golang-code.gitea-git

3 results · Clear filters · Feed

• Critical 9.8
  CVE-2021-45327

  Capture-replay in Gitea

  Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a remote malisious user execute arbitrary code.

  code.gitea.io/gitea github.com/go-gitea/gitea gitea golang-code.gitea-git Ubuntu Alpine Go
  Feb 8, 2022
• Critical 9.8
  CVE-2019-11576

  Gitea Allows 1FA Even for 2FA-Enrolled Accounts

  Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password.

  code.gitea.io/gitea golang-code.gitea-git Ubuntu Go
  Apr 28, 2019
• Critical 9.8
  CVE-2018-18926

  Gitea Remote Code Execution (RCE)

  Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron.

  code.gitea.io/gitea golang-code.gitea-git Ubuntu Go
  Nov 4, 2018