Skip to content
OpenAdvisories

Package · Go

code.gitea.io/gitea

123 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

48 results · Clear filters · Feed

  • Medium 6.5
    CVE-2022-38795

    Gitea erroneous repo clones

    In Gitea through 1.17.1, repo cloning can occur in the migration function.

    code.gitea.io/gitea Go
  • Medium 6.5
    CVE-2022-38183

    Gitea allowed assignment of private issues

    In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker…

    code.gitea.io/gitea golang-code.gitea-git golang-code.gitea-sdk Ubuntu Go
  • Medium 4.4
    CVE-2022-1928

    Cross-site Scripting (XSS) - Stored in go-gitea/gitea

    Cross-site Scripting (XSS) - Stored in GitHub repository go-gitea/gitea prior to 1.16.9.

    go-gitea go-gitea/gitea code.gitea.io/gitea Go
  • Medium 5.3
    CVE-2021-29134

    Path Traversal in Gitea

    The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL.

    code.gitea.io/gitea gitea Alpine Go
  • Medium 6.5
    CVE-2022-0905

    Missing Authorization in go-gitea/gitea

    Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4.

    go-gitea go-gitea/gitea code.gitea.io/gitea Go
  • Medium 6.1
    CVE-2019-1010261

    Gitea XSS Vulnerability

    Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack ve…

    Gitea Gitea code.gitea.io/gitea golang-code.gitea-git Ubuntu Go
  • Medium 6.1
    CVE-2019-1010314

    Gitea XSS Vulnerability in Repository Description

    Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and…

    Gitea Gitea code.gitea.io/gitea golang-code.gitea-git Ubuntu Go
  • Medium 6.5
    CVE-2019-1000002

    Gitea Arbitrary File Delete Vulnerability

    Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the atta…

    code.gitea.io/gitea Go