There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are
    mishandled. (CVE-2022-42968)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage
    will take significant time to parse. (CVE-2022-32149)

  - Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are
    mishandled. (CVE-2022-42968)

遠端主機受到 GLSA-202210-14 中所述的弱點影響 (Gitea：多個弱點)

  - GitHub 存放庫 go-gitea/gitea 1.16.9 之前版本存在儲存型跨網站指令碼弱點 (XSS)。(CVE-2022-1928)

  - 攻擊者可藉由建構一個需要 ParseAcceptLanguage 花大量時間剖析的 Accept-Language 標頭來造成程式拒絕服務。(CVE-2022-32149)

  - 在 1.16.9 版之前的 Gitea 中，使用者可以將現有問題新增至專案。由於存取控制不當，攻擊者可將任何問題指派給 Gitea 中的任何專案 (擷取問題時沒有權限檢查)。因此，攻擊者可存取私人問題標題。
    (CVE-2022-38183)

  - 1.17.3 版之前的 Gitea 未執行清理便逸出 git 後端中的參照。對於 git 命令的引數處理不當。(CVE-2022-42968)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程主机受到 GLSA-202210-14 中所述漏洞的影响（Gitea：多个漏洞）

  - 跨站脚本 (XSS) - 存储在 1.16.9 之前的 GitHub 存储库 go-gitea/gitea 中。(CVE-2022-1928)

  - 攻击者可构建需要 ParseAcceptLanguage 花费大量时间来解析的 Accept-Language 标头，从而造成拒绝服务。(CVE-2022-32149)

  - 在 1.16.9之前的 Gitea 中，用户可以向项目添加现有问题。由于访问控制不当，攻击者可以将任何问题分配给 Gitea 中的任何项目（没有用于提取问题的权限检查）。因此，攻击者将获得访问隐私问题标题的权限。
    (CVE-2022-38183)

  - 1.17.3 之前的 Gitea 不会审查和转义 git 后端中的引用。对 git 命令的参数的处理不当。(CVE-2022-42968)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

The remote host is affected by the vulnerability described in GLSA-202210-14 (Gitea: Multiple Vulnerabilities)

  - Cross-site Scripting (XSS) - Stored in GitHub repository go-gitea/gitea prior to 1.16.9. (CVE-2022-1928)

  - An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage     will take significant time to parse. (CVE-2022-32149)

  - In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper     access controls, an attacker could assign any issue to any project in Gitea (there was no permission check     for fetching the issue). As a result, the attacker would get access to private issue titles.
    (CVE-2022-38183)

  - Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are     mishandled. (CVE-2022-42968)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
419825	SCA: security update for github.com/go-gitea/gitea (GHSA-w8xw-7crf-h23x)	Tenable Self-Hosted Container Security	SCA Checks	2025/1/23	2026/7/2	critical
404676	Alpine: multiple gitea packages: security update to 1.17.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	critical
419825	SCA: security update for github.com/go-gitea/gitea (GHSA-w8xw-7crf-h23x)	Tenable Cloud Security	SCA Checks	2025/1/23	2026/7/2	critical
404676	Alpine: multiple gitea packages: security update to 1.17.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	critical
426457	Alpine: multiple gitea packages: security update to 1.17.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2025/5/16	2025/12/16	critical
426457	Alpine: multiple gitea packages: security update to 1.17.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2025/5/16	2025/12/16	critical
166729	GLSA-202210-14：Gitea：多個弱點	Nessus	Gentoo Local Security Checks	2022/10/31	2023/10/6	critical
166729	GLSA-202210-14 : Gitea：多个漏洞	Nessus	Gentoo Local Security Checks	2022/10/31	2023/10/6	critical
166729	GLSA-202210-14 : Gitea: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2022/10/31	2023/10/6	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical