← Back

Octopus Server

octopus_server

Vendor: Octopus • 66 CVEs

CVEs (66)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2019-11632
1Octopus
2Octopus Deploy
Octopus Server
Jun 17, 2026
May 1, 2019
N/A· v4
8.1 HIGH· v3
5.5 MEDIUM· v2
In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUnscoped or VariableEditUnscoped permission scoped to a specific project could view or edit unscoped v...Show more
In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUnscoped or VariableEditUnscoped permission scoped to a specific project could view or edit unscoped variables from a different project. (These permissions are only used in custom User Roles and do not affect built in User Roles.)Show less
CVE-2019-8944
1Octopus
2Octopus Deploy
Octopus Server
Jun 17, 2026
Feb 20, 2019
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
An Information Exposure issue in the Terraform deployment step in Octopus Deploy before 2019.1.8 (and before 2018.10.4 LTS) allows remote authenticated users to view sensitive Terraform output variables via log files.
CVE-2018-18850
1Octopus
1Octopus Server
Nov 21, 2024
Oct 31, 2018
N/A· v4
8.8 HIGH· v3
9.0 HIGH· v2
In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could upload a maliciously crafted YAML configuration, potentially allowing for remote exe...Show more
In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could upload a maliciously crafted YAML configuration, potentially allowing for remote execution of arbitrary code, running in the same context as the Octopus Server (for self-hosted installations by default, SYSTEM).Show less
CVE-2018-12089
1Octopus
1Octopus Server
Nov 21, 2024
Jun 11, 2018
N/A· v4
7.5 HIGH· v3
3.5 LOW· v2
In Octopus Deploy version 2018.5.1 to 2018.5.7, a user with Task View is able to view a password for a Service Fabric Cluster, when the Service Fabric Cluster target is configured in Azure Active Directory security mode...Show more
In Octopus Deploy version 2018.5.1 to 2018.5.7, a user with Task View is able to view a password for a Service Fabric Cluster, when the Service Fabric Cluster target is configured in Azure Active Directory security mode and a deployment is executed with OctopusPrintVariables set to True. This is fixed in 2018.6.0.Show less
CVE-2018-11320
1Octopus
1Octopus Server
Nov 21, 2024
May 21, 2018
N/A· v4
9.8 CRITICAL· v3
5.0 MEDIUM· v2
In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target do not have sensitive values obfuscated in the deployment logs.
CVE-2017-11348
1Octopus
2Octopus Deploy
Octopus Server
May 13, 2026
Jul 17, 2017
N/A· v4
5.7 MEDIUM· v3
6.3 MEDIUM· v2
In Octopus Deploy 3.x before 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, potentially overwriting other packages or modifying system files...Show more
In Octopus Deploy 3.x before 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, potentially overwriting other packages or modifying system files. This is a directory traversal in the PackageId value.Show less