Vendor
Octopus Deploy
87 known vulnerabilities.
Products
Octopus Server 79
Octopus Tentacle 4
Codefresh 1
OctopusDSC 1
Kubernetes Worker or Kubernetes Agent 1
Halibut 1
Octopus Deploy < 2022.4.8377 0
Octopus Deploy 0
Octopus Deploy < 2022.3.10750 0
Octopus Deploy < 2022.4.8221 0
Octopus Deploy < 2022.2.8552 0
Octopus Deploy < 2022.3.11098 0
Octopus Deploy < 2022.4.8463 0
Octopus Deploy < 2023.1.9672 0
Octopus Deploy < 2023.2.2394 0
Octopus Deploy < 2023.1.10235 0
Octopus Deploy < 2023.1.9879 0
Octopus Deploy < 2023.2.8159 0
Octopus Deploy < 2022.4.8319 0
Octopus Deploy < 2023.1.4189 0
Octopus Deploy < 2022.3.11043 0
Octopus Deploy < 2022.4.8401 0
Octopus Deploy < 2023.1.9794 0
Octopus Deploy < 2022.4.8332 0
Octopus Deploy < 2022.3.10957 0
Octopus Deploy < 2023.1.11942 0
Octopus Deploy < 2023.2.13151 0
Octopus Deploy < 2023.3.5049 0
Octopus Deploy < 2022.4.9997 0
Octopus Deploy < 2023.2.10545 0
87 results · Feed
-
Medium 4.2
In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during th…
-
Medium 5.5
In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows en…
-
Medium 5.5
In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoi…
-
Medium 5.3
In affected versions of Octopus Deploy it is possible to discover network details via error message
-
Medium 5.5
In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Ser…
-
Unscored —
In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function
-
Medium 5.3
In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage
-
High 8.8
In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation
-
Medium 4.3
In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned perm…
-
Medium 4.3
In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned …
-
High 7.5
In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Ser…
-
Medium 5.4
In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in …
-
Medium 6.1
In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to byp…
-
High 7.5
In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become …
-
High 7.5
In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive …
-
Critical 9.8
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible …
-
Medium 5.3
In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user doe…
-
Critical 9.1
In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper vali…
-
High 8.1
In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to i…
-
Medium 6.5
In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure …
-
Medium 5.3
In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, s…
-
Unscored —
In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting …
-
Unscored —
In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token
-
Critical 9.8
In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.
-
Medium 4.3
In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have acce…
-
Unscored —
In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permission…
-
Unscored —
In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build informat…
-
Unscored —
In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project T…
-
Unscored —
In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload funct…
-
Unscored —
In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview.
-
Unscored —
In affected versions of Octopus Deploy, there is no logging of changes to artifacts within Octopus Deploy.
-
Unscored —
In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in …
-
Unscored —
In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible fo…
-
Unscored —
In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental …
-
Unscored —
When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of…
-
Unscored —
Permissions were not properly verified in the API on projects using version control in Git. This allowed projects to be…
-
Unscored —
In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server…
-
Unscored —
When the Windows Tentacle docker image starts up it logs all the commands that it runs along with the arguments, which …
-
Unscored —
When Octopus Tentacle is installed on a Linux operating system, the systemd service file permissions are misconfigured.…
-
Unscored —
When Octopus Tentacle is installed using a custom folder location, folder ACLs are not set correctly and could lead to …