Advisories · Technology
onedev.
Every CVE that names onedev among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.3 High
OneDev: RCE through absolute-path symlink following allows low-privileged users to overwrite arbitrary server via TarUtils.untar
- onedev
- CWE-61
- CVSS 5.3 Medium
theonedev Pull Request issues canAccessIssue improper authorization
- onedev
- Privilege escalation
- Broken access control
- CVSS 5.3 Medium
theonedev REST API default-branch improper authorization
- onedev
- Privilege escalation
- Broken access control
- CVSS 5.3 Medium
theonedev Parent Project projects improper authorization
- onedev
- Privilege escalation
- Broken access control
- CVSS 5.3 Medium
theonedev projects improper authorization
- onedev
- Privilege escalation
- Broken access control
- CVSS 7.1 High
OneDev: Path Traversal (read capability via Git LFS pointer resolution)
- onedev
- Path traversal
- CVSS 8.7 HighCritical · CVSS 7+ and EPSS
OneDev vulnerable to arbitrary file reading for unauthenticated user
- onedev
- Information disclosure
- CVSS 8.1 High
Use of Cryptographically Weak Pseudo-Random Number Generator in Onedev
- onedev
- Weak cryptography or TLS
- CVSS 9.9 CriticalCritical · CVSS 9+
CI/CD Docker Escape in OneDev
- onedev
- CWE-610
- CVSS 5.4 Medium
Persistent XSS in OneDev
- onedev
- Cross-site scripting (XSS)
- CVSS 7.5 High
Git Repository Disclosure in Onedev
- onedev
- Information disclosure
- CVSS 9.0 CriticalCritical · CVSS 9+
Access Control Bypass in Onedev
- onedev
- Authentication bypass
- CVSS 3.1 Low
LDAP injection via OneDev may leak some LDAP directory information
- onedev
- Other injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Pre-Auth Arbitrary File Upload
- onedev
- Unrestricted file upload
- CVSS 8.6 HighCritical · CVSS 7+ and EPSS
Pre-Auth Access token leak
- onedev
- Broken access control
- CVSS 9.6 CriticalCritical · CVSS 9+
Post-Auth Unsafe Deserialization on BasePage (AJAX)
- onedev
- Other injection
- CVSS 9.6 CriticalCritical · CVSS 9+
Post-Auth Unsafe Yaml deserialization
- onedev
- Other injection
- CVSS 9.6 CriticalCritical · CVSS 9+
Post-Auth Arbitrary Code execution via Groovy script injection
- onedev
- Other injection
- CVSS 7.7 High
Post-Auth External Entity Expansion (XXE)
- onedev
- Information disclosure
- CVSS 7.7 HighCritical · CVSS 7+ and EPSS
ZipSlip Arbitrary File Upload
- onedev
- Path traversal
- CVSS 10.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Pre-Auth Unsafe Deserialization on AttachmentUploadServet
- onedev
- Other injection
- CVSS 10.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Pre-Auth Unsafe Deserialization on KubernetesResource
- onedev
- Other injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Pre-Auth SSTI via Bean validation message tampering
- onedev
- Other injection