Betroffene Versionslinien
Bekannte Schwachstellen
| CVE | Titel | Betroffene Versionen | CVSS | Ausgenutzt | EPSS | Veröffentlicht |
|---|---|---|---|---|---|---|
| CVE-2026-49248 | OneDev: RCE through absolute-path symlink following allows low-privileged users to overwrite arbitrary server... | * | 8.3 | — | 2026-06-19 | |
| CVE-2026-11441 | theonedev Pull Request issues canAccessIssue improper authorization | = 15.0.0 = 15.0.1 = 15.0.2 | 5.3 | — | 2026-06-07 | |
| CVE-2026-11440 | theonedev REST API default-branch improper authorization | = 15.0.0 = 15.0.1 = 15.0.2 | 5.3 | — | 2026-06-07 | |
| CVE-2026-11439 | theonedev Parent Project projects improper authorization | = 15.0.0 = 15.0.1 = 15.0.2 | 5.3 | — | 2026-06-07 | |
| CVE-2026-11438 | theonedev projects improper authorization | = 15.0.0 = 15.0.1 = 15.0.2 | 5.3 | — | 2026-06-07 | |
| CVE-2026-44647 | OneDev: Path Traversal (read capability via Git LFS pointer resolution) | * | 7.1 | — | 2026-05-15 | |
| CVE-2024-45309 | OneDev vulnerable to arbitrary file reading for unauthenticated user | * | 8.7 | — | 2024-10-21 | |
| CVE-2023-24828 | Use of Cryptographically Weak Pseudo-Random Number Generator in Onedev | * | 8.1 | — | 2023-02-08 | |
| CVE-2022-38301 | Onedev v7.4.14 contains a path traversal vulnerability which allows attackers to access restricted files and d... | * | — | — | 2022-09-15 | |
| CVE-2022-39206 | CI/CD Docker Escape in OneDev | * | 9.9 | — | 2022-09-14 | |
| CVE-2022-39207 | Persistent XSS in OneDev | * | 5.4 | — | 2022-09-14 | |
| CVE-2022-39208 | Git Repository Disclosure in Onedev | * | 7.5 | — | 2022-09-14 | |
| CVE-2022-39205 | Access Control Bypass in Onedev | * | 9.0 | — | 2022-09-14 | |
| CVE-2021-32651 | LDAP injection via OneDev may leak some LDAP directory information | * | 3.1 | — | 2021-06-02 | |
| CVE-2021-21245 | Pre-Auth Arbitrary File Upload | * | 10.0 | — | 2021-01-16 | |
| CVE-2021-21246 | Pre-Auth Access token leak | * | 8.6 | — | 2021-01-16 | |
| CVE-2021-21247 | Post-Auth Unsafe Deserialization on BasePage (AJAX) | * | 9.6 | — | 2021-01-16 | |
| CVE-2021-21249 | Post-Auth Unsafe Yaml deserialization | * | 9.6 | — | 2021-01-16 | |
| CVE-2021-21248 | Post-Auth Arbitrary Code execution via Groovy script injection | * | 9.6 | — | 2021-01-16 | |
| CVE-2021-21250 | Post-Auth External Entity Expansion (XXE) | * | 7.7 | — | 2021-01-16 | |
| CVE-2021-21251 | ZipSlip Arbitrary File Upload | * | 7.7 | — | 2021-01-16 | |
| CVE-2021-21242 | Pre-Auth Unsafe Deserialization on AttachmentUploadServet | * | 10.0 | — | 2021-01-16 | |
| CVE-2021-21243 | Pre-Auth Unsafe Deserialization on KubernetesResource | * | 10.0 | — | 2021-01-16 | |
| CVE-2021-21244 | Pre-Auth SSTI via Bean validation message tampering | * | 10.0 | — | 2021-01-16 |
Verfolgen Sie diese Versionen auf Ihren eigenen Servern
InfraGuard erfasst die installierten Softwareversionen auf jedem Server und markiert diejenigen mit bekannten Schwachstellen. Self-Hosted – nichts verlässt Ihr Netzwerk.
Daten: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (siehe EPSS unter https://www.first.org/epss), endoflife.date. Softwareliste: awesome-selfhosted (CC BY-SA 3.0).