Vendor
Octopus Deploy
87 known vulnerabilities.
Products
Octopus Server 79
Octopus Tentacle 4
Codefresh 1
OctopusDSC 1
Kubernetes Worker or Kubernetes Agent 1
Halibut 1
Octopus Deploy < 2022.4.8377 0
Octopus Deploy 0
Octopus Deploy < 2022.3.10750 0
Octopus Deploy < 2022.4.8221 0
Octopus Deploy < 2022.2.8552 0
Octopus Deploy < 2022.3.11098 0
Octopus Deploy < 2022.4.8463 0
Octopus Deploy < 2023.1.9672 0
Octopus Deploy < 2023.2.2394 0
Octopus Deploy < 2023.1.10235 0
Octopus Deploy < 2023.1.9879 0
Octopus Deploy < 2023.2.8159 0
Octopus Deploy < 2022.4.8319 0
Octopus Deploy < 2023.1.4189 0
Octopus Deploy < 2022.3.11043 0
Octopus Deploy < 2022.4.8401 0
Octopus Deploy < 2023.1.9794 0
Octopus Deploy < 2022.4.8332 0
Octopus Deploy < 2022.3.10957 0
Octopus Deploy < 2023.1.11942 0
Octopus Deploy < 2023.2.13151 0
Octopus Deploy < 2023.3.5049 0
Octopus Deploy < 2022.4.9997 0
Octopus Deploy < 2023.2.10545 0
28 results · Clear filters · Feed
-
Medium 5.3
In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call…
-
Medium 5.1
In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a …
-
Medium 5.1
In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user t…
-
Medium 5.6
In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Paylo…
-
Medium 6.0
In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user bein…
-
Medium 5.9
In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API…
-
Medium 5.9
In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests t…
-
Medium 5.9
In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all s…
-
Medium 6.9
In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible fo…
-
Medium 6.5
In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes …
-
Medium 6.5
In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed…
-
Medium 4.1
In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting paylo…
-
Medium 4.3
It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt.
-
Medium 4.2
In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during th…
-
Medium 5.5
In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows en…
-
Medium 5.5
In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoi…
-
Medium 5.3
In affected versions of Octopus Deploy it is possible to discover network details via error message
-
Medium 5.5
In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Ser…
-
Medium 5.3
In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage
-
Medium 4.3
In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned perm…
-
Medium 4.3
In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned …
-
Medium 5.4
In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in …
-
Medium 6.1
In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to byp…
-
Medium 5.3
In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user doe…
-
Medium 6.5
In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure …
-
Medium 5.3
In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, s…
-
Medium 4.3
In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have acce…
-
Medium 6.2
Cleartext Storage of Sensitive Information
OctopusDSC is a PowerShell module with DSC resources that can be used to install and configure an Octopus Deploy Server and Tentacle agent. In OctopusDSC version 4.0.977 and earlier a customer API key used to connect to Octopus Server is exposed via logging i…