GHSA-PH3W-2843-72MX Stored Cross-site Scripting in gitea

Cross-site Scripting XSS - Stored in GitHub repository go-gitea/gitea prior to 1.16.9 via unfiltered pdfs...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cross-site Scripting XSS - Stored in GitHub repository go-gitea/gitea prior to 1.16.9...

CVE-2022-1928

Cross-site Scripting XSS - Stored in GitHub repository go-gitea/gitea prior to 1.16.9...

CVE-2022-1928

Cross-site Scripting XSS - Stored in GitHub repository go-gitea/gitea prior to 1.16.9...

CVE-2022-1928 Cross-site Scripting (XSS) - Stored in go-gitea/gitea

Cross-site Scripting XSS - Stored in GitHub repository go-gitea/gitea prior to 1.16.9...

CVE-2022-1928

CVE-2022-1928 affects go-gitea/gitea up to version 1.16.9, with stored Cross-site Scripting in user-facing content. The vulnerability is caused by unfiltered/pdf content handling that allows attacker-supplied data to be stored and later rendered in a web page, enabling XSS. Multiple connected sou...

CVE-2022-1928 Cross-site Scripting (XSS) - Stored in go-gitea/gitea

Cross-site Scripting XSS - Stored in GitHub repository go-gitea/gitea prior to 1.16.9...

Gitea 跨站脚本漏洞

Gitea is a lightweight Go-based git service developed by the Gitea community. cross-site scripting vulnerabilities exist in versions of Gitea prior to 1.16.9. No detailed vulnerability details are currently available...

PT-2022-14196 · Gitea +1 · Gitea +1

Name of the Vulnerable Software and Affected Versions: gitea versions prior to 1.16.9 Description: The issue is related to Stored Cross-site Scripting XSS in the GitHub repository go-gitea/gitea. This occurs via unfiltered pdfs. Recommendations: For versions prior to 1.16.9, update to version...

GHSA-Q98C-RQX7-7GHF Improper handling of untrusted branches in Gitea Jenkins Plugin

Jenkins Gitea Plugin prior to 1.1.2 did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted...

Improper handling of untrusted branches in Gitea Jenkins Plugin

Jenkins Gitea Plugin prior to 1.1.2 did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted...

GHSA-5RH7-6GFJ-MC87 Gitea XSS Vulnerability

Gitea 1.7.0 and earlier is affected by: Cross Site Scripting XSS. The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically...

Gitea XSS Vulnerability

Gitea 1.7.0 and earlier is affected by: Cross Site Scripting XSS. The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically...

Gitea XSS Vulnerability in Repository Description

Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting XSS. The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page...

GHSA-HQX2-J33X-9FC4 Gitea XSS Vulnerability in Repository Description

Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting XSS. The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page...

Gitea Allows 1FA Even for 2FA-Enrolled Accounts

Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password...

GHSA-3393-R4P5-VHQH Gitea Allows 1FA Even for 2FA-Enrolled Accounts

Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Gitea 1.7.0 and earlier is affected by: Cross Site Scripting XSS. The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically...

Gitea XSS Vulnerability in Repository Description

Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting XSS. The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page...

Gitea Allows 1FA Even for 2FA-Enrolled Accounts

Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password...