gitea vulnerabilities (Bitnami)
73 vulnerabilities.
-
giteaBitnami Gitea repository media API stored XSS 6.1 Medium -
giteaBitnami Gitea push-to-create bypass of FORCE_PRIVATE policy 5.4 Medium -
giteaBitnami Gitea issue attachment API allows changing comment attachments 4.3 Medium -
giteaBitnami Gitea tag delete route deletes releases without release permission 8.1 High -
giteaBitnami Gitea migration memory exhaustion from zero page size 6.5 Medium -
giteaBitnami Gitea OAuth2 refresh token grant accepts access tokens 9.1 Critical -
giteaBitnami Gitea push mirror API bypass of DISABLE_NEW_PUSH policy 4.9 Medium -
giteaBitnami Gitea push mirror local path check uses the repository owner 7.1 High -
giteaBitnami Gitea WebAuthn bypass during OAuth and OIDC sign-in 9.8 Critical -
giteaBitnami Gitea private repository access retained after rejected transfer 4.3 Medium -
giteaBitnami Gitea Actions memory exhaustion through large static matrices 7.5 High -
giteaBitnami Gitea installer authentication bypass for existing accounts 8.1 High -
giteaBitnami Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS 4.3 Medium -
giteaBitnami Gitea denial of service through external issue tracker patterns 7.5 High -
giteaBitnami Gitea issue reference parsing CPU exhaustion 6.5 Medium -
giteaBitnami Gitea fork workflow approval bypass through maintainer-triggered events 9.8 Critical -
giteaBitnami Gitea deploy key pushes acting as the repository owner 7.1 High -
giteaBitnami Gitea repository migration SSRF through DNS rebinding 7.5 High -
giteaBitnami Gitea SSRF through Git HTTP redirects in mirrors and fetches 7.5 High -
giteaBitnami Gitea review and execution mismatch through duplicate tree entries 9.1 Critical -
giteaBitnami Gitea push mirror SSRF and forced writes to internal Git hosts 8.1 High -
giteaBitnami Gitea trusted workflow cancellation by unapproved fork runs 7.5 High -
giteaBitnami Gitea container registry stored XSS through blob media type 5.4 Medium -
giteaBitnami Gitea migration and pull mirror SSRF through multi-answer DNS 4.3 Medium -
giteaBitnami Gitea migration SSRF through ALLOWED_DOMAINS address check bypass 7.7 High -
giteaBitnami Gitea fork workflow job revival through later approval 8.8 High -
giteaBitnami Gitea built-in SSH server authentication bypass through key case folding 9.1 Critical -
giteaBitnami Gitea fork workflow approval bypass through cancel and rerun 8.8 High -
giteaBitnami Gitea: Remote Code Execution via diffpatch Git Hook Installation 9.8 Critical -
giteaBitnami SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata 7.5 High -
giteaBitnami Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass 8.3 High -
giteaBitnami Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure 9.1 Critical -
giteaBitnami Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes 6.5 Medium -
giteaBitnami Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR) 9.1 Critical -
giteaBitnami Gitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass) 4.3 Medium -
giteaBitnami Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure 6.5 Medium -
giteaBitnami Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation 6.5 Medium -
giteaBitnami Gitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR) 9.1 Critical -
giteaBitnami Gitea Web Attachment Deletion: Cross-Repository Unauthorized Deletion via Missing Repo Ownership Check 7.5 High -
giteaBitnami Gitea Release Email Notifications Leak Private Repository Release Details After Access Revocation 3.5 Low -
giteaBitnami Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists 5.3 Medium -
giteaBitnami Gitea vulnerable to Cross-site Scripting 5.4 Medium -
giteaBitnami Gitea: anonymous user can visit private user's project 5.8 Medium -
giteaBitnami Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries 5.0 Medium -
giteaBitnami Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order 5.3 Medium -
giteaBitnami Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text 5.4 Medium -
giteaBitnami Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources 4.9 Medium -
giteaBitnami Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. 3.1 Low -
giteaBitnami Gitea allows attackers to add attachments with forbidden file extensions 8.2 High -
giteaBitnami Gitea mishandles authorization for deletion of releases 4.3 Medium - Show olderLoading…