Octopus Deploy vulnerabilities
80 CVEs and advisories name Octopus Deploy as an affected vendor, newest first. Follow it as a feed.
- CVE-2024-4456In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting payload on the audit page.
- CVE-2024-4226It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and p
- CVE-2023-4509It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt.
- CVE-2024-2975A race condition was identified through which privilege escalation was possible in certain configurations.
- CVE-2023-1904In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Oc
- CVE-2022-2416In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an
- CVE-2022-2346In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints.
- CVE-2022-4870In affected versions of Octopus Deploy it is possible to discover network details via error message
- CVE-2022-4008In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service
- CVE-2023-2247In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function
- CVE-2022-2507In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage
- CVE-2022-4009In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation
- CVE-2022-2259In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view t
- CVE-2022-2258In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these
- CVE-2022-2883In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service
- CVE-2022-4898In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link.
- CVE-2022-3614In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication ch
- CVE-2022-3460In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed
- CVE-2022-2721In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plain
- CVE-2022-2572In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys
- CVE-2022-2508In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to
- CVE-2022-2782In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session
- CVE-2022-2780In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB reques
- CVE-2022-2828In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Referen
- CVE-2022-2720In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value maskin
- CVE-2022-2783In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token
- CVE-2022-2781In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and v
- CVE-2022-2778In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.
- CVE-2022-2760In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an erro
- CVE-2022-2528In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing p