Theonedev Onedev
23 CVEs affecting Theonedev Onedev. Latest disclosed: 2026-06-18. Critical: 9, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-21245 | Critical | 10.0 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) t… |
CVE-2021-21242 | Critical | 10.0 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. At… |
CVE-2021-21244 | Critical | 10.0 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean… |
CVE-2021-21243 | Critical | 10.0 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes two methods that deserialize untrusted data from th… |
CVE-2022-39206 | Critical | 9.9 | 2022-09-13 | Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. When using Docker-based job executors, the Docker socket (e.g. /var/run/docker.sock on… |
CVE-2021-21249 | Critical | 9.6 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is an issue involving YAML parsing which can lead to post-auth remote code execu… |
CVE-2021-21248 | Critical | 9.6 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec i… |
CVE-2021-21247 | Critical | 9.6 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the application's BasePage registers an AJAX event listener (`AbstractPostAjaxBehavior… |
CVE-2022-39205 | Critical | 9.0 | 2022-09-13 | Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. In versions of Onedev prior to 7.3.0 unauthenticated users can take over a OneDev insta… |
CVE-2021-21246 | High | 8.6 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only admini… |
CVE-2023-24828 | High | 8.1 | 2023-02-08 | Onedev is a self-hosted Git Server with CI/CD and Kanban. In versions prior to 7.9.12 the algorithm used to generate access token and password reset keys was n… |
CVE-2021-21251 | High | 7.7 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3 there is a critical "zip slip" vulnerability. This issue may lead to arbitrary file wri… |
CVE-2021-21250 | High | 7.7 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which may lead to arbitrary file read. When BuildSpe… |
CVE-2024-45309 | High | 7.5 | 2024-10-21 | OneDev is a Git server with CI/CD, kanban, and packages. A vulnerability in versions prior to 11.0.9 allows unauthenticated users to read arbitrary files acces… |
CVE-2022-39208 | High | 7.5 | 2022-09-13 | Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. All files in the /opt/onedev/sites/ directory are exposed and can be read by unauthenti… |
CVE-2026-11441 | Medium | 6.3 | 2026-06-06 | A vulnerability was identified in theonedev onedev up to 15.0.5. This vulnerability affects the function canAccessIssue of the file /issues/ of the component P… |
CVE-2026-11440 | Medium | 6.3 | 2026-06-06 | A vulnerability was determined in theonedev onedev up to 15.0.5. This affects an unknown part of the file /repositories/{projectId}/default-branch of the compo… |
CVE-2026-11439 | Medium | 6.3 | 2026-06-06 | A vulnerability was found in theonedev onedev up to 15.0.5. Affected by this issue is some unknown functionality of the file /projects/ of the component Parent… |
CVE-2026-11438 | Medium | 6.3 | 2026-06-06 | A vulnerability has been found in theonedev onedev up to 15.0.5. Affected by this vulnerability is an unknown functionality of the file /projects. The manipula… |
CVE-2022-39207 | Medium | 5.4 | 2022-09-13 | Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. During CI/CD builds, it is possible to save build artifacts for later retrieval. They c… |