https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 06:41:08 +0000 https://cve.radiocsirt.org/vuln/cnvd-2021-05131 cnvd-2021-05131 https://cve.radiocsirt.org/vuln/cnvd-2021-05131 https://cve.radiocsirt.org/vuln/euvd-2026-22122 EUVD-2026-22122 https://cve.radiocsirt.org/vuln/euvd-2026-22122 https://cve.radiocsirt.org/vuln/fkie_cve-2021-21245 <p>OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader(&#34;File-Name&#34;)`). This issue may lead to arbitrary file upload which can be used to upload a WebShell to OneDev server. This issue is addressed in 4.0.3 by only allowing uploaded file to be in attachments folder. The webshell issue is not possible as OneDev never executes files in attachments folder.</p> <p>OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader(&#34;File-Name&#34;)`). This issue may lead to arbitrary file upload which can be used to upload a WebShell to OneDev server. This issue is addressed in 4.0.3 by only allowing uploaded file to be in attachments folder. The webshell issue is not possible as OneDev never executes files in attachments folder.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-21245 https://cve.radiocsirt.org/vuln/gsd-2021-21245 gsd-2021-21245 https://cve.radiocsirt.org/vuln/gsd-2021-21245