Octopus
octopus
105 CVEs • 7 products
Products (7)
Click to collapseToggle
Products (7)
Click to collapse
CVEs (105)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt. |
A race condition was identified through which privilege escalation was possible in certain configurations. |
In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server. |
In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment. |
In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints. |
In affected versions of Octopus Deploy it is possible to discover network details via error message |
In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service |
In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function |
In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage |
In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation |
In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view these items |
In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these items |
In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service |
In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially resolved in advisory 2022-07 however it was identified that the...Show more |
In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be redirected to the configured redirect url without any validation. |
In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview. |
In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verbose logging is enabled. |
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked. |
In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters. |
In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose error messaging. |