gitea

3 results · Clear filters · Feed

• Critical 9.8
  CVE-2022-42968

  Gitea vulnerable to Argument Injection

  Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled.

  code.gitea.io/gitea github.com/go-gitea/gitea gitea Alpine Go
  Oct 16, 2022
• Critical 9.8
  CVE-2021-45331

  Reuse of one time passwords allowed in Gitea

  An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once.

  code.gitea.io/gitea gitea Alpine Go
  Feb 9, 2022
• Critical 9.8
  CVE-2021-45327

  Capture-replay in Gitea

  Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a remote malisious user execute arbitrary code.

  code.gitea.io/gitea github.com/go-gitea/gitea gitea golang-code.gitea-git Ubuntu Alpine Go
  Feb 8, 2022