Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
octopus deploy vulnerabilities and exploits
(subscribe to this query)
445
VMScore
CVE-2017-15609
Octopus prior to 3.17.7 allows malicious users to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets.
Octopus Octopus Deploy
356
VMScore
CVE-2017-15611
In Octopus prior to 3.17.7, an authenticated user who was explicitly granted the permission to invite new users (aka UserInvite) can invite users to teams with escalated privileges.
Octopus Octopus Deploy
356
VMScore
CVE-2019-19084
In Octopus Deploy 3.3.0 up to and including 2019.10.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted package, triggering an exception that exposes underlying operating system details.
Octopus Octopus Deploy
516
VMScore
CVE-2020-26161
In Octopus Deploy up to and including 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host header.
Octopus Octopus Deploy
356
VMScore
CVE-2017-15610
An issue exists in Octopus prior to 3.17.7. When the special Guest user account is granted the CertificateExportPrivateKey permission, and Guest Access is enabled for the Octopus Server, an attacker can sign in as the Guest account and export Certificates managed by Octopus, incl...
Octopus Octopus Deploy
578
VMScore
CVE-2017-17665
In Octopus Deploy prior to 4.1.3, the machine update process doesn't check that the user has access to all environments. This allows an access-control bypass because the set of environments to which a machine is scoped may include environments in which the user lacks access.
Octopus Octopus Deploy
445
VMScore
CVE-2018-10550
In Octopus Deploy prior to 2018.4.7, target and tenant tag variable scopes were not checked against the list of tenants the user has access to.
Octopus Octopus Deploy
490
VMScore
CVE-2018-10581
In Octopus Deploy 3.4.x prior to 2018.4.7, an authenticated user is able to view/update/save variable values within the Tenant Variables area for Environments that do not exist within their associated Team scoping. This occurs in situations where this authenticated user also belo...
Octopus Octopus Deploy
356
VMScore
CVE-2018-12884
In Octopus Deploy 3.0 onwards (prior to 2018.6.7), an authenticated user with incorrect permissions may be able to create Accounts under the Infrastructure menu.
Octopus Octopus Deploy 3.0
561
VMScore
CVE-2017-11348
In Octopus Deploy 3.x prior to 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, potentially overwriting other packages or modifying system files. This is a directory traversal in the PackageId value.
Octopus Octopus Deploy 3.6.0
Octopus Octopus Deploy 3.7.0
Octopus Octopus Server 3.0.6
Octopus Octopus Server 3.0.12
Octopus Octopus Server 3.0.4
Octopus Octopus Server 3.0.18
Octopus Octopus Server 3.0.13
Octopus Octopus Server 3.0.20
Octopus Octopus Server 3.0.19
Octopus Octopus Server 3.0.26
Octopus Octopus Server 3.0.1
Octopus Octopus Server 3.0.8
Octopus Octopus Server 3.0.10
Octopus Octopus Server 3.0.15
Octopus Octopus Server 3.0.17
Octopus Octopus Server 3.0.22
Octopus Octopus Server 3.0.11
Octopus Octopus Server 3.0.14
Octopus Octopus Server 3.0.25
Octopus Octopus Server 3.0.2
Octopus Octopus Server 3.0.3
Octopus Octopus Server 3.0.5
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2020-4463
CVE-2024-3400
deserialization
CVE-2024-21788
CVE-2023-42433
CVE-2024-21841
CVE-2024-22095
local file inclusion
memory leak
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
NEXT »