← Back

Octopus Server

octopus_server

Vendor: Octopus • 64 CVEs

CVEs (64)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-18850
1Octopus
1Octopus Server
Nov 21, 2024
Oct 31, 2018
N/A· v4
8.8 HIGH· v3
9.0 HIGH· v2
In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could upload a maliciously crafted YAML configuration, potentially allowing for remote exe...Show more
In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could upload a maliciously crafted YAML configuration, potentially allowing for remote execution of arbitrary code, running in the same context as the Octopus Server (for self-hosted installations by default, SYSTEM).Show less
CVE-2018-12089
1Octopus
1Octopus Server
Nov 21, 2024
Jun 11, 2018
N/A· v4
7.5 HIGH· v3
3.5 LOW· v2
In Octopus Deploy version 2018.5.1 to 2018.5.7, a user with Task View is able to view a password for a Service Fabric Cluster, when the Service Fabric Cluster target is configured in Azure Active Directory security mode...Show more
In Octopus Deploy version 2018.5.1 to 2018.5.7, a user with Task View is able to view a password for a Service Fabric Cluster, when the Service Fabric Cluster target is configured in Azure Active Directory security mode and a deployment is executed with OctopusPrintVariables set to True. This is fixed in 2018.6.0.Show less
CVE-2018-11320
1Octopus
1Octopus Server
Nov 21, 2024
May 21, 2018
N/A· v4
9.8 CRITICAL· v3
5.0 MEDIUM· v2
In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target do not have sensitive values obfuscated in the deployment logs.
CVE-2017-11348
1Octopus
2Octopus Deploy
Octopus Server
May 13, 2026
Jul 17, 2017
N/A· v4
5.7 MEDIUM· v3
6.3 MEDIUM· v2
In Octopus Deploy 3.x before 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, potentially overwriting other packages or modifying system files...Show more
In Octopus Deploy 3.x before 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, potentially overwriting other packages or modifying system files. This is a directory traversal in the PackageId value.Show less