https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T19:46:42.028036+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2021-05131 cnvd-2021-05131 2026-10-07T19:46:42.030871+00:00 cnvd-2021-05131 https://cve.radiocsirt.org/vuln/euvd-2026-22122 EUVD-2026-22122 2026-10-07T19:46:42.030906+00:00 EUVD-2026-22122 https://cve.radiocsirt.org/vuln/fkie_cve-2021-21245 fkie_cve-2021-21245 2026-10-07T19:46:42.030920+00:00

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary file upload which can be used to upload a WebShell to OneDev server. This issue is addressed in 4.0.3 by only allowing uploaded file to be in attachments folder. The webshell issue is not possible as OneDev never executes files in attachments folder.

 https://cve.radiocsirt.org/vuln/gsd-2021-21245 gsd-2021-21245 2026-10-07T19:46:42.030953+00:00 gsd-2021-21245