gitea -- multiple vulnerabilities

The Gitea Team reports for release 1.13.0: Add Allow-/Block-List for Migrate and Mirrors Prevent git operations for inactive users Disallow urlencoded new lines in git protocol paths if there is a port Mitigate Security vulnerability in the git hook feature Disable DSA ssh keys by default Set TLS...

Git LFS Remote Code Execution (CVE-2020-27955)

A remote code execution vulnerability exists in Git LFS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

@fengshangwuqi/appkit (>=1.0.22, <=1.0.29), @koj/strapi (>=1.4.1, <=1.4.3) +30 more potentially affected by CVE-2021-23362 via hosted-git-info (>=3.0.0, <=3.0.7)

hosted-git-info NPM version =3.0.0, =1.0.22, =1.4.1, =0.1.0, =4.0.0, =1.0.0, =3.0.0, =0.0.0-2020520224551, =0.1.0, =0.0.0-2020520224551, =0.0.0-2020520224551, =0.1.0, =0.0.0-2020520224551, =0.1.0, =0.0.0-2020520224551, =0.1.0, =0.1.10 and more Source cves: CVE-2021-23362 Source advisory:...

421752593pro (5.6.0), @concisejs/docz-theme-ext (>=0.0.1, <=0.0.3) +81 more potentially affected by CVE-2021-23362 via hosted-git-info (>=2.1.5, <=2.8.8)

hosted-git-info NPM version =2.1.5, =0.0.1, =0.1.0, =1.3.13, =3.0.0, =2.0.0, =1.16.0, =0.0.2, =2.3.1, =1.0.0, =1.0.0, =1.3.0, =1.3.16 and more Source cves: CVE-2021-23362 Source advisory: SNYK:JS-HOSTEDGITINFO-1088355...

Regular Expression Denial of Service (ReDoS)

Overview hosted-git-info is a Provides metadata and conversions from repository urls for Github, Bitbucket and Gitlab Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via regular expression shortcutMatch in the fromUrl function in index.js. The affect...

vulhub

This repository is an open-source collection of pre-built vulnerable docker environments. It is an offensive tool for web application security testing. The primary CVE ID present in the context is not explicitly stated, but the repository contains various vulnerable environments, including ones...

Exploit for Uncontrolled Search Path Element in Git_Large_File_Storage_Project Git_Large_File_Storage

CVE-2020-27955 Thanks h...

CVE-2020-28991

Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines with URL encoding in ParseRemoteAddr in modules/auth/repoform.go...

CVE-2020-28991

Gitea 0.9.99 through 1.12.x before 1.12.6 is vulnerable due to ParseRemoteAddr handling of a git protocol path containing a TCP port and encoded newlines, enabling partial SSRF. The issue affects the gitea repository server implementation and can be triggered by crafted Git URLs. Upstream fix: up...

CVE-2020-28991

Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines with URL encoding in ParseRemoteAddr in modules/auth/repoform.go...

PT-2020-17077 · Gitea +1 · Gitea +1

Name of the Vulnerable Software and Affected Versions: Gitea versions 0.9.99 through 1.12.x before 1.12.6 Description: The issue arises from the failure to prevent a git protocol path that specifies a TCP port number and also contains newlines with URL encoding in ParseRemoteAddr in...

FreeBSD : gitea -- multiple vulnerabilities (55facdb0-2c24-11eb-9aac-08002734b9ed)

The Gitea Team reports for release 1.12.6 : - Prevent git operations for inactive users - Disallow urlencoded new lines in git protocol paths if there is a port C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database :...

Gitea Security Vulnerabilities

Gitea is a lightweight Go-based git service developed by the Gitea community. A security vulnerability exists in Gitea versions 0.9.99 through 1.12.x series prior to 1.12.6, which stems from will not prevent the git protocol path from specifying a TCP port number and also contains line breaks wit...

PT-2020-5727 · Nats.Io · Nats Server

Name of the Vulnerable Software and Affected Versions: github.com/nats-io/nats-server/server versions prior to a fixed version Description: The issue is related to an uncontrolled resource consumption in the NATS messaging system server. This can be exploited by a remote attacker to cause a denia...

Mail.ru: Exposed Git Repo at https://mini-app.delivery-club.ru

Leaking sensitive application data in configuration files at mini-app.delivery-club.ru...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure. When importing repos via URL, one time use git credentials were persisted beyond the expected time window. Remediation Upgrade gitaly to version 13.3.9, 13.4.5, 13.5.2 or higher...

DEBIAN-CVE-2020-13353

When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above...

CVE-2020-13353

When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above...

CVE-2020-13353

When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above...

Design/Logic Flaw

When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above...