44 matches found
Access Control Bypass
Overview Affected versions of this package are vulnerable to Access Control Bypass due to the default configuration of REVERSEPROXYTRUSTEDPROXIES allowing all sources. An attacker can gain unauthorized access by sending spoofed reverse-proxy authentication headers such as X-WEBAUTH-USER...
Improper Input Validation
Overview Affected versions of this package are vulnerable to Improper Input Validation via insufficient validation of repository creation fields, including length-limited template fields and trust model or object format values. An attacker can submit malformed or unexpected data by providing...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via insufficient permission checks in the process handling Composer package source links. An attacker can gain unauthorized access to private or internal package source information by directly accessing these links...
Access Control Bypass
Overview Affected versions of this package are vulnerable to Access Control Bypass due to insufficient permission checks in the draft release process. An attacker can access sensitive draft release data or attachments by bypassing required write permissions. Remediation Upgrade...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the pre-receive process. An attacker can gain unauthorized write access to the entire repository by exploiting cached branch-specific write-permission results across multiple refs within a single session...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization due to improper error handling in the pre-receive process when processing input with bufio.Scanner. An attacker can bypass branch-protection checks by submitting oversized input that triggers scanner errors...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure via the /api/v1/user endpoint returning different responses for failed authentication attempts depending on whether a username exists. An attacker can enumerate valid usernames by analyzing the variations in...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure via the /api/v1/user endpoint returning different responses for failed authentication attempts depending on whether a username exists. An attacker can enumerate valid usernames by analyzing the variations in...
EUVD-2023-2029
Malicious code in bioql PyPI...
CVE-2023-3515
Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4...
CVE-2022-1928
Cross-site Scripting XSS - Stored in GitHub repository go-gitea/gitea prior to 1.16.9...
GO-2022-0862 Gitea Improper Input Validation in github.com/go-gitea/gitea
Gitea Improper Input Validation in github.com/go-gitea/gitea...
GO-2022-0846 Gitea Remote Code Execution in github.com/go-gitea/gitea
Gitea Remote Code Execution in github.com/go-gitea/gitea...
GO-2022-0579 Open redirect in Gitea in github.com/go-gitea/gitea
Open redirect in Gitea in github.com/go-gitea/gitea...
GO-2022-0314 Cross-site Scripting in Gitea in github.com/go-gitea/gitea
Cross-site Scripting in Gitea in github.com/go-gitea/gitea...
GO-2022-0309 Cross Site Request Forgery in Gitea in github.com/go-gitea/gitea
Cross Site Request Forgery in Gitea in github.com/go-gitea/gitea...
BIT-GITEA-2022-0905 Missing Authorization in go-gitea/gitea
Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4...
Open Redirect
github.com/go-gitea/gitea is vulnerable to Open Redirect. The vulnerability exists due to improper path sanitization in the RedirectToFirst function, which allows an attacker to pass a crafted POST request, redirecting the victim to a malicious site...
