Csenox

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The API scope middleware incorrectly classifies the 'GET /api/v1/user/actions/runners/registration-token' endpoint, as well as its owner- and repository-level equivalents, as read-only because it uses a GET request. However, this endpoint creates a new runner registration token if one does not already exist. An attacker possessing a leaked `read:user`-scoped token can use this behavior to generate a registration token and register a malicious Actions runner, allowing the execution of workflow jobs with access to source code and repository secrets. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gitea versions prior to 1.25.5 **Description** The software fails to scope the lookup of tracked-time entries to the specific issue provided in the request URL when searching by time ID. This flaw allows an attacker to attempt the deletion of time entries associated with a different issue than the one specified in the request. **Recommendations** Update Gitea to version 1.25.5 or later.

**Name of the Vulnerable Software and Affected Versions** Gitea versions prior to 1.25.5 **Description** A flaw allows a user to change the primary email address of another user. **Recommendations** Update to version 1.25.5 or later.