Octopus Deploy vulnerabilities
80 CVEs and advisories name Octopus Deploy as an affected vendor, newest first. Follow it as a feed.
- CVE-2022-2075In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build information request validatio
- CVE-2022-2074In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project Template.
- CVE-2022-2049In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function.
- CVE-2022-1901In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview.
- CVE-2022-30532In affected versions of Octopus Deploy, there is no logging of changes to artifacts within Octopus Deploy.
- CVE-2022-29890In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link.
- CVE-2022-1881In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download
- CVE-2022-2013In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental feature flag all new
- CVE-2022-1670When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users.
- CVE-2022-1502Permissions were not properly verified in the API on projects using version control in Git.
- CVE-2022-23184In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server will allow open redi
- CVE-2021-31821When the Windows Tentacle docker image starts up it logs all the commands that it runs along with the arguments, which writes the Octopus Se
- CVE-2021-31822When Octopus Tentacle is installed on a Linux operating system, the systemd service file permissions are misconfigured.
- CVE-2021-26557When Octopus Tentacle is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user
- CVE-2021-26556When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user us
- CVE-2021-31819In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already t
- CVE-2021-31820In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in
- CVE-2021-31817When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written
- CVE-2021-31816When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written
- CVE-2021-31818Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied d