRF attack.

The vulnerability of the Git repository management system Gitea is related to insufficient validation of incoming requests. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack using a specially crafted link based on the OpenID standard...

The vulnerability of the Git repository management system Gitea’s interface allows a attacker to perform a CSRF attack.

The vulnerability of the Git repository management system Gitea relates to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to execute a CSRF attack by sending specially crafted POST requests...

The vulnerability of the Git repository management system Gitea lies in its ability to bypass authentication procedures by using capture-replay techniques for intercepted parameters. This allows attackers to circumvent security restrictions, gain unauthorized access to read, modify, or delete data, or execute arbitrary code.

The vulnerability of the Git repository management system Gitea relates to exploiting a authentication process by using capture-replay techniques to intercept and replay captured parameters. Exploiting this vulnerability allows an attacker operating remotely to circumvent security restrictions,...

Gitea < 1.19.3 Multiple golang Vulnerabilities

Gitea is prone to multiple vulnerabilities in golang. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gitea:gitea"; ifdescription...

The vulnerability of the Git repository management system Gitea, related to the use of open redirection, allows a hacker to redirect a user to any arbitrary URL address.

The vulnerability of the Git repository management system Gitea is related to the use of open redirection. Exploiting this vulnerability could allow a malicious actor to redirect a user to an arbitrary URL address...

FreeBSD : gitea -- password hash quality (5048ed45-b0f1-11ed-ab04-9106b1b896dd)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 5048ed45-b0f1-11ed-ab04-9106b1b896dd advisory. - The Gitea team reports: This PR refactors and improves the password hashing code within gitea and mak...

Gitea < 1.18.3 Information Disclosure Vulnerability

Gitea is prone to an information disclosure vulnerability. Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; yo...

FreeBSD : gitea -- information disclosure (b8a0fea2-9be9-11ed-8acf-0800277bb8a8)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the b8a0fea2-9be9-11ed-8acf-0800277bb8a8 advisory. - The Gitea team reports: Prevent multiple To recipients: Change the mailer interface to prevent leakin...

FreeBSD : gitea -- multiple issues (d0da046a-81e6-11ed-96ca-0800277bb8a8)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the d0da046a-81e6-11ed-96ca-0800277bb8a8 advisory. - The Gitea team reports: Do not allow Ghost access to limited visible user/org Fix package access for...

Jenkins Gitea Plugin vulnerable to Cleartext Transmission of Sensitive Information

In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them through the build log. Gitea Plugin 1.4.5 adds support for masking of Gitea personal access tokens. Administrators unable to update are...