Vulnerabilities > Gitea > Critical
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-10-16 | CVE-2022-42968 | Argument Injection or Modification vulnerability in Gitea Gitea before 1.17.3 does not sanitize and escape refs in the git backend. | 9.8 |
| 2022-02-09 | CVE-2021-45330 | Incomplete Cleanup vulnerability in Gitea An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and the session remains valid on the server side for reuse. | 9.8 |
| 2022-02-09 | CVE-2021-45331 | Improper Authentication vulnerability in Gitea An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. | 9.8 |
| 2022-02-08 | CVE-2021-45327 | Interpretation Conflict vulnerability in Gitea Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. | 9.8 |
| 2020-11-24 | CVE-2020-28991 | Unspecified vulnerability in Gitea Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines (with URL encoding) in ParseRemoteAddr in modules/auth/repo_form.go. | 9.8 |
| 2019-04-28 | CVE-2019-11576 | Improper Authentication vulnerability in Gitea Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. | 9.8 |
| 2018-11-04 | CVE-2018-18926 | Session Fixation vulnerability in Gitea Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. | 9.8 |