Octopus

Octopus Server

65 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.3

CVE-2025-0589

  • EPSS 0.36%
  • Veröffentlicht 11.02.2025 09:15:09
  • Zuletzt bearbeitet 02.07.2025 17:25:02

In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API request against two endpoints which would retrieve some data from the associated Active Di...

9.8

CVE-2024-9194

  • EPSS 0.43%
  • Veröffentlicht 30.09.2024 23:15:02
  • Zuletzt bearbeitet 02.07.2025 17:25:50

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Linux and Microsoft Windows Octopus Server on Windows, Linux allows SQL Injection.This issue affects Octopus Server: from 2024.1.0 before 2024.1.130...

2.6

CVE-2024-1656

  • EPSS 0.25%
  • Veröffentlicht 11.09.2024 05:15:02
  • Zuletzt bearbeitet 02.07.2025 17:26:16

Affected versions of Octopus Server had a weak content security policy.

2.6

CVE-2024-7998

  • EPSS 0.25%
  • Veröffentlicht 21.08.2024 06:15:13
  • Zuletzt bearbeitet 02.07.2025 17:26:30

In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifespan.

6.5

CVE-2024-6972

  • EPSS 0.23%
  • Veröffentlicht 25.07.2024 06:15:01
  • Zuletzt bearbeitet 02.07.2025 17:26:41

In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in clear-text.

2.2

CVE-2024-4811

  • EPSS 0.24%
  • Veröffentlicht 25.07.2024 05:15:26
  • Zuletzt bearbeitet 02.07.2025 17:27:05

In affected versions of Octopus Server under certain conditions, a user with specific role assignments can access restricted project artifacts.

5.4

CVE-2024-4456

  • EPSS 0.26%
  • Veröffentlicht 08.05.2024 01:15:06
  • Zuletzt bearbeitet 30.06.2025 18:04:42

In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting payload on the audit page.

3.5

CVE-2024-4226

  • EPSS 0.3%
  • Veröffentlicht 30.04.2024 02:15:06
  • Zuletzt bearbeitet 27.06.2025 14:42:47

It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and permissions. This functionality was removed in versions of Octopus Server after the fixed versions listed.

4.3

CVE-2023-4509

  • EPSS 0.23%
  • Veröffentlicht 18.04.2024 00:15:07
  • Zuletzt bearbeitet 02.07.2025 18:09:48

It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt.

7.5

CVE-2024-2975

  • EPSS 0.39%
  • Veröffentlicht 09.04.2024 01:15:49
  • Zuletzt bearbeitet 02.07.2025 12:32:30

A race condition was identified through which privilege escalation was possible in certain configurations.