PT-2021-14360

Name of the Vulnerable Software and Affected Versions: OneDev versions prior to 4.0.3 Description: OneDev is an all-in-one devops platform. In OneDev, there is a critical issue that may lead to arbitrary file read. When BuildSpec is provided in XML format, the spec is processed by...

CVE-2021-21250: Insertion of Sensitive Information into Externally-Accessible File or Directory

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which may lead to arbitrary file read. When BuildSpec is provided in XML format, the spec is processed by XmlBuildSpecMigrator.migratebuildSpecString; which processes the XML document withou...