Skip to content
OpenAdvisories

Archive

15 January 2021

Vulnerabilities first published on this day (UTC), newest first.

← December 2020 2021 / January /15 February 2021 →
  1. 119
  2. 22
  3. 38
  4. 445
  5. 548
  6. 660
  7. 757
  8. 895
  9. 92
  10. 10 
  11. 1184
  12. 12178
  13. 13172
  14. 1429
  15. 1552
  16. 16 
  17. 172
  18. 1814
  19. 1948
  20. 20242
  21. 2172
  22. 2254
  23. 231
  24. 242
  25. 2539
  26. 2653
  27. 2744
  28. 2831
  29. 2969
  30. 304
  31. 311
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 10.0
    CVE-2021-21245

    Pre-Auth Arbitrary File Upload

    OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary fil…

    theonedev onedev
  • Critical 9.6
    CVE-2021-21247

    Post-Auth Unsafe Deserialization on BasePage (AJAX)

    OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the application's BasePage registers an AJAX event listener (`AbstractPostAjaxBehavior`) in all pages other than the login page. This listener decodes and deserializes the `data` query p…

    theonedev onedev
  • Critical 9.6
    CVE-2021-21249

    Post-Auth Unsafe Yaml deserialization

    OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is an issue involving YAML parsing which can lead to post-auth remote code execution. In order to parse and process YAML files, OneDev uses SnakeYaml which by default (when not usi…

    theonedev onedev
  • Critical 9.6
    CVE-2021-21248

    Post-Auth Arbitrary Code execution via Groovy script injection

    OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec is used to define parameters of a Build spec. It does so by using dynamically generated Groovy classe…

    theonedev onedev
  • Critical 10.0
    CVE-2021-21242 EPSS 74%

    Pre-Auth Unsafe Deserialization on AttachmentUploadServet

    OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` header. This Servlet…

    theonedev onedev
  • Critical 10.0
    CVE-2021-21243 EPSS 54%

    Pre-Auth Unsafe Deserialization on KubernetesResource

    OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes two methods that deserialize untrusted data from the request body. These endpoints do not enforce any authentication or authorization checks. This issu…

    theonedev onedev
  • Critical 10.0
    CVE-2021-21244

    Pre-Auth SSTI via Bean validation message tampering

    OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean validation message tampering. Full details in the reference GHSA. This issue was fixed in 4.0.3 by …

    theonedev onedev
  • Critical 10.0
    CVE-2021-0211

    Junos OS and Junos OS Evolved: Upon receipt of a specific BGP FlowSpec message network traffic may be disrupted.

    An improper check for unusual or exceptional conditions in Juniper Networks Junos OS and Junos OS Evolved Routing Protocol Daemon (RPD) service allows an attacker to send a valid BGP FlowSpec message thereby causing an unexpected change in the route advertise…

    Juniper Networks Junos OS Junos OS Evolved Network devices