Octopus

Octopus Server

61 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.5

CVE-2022-4008

  • EPSS 0.04%
  • Veröffentlicht 10.05.2023 06:15:09
  • Zuletzt bearbeitet 28.01.2025 15:15:09

In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service

5.3

CVE-2022-2507

  • EPSS 0.31%
  • Veröffentlicht 19.04.2023 08:15:07
  • Zuletzt bearbeitet 05.02.2025 16:15:32

In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage

8.8

CVE-2022-4009

  • EPSS 0.48%
  • Veröffentlicht 16.03.2023 04:15:12
  • Zuletzt bearbeitet 26.02.2025 21:15:12

In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation

4.3

CVE-2022-2259

  • EPSS 0.13%
  • Veröffentlicht 13.03.2023 05:15:11
  • Zuletzt bearbeitet 03.03.2025 21:15:12

In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view these items

4.3

CVE-2022-2258

  • EPSS 0.2%
  • Veröffentlicht 13.03.2023 05:15:11
  • Zuletzt bearbeitet 27.02.2025 22:15:34

In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these items

7.5

CVE-2022-2883

  • EPSS 0.54%
  • Veröffentlicht 22.02.2023 01:15:10
  • Zuletzt bearbeitet 11.03.2025 20:15:12

In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service

5.4

CVE-2022-4898

  • EPSS 0.21%
  • Veröffentlicht 31.01.2023 04:15:07
  • Zuletzt bearbeitet 27.03.2025 15:15:41

In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially resolved in advisory 2022-07 however it was identified that the fix could be bypassed in certa...

6.1

CVE-2022-3614

  • EPSS 0.21%
  • Veröffentlicht 03.01.2023 02:15:16
  • Zuletzt bearbeitet 10.04.2025 15:15:50

In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be redirected to the configured redirect url without any validation.

7.5

CVE-2022-3460

  • EPSS 0.4%
  • Veröffentlicht 03.01.2023 00:15:10
  • Zuletzt bearbeitet 10.04.2025 16:15:22

In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview.

7.5

CVE-2022-2721

  • EPSS 0.32%
  • Veröffentlicht 25.11.2022 05:15:12
  • Zuletzt bearbeitet 25.04.2025 18:15:23

In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verbose logging is enabled.