(#Several vulnerabilities have been identified in cgit:#- CVE-2016-1899: reflected cross-site scripting. A remote attacker can exploit it in order to execute arbitrary Javascript or HTML code by inciting their victim into following a specially formed link. The vulnerability can be exploited via the "Mimetype" query string##- CVE-2016-1900: persistent cross-site scripting. A remote attacker can exploit it in order to execute arbitrary Javascript or HTML code. The vulnerability is located in the "filename" parameter##- CVE-2016-1901: integer overflow. A remote attacker could exploit it in order to cause a denial of service or potentially execute arbitrary code. The vulnerability is located in the "open_auth_filter" function of the "cgit.c" source file.##The cgit packages provided by Debian Jessie 8 are vulnerable.)
