theonedev

Records24All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical9CVSS 9.0–10.0

CVSS high9CVSS 7.0–8.9

Exploited now

theonedev records in CISA KEV

No theonedev vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Onedev 18 records HIGH

Records

18 records in Onedev · all components

TI-2021-04345 CVE-2021-21242

Pre-Auth Unsafe Deserialization on AttachmentUploadServet

HIGH 81

OneDev is an all-in-one devops platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.74191 Published 2021-01-15 Fixed in 4.0.3 CWE-74

TI-2022-18585 CVE-2022-39206

CI/CD Docker Escape in OneDev

HIGH 76

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.02194 Published 2022-09-13 Fixed in 7.3.0 CWE-610

TI-2022-18584 CVE-2022-39205

Access Control Bypass in Onedev

HIGH 76

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02461 Published 2022-09-13 Fixed in 7.3.0 CWE-287

TI-2021-04346 CVE-2021-21243

Pre-Auth Unsafe Deserialization on KubernetesResource

HIGH 75

OneDev is an all-in-one devops platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.54494 Published 2021-01-15 Fixed in 4.0.3 CWE-74

TI-2022-18587 CVE-2022-39208

Git Repository Disclosure in Onedev

HIGH 72

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01935 Published 2022-09-13 Fixed in 7.3.0 CWE-552

TI-2021-04349 CVE-2021-21246

Pre-Auth Access token leak

HIGH 68

OneDev is an all-in-one devops platform.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.49051 Published 2021-01-15 Fixed in 4.0.3 CWE-862

TI-2024-30380 CVE-2024-45309

OneDev vulnerable to arbitrary file reading for unauthenticated user

MEDIUM 59

OneDev is a Git server with CI/CD, kanban, and packages.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.24531 Published 2024-10-21 Fixed in 11.0.9 CWE-200

TI-2022-18586 CVE-2022-39207

Persistent XSS in OneDev

MEDIUM 58

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01029 Published 2022-09-13 Fixed in 7.3.0 CWE-79

TI-2021-04354 CVE-2021-21251

ZipSlip Arbitrary File Upload

MEDIUM 52

OneDev is an all-in-one devops platform.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.12681 Published 2021-01-15 Fixed in 4.0.3 CWE-22

TI-2021-04352 CVE-2021-21249

Post-Auth Unsafe Yaml deserialization

MEDIUM 47

OneDev is an all-in-one devops platform.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.03059 Published 2021-01-15 Fixed in 4.0.3 CWE-74

TI-2021-04347 CVE-2021-21244

Pre-Auth SSTI via Bean validation message tampering

MEDIUM 46

OneDev is an all-in-one devops platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01513 Published 2021-01-15 Fixed in 4.0.3 CWE-74

TI-2021-04348 CVE-2021-21245

Pre-Auth Arbitrary File Upload

MEDIUM 45

OneDev is an all-in-one devops platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01213 Published 2021-01-15 Fixed in 4.0.3 CWE-434

TI-2021-04351 CVE-2021-21248

Post-Auth Arbitrary Code execution via Groovy script injection

MEDIUM 44

OneDev is an all-in-one devops platform.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.01469 Published 2021-01-15 Fixed in 4.0.3 CWE-74

TI-2021-04350 CVE-2021-21247

Post-Auth Unsafe Deserialization on BasePage (AJAX)

MEDIUM 44

OneDev is an all-in-one devops platform.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.01521 Published 2021-01-15 Fixed in 4.0.3 CWE-74

TI-2023-10328 CVE-2023-24828

Use of Cryptographically Weak Pseudo-Random Number Generator in Onedev

MEDIUM 41

Onedev is a self-hosted Git Server with CI/CD and Kanban.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00713 Published 2023-02-07 Fixed in 7.9.12 CWE-338

TI-2022-17958 CVE-2022-38301 · GHSA-q2x9-c2ph-g22q

Onedev v7.4.14 contains a path traversal vulnerability which allows attackers to access…

MEDIUM 41

Onedev v7.4.14 contains a path traversal vulnerability which allows attackers to access restricted files and directories via uploading a crafted JAR file into the directory /opt/onedev/lib.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01431 Published 2022-09-14 No fix listed CWE-22

TI-2021-04353 CVE-2021-21250

Post-Auth External Entity Expansion (XXE)

LOW 35

OneDev is an all-in-one devops platform.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00943 Published 2021-01-15 Fixed in 4.0.3 CWE-538

TI-2021-12319 CVE-2021-32651 · GHSA-r89m-qpxm-ccgx

LDAP injection via OneDev may leak some LDAP directory information

LOW 22

OneDev is a development operations platform.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01069 Published 2021-06-01 No fix listed CWE-90

Open these records in search →

Critical	9
High	9
Medium	6
Low	0
No CVSS	0