GO-2022-0862 Gitea Improper Input Validation in github.com/go-gitea/gitea

Gitea Improper Input Validation in github.com/go-gitea/gitea...

GO-2022-0846 Gitea Remote Code Execution in github.com/go-gitea/gitea

Gitea Remote Code Execution in github.com/go-gitea/gitea...

GO-2022-0579 Open redirect in Gitea in github.com/go-gitea/gitea

Open redirect in Gitea in github.com/go-gitea/gitea...

GO-2022-0314 Cross-site Scripting in Gitea in github.com/go-gitea/gitea

Cross-site Scripting in Gitea in github.com/go-gitea/gitea...

Open Redirect

github.com/go-gitea/gitea is vulnerable to Open Redirect. The vulnerability exists due to improper path sanitization in the RedirectToFirst function, which allows an attacker to pass a crafted POST request, redirecting the victim to a malicious site...

Remote Code Execution (RCE)

github.com/go-gitea/gitea is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of the newPullRequest function in the giteauploader.go file allowing an attacker to inject maliciously crafted script into the system...

Authorization Bypass

github.com/go-gitea/gitea is vulnerable to authorization bypass. The vulnerability exists in the Auth function in pam.go due to missing checks in the pam module, allowing a malicious attacker to log in and perform unauthorized actions...

Cross Site Scripting (XSS)

github.com/go-gitea/gitea is vulnerable to cross-site scripting XSS. The vulnerability exists due to the lack of sanitization in the repository settings in the setting.go file allows the attacker to inject and execute arbitrary Javascript via the URL field in the external wiki/issue tracker...

Cross-Site Scripting (XSS)

github.com/go-gitea/gitea is susceptible to cross-site scripting XSS attacks. The search query and wiki page title parameters are not escaped properly, allowing an attacker to inject and execute arbitrary code through it...

Unauthorized Modification Of Data

github.com/go-gitea/gitea is vulnerable to unauthorized deletion of user emails. A malicious user can modify the HTTP post requests to delete another user's email...

Timing Attacks

github.com/go-gitea/gitea is vulnerable to timing attacks. This vulnerability is caused because the passwords are not compared in constant time, allowing malicious users to guess the valid passwords based on the time that a comparison takes...