All CVEs — page 278 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
Gitea's Git client validates initial remote URLs but fails to revalidate destinations after HTTP redirects, allowing attackers to bypass outbound host policies and redirect requests to otherwise blocked internal services. This creates a potential vector for unauthorized access to internal systems through repository configuration.
The flaw allows a user with Actions write access to bypass the approval requirement by canceling and re-running a workflow, potentially leading to unauthorized execution of code from a fork pull request.
This vulnerability allows a user to execute fork-controlled workflow code by manipulating Gitea Actions runs, requiring maintainer approval to exploit fully.
A Gitea Actions concurrency cancellation flaw allows attackers to interrupt in-progress trusted runs without approval by creating pull requests from forks, potentially disrupting deployments on self-hosted runners.
A team's permission level was not properly enforced after API updates, allowing members to retain higher-level access than granted. This creates a privilege escalation risk where users maintain write permissions beyond their assigned team role.
The flaw allows an attacker to exploit a case-insensitive SQL `LIKE` comparison in Gitea's SSH server, potentially matching a crafted public key to a victim's account and gaining SSH access.