Total
33 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-28378 | 1 Gitea | 1 Gitea | 2021-12-16 | 3.5 LOW | 5.4 MEDIUM |
| Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations. | |||||
| CVE-2021-3382 | 1 Gitea | 1 Gitea | 2021-02-08 | 5.0 MEDIUM | 7.5 HIGH |
| Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service (crash) via vectors related to a file path. | |||||
| CVE-2019-11229 | 1 Gitea | 1 Gitea | 2021-02-04 | 6.5 MEDIUM | 8.8 HIGH |
| models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution. | |||||
| CVE-2020-28991 | 1 Gitea | 1 Gitea | 2020-12-03 | 7.5 HIGH | 9.8 CRITICAL |
| Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines (with URL encoding) in ParseRemoteAddr in modules/auth/repo_form.go. | |||||
| CVE-2019-1000002 | 1 Gitea | 1 Gitea | 2020-08-24 | 5.5 MEDIUM | 6.5 MEDIUM |
| Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to "any" repository including self-created ones.. This vulnerability appears to have been fixed in 1.6.3, 1.7.0-rc2. | |||||
| CVE-2019-11576 | 1 Gitea | 1 Gitea | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password. | |||||
| CVE-2020-13246 | 1 Gitea | 1 Gitea | 2020-05-21 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Gitea through 1.11.5. An attacker can trigger a deadlock by initiating a transfer of a repository's ownership from one organization to another. | |||||
| CVE-2019-1010261 | 1 Gitea | 1 Gitea | 2019-07-19 | 4.3 MEDIUM | 6.1 MEDIUM |
| Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically crafted URL. The fixed version is: 1.7.1 and later. | |||||
| CVE-2019-1010314 | 1 Gitea | 1 Gitea | 2019-07-12 | 4.3 MEDIUM | 6.1 MEDIUM |
| Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page. | |||||
| CVE-2019-11228 | 1 Gitea | 1 Gitea | 2019-04-16 | 5.0 MEDIUM | 7.5 HIGH |
| repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress. | |||||
| CVE-2018-18926 | 1 Gitea | 1 Gitea | 2019-01-29 | 7.5 HIGH | 9.8 CRITICAL |
| Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron. | |||||
| CVE-2018-1000803 | 1 Gitea | 1 Gitea | 2019-01-08 | 5.0 MEDIUM | 5.3 MEDIUM |
| Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email set as private. This vulnerability appears to have been fixed in 1.5.1. | |||||
| CVE-2018-15192 | 2 Gitea, Gogs | 2 Gitea, Gogs | 2018-10-18 | 5.0 MEDIUM | 8.6 HIGH |
| An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services. | |||||