https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 11:11:55 +0000 https://cve.radiocsirt.org/vuln/cnvd-2021-70091 cnvd-2021-70091 https://cve.radiocsirt.org/vuln/cnvd-2021-70091 https://cve.radiocsirt.org/vuln/euvd-2026-30432 EUVD-2026-30432 https://cve.radiocsirt.org/vuln/euvd-2026-30432 https://cve.radiocsirt.org/vuln/fkie_cve-2021-39132 <p>Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, an authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition. An authenticated user can make a POST request, that can cause the server to run untrusted code on Rundeck Enterprise Edition. The zip-format plugin issues requires authentication and authorization to these access levels, and affects all Rundeck editions:`admin` level access to the `system` resource type. The ACL Policy yaml file upload issues requires authentication and authorization to these access levels, and affects all Rundeck editions: `create` `update` or `admin` level access to a `project_acl` resource, and/or`create` `update` or `admin` level access to the `system_acl` resource. The unauthorized POST request requires authentication, but no specific authorization, and affects Rundeck Enterprise only. Patches are available in versions 3.4.3, 3.3.14</p> <p>Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, an authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition. An authenticated user can make a POST request, that can cause the server to run untrusted code on Rundeck Enterprise Edition. The zip-format plugin issues requires authentication and authorization to these access levels, and affects all Rundeck editions:`admin` level access to the `system` resource type. The ACL Policy yaml file upload issues requires authentication and authorization to these access levels, and affects all Rundeck editions: `create` `update` or `admin` level access to a `project_acl` resource, and/or`create` `update` or `admin` level access to the `system_acl` resource. The unauthorized POST request requires authentication, but no specific authorization, and affects Rundeck Enterprise only. Patches are available in versions 3.4.3, 3.3.14</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-39132 https://cve.radiocsirt.org/vuln/ghsa-q4rf-3fhx-88pf <p><strong>Affected:</strong> Maven: org.rundeck:rundeck-core</p> <p>### Impact</p> <p>An authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition. An authenticated user can make a POST request, that can cause the server to run untrusted code on Rundeck Enterprise Edition.</p> <p>The zip-format plugin issues requires authentication and authorization to these access levels, and affects all Rundeck editions:</p> <p>* `admin` level access to the `system` resource type</p> <p>The ACL Policy yaml file upload issues requires authentication and authorization to these access levels, and affects all Rundeck editions:</p> <p>* `create` `update` or `admin` level access to a `project_acl` resource * `create` `update` or `admin` level access to the `system_acl` resource</p> <p>The unauthorized POST request requires authentication, but no specific authorization, and affects Rundeck Enterprise only.</p> <p>### Patches Versions 3.4.3, 3.3.14</p> <p>### Workarounds</p> <p>Please visit [https://rundeck.com/security](https://rundeck.com/security) for information about specific workarounds.</p> <p>### For more information If you have any questions or comments about this advisory: * Email us at [security@rundeck.com](mailto:security@rundeck.com)</p> <p>To report security issues to Rundeck please use the form at [https://rundeck.com/security](https://rundeck.com/security)</p> <p>Reporter: Rojan Rijal from Tinder Red Te…</p> <p><strong>Affected:</strong> Maven: org.rundeck:rundeck-core</p> <p>### Impact</p> <p>An authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition. An authenticated user can make a POST request, that can cause the server to run untrusted code on Rundeck Enterprise Edition.</p> <p>The zip-format plugin issues requires authentication and authorization to these access levels, and affects all Rundeck editions:</p> <p>* `admin` level access to the `system` resource type</p> <p>The ACL Policy yaml file upload issues requires authentication and authorization to these access levels, and affects all Rundeck editions:</p> <p>* `create` `update` or `admin` level access to a `project_acl` resource * `create` `update` or `admin` level access to the `system_acl` resource</p> <p>The unauthorized POST request requires authentication, but no specific authorization, and affects Rundeck Enterprise only.</p> <p>### Patches Versions 3.4.3, 3.3.14</p> <p>### Workarounds</p> <p>Please visit [https://rundeck.com/security](https://rundeck.com/security) for information about specific workarounds.</p> <p>### For more information If you have any questions or comments about this advisory: * Email us at [security@rundeck.com](mailto:security@rundeck.com)</p> <p>To report security issues to Rundeck please use the form at [https://rundeck.com/security](https://rundeck.com/security)</p> <p>Reporter: Rojan Rijal from Tinder Red Te…</p> https://cve.radiocsirt.org/vuln/ghsa-q4rf-3fhx-88pf https://cve.radiocsirt.org/vuln/gsd-2021-39132 gsd-2021-39132 https://cve.radiocsirt.org/vuln/gsd-2021-39132