Octopus Deploy Access Control Vulnerability

An issue was discovered in Octopus. When the special Guest user account is granted the CertificateExportPrivateKey permission, and Guest Access is enabled for the Octopus Server, an attacker can sign in as the Guest account and export Certificates managed by Octopus, including the private key...

Octopus Deploy Privilege Escalation Vulnerability

In Octopus, an authenticated user who was explicitly granted the permission to invite new users aka UserInvite can invite users to teams with escalated privileges. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by...

Octopus Deploy XSS Vulnerability

Cross-site scripting XSS vulnerability in Octopus Deploy allows remote authenticated users to inject arbitrary web script or HTML via the Step Template Name parameter. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright ...

Octopus Deploy Information Disclosure Vulnerability

Octopus allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Octopus Deploy XSS Vulnerability

Cross-site scripting XSS vulnerability in the All Variables tab in Octopus Deploy allows remote attackers to inject arbitrary web script or HTML via the Variable Set Name parameter. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and...

CVE-2017-16810

Cross-site scripting XSS vulnerability in the All Variables tab in Octopus Deploy 3.4.0-3.13.6 fixed in 3.13.7 allows remote attackers to inject arbitrary web script or HTML via the Variable Set Name parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in the All Variables tab in Octopus Deploy 3.4.0-3.13.6 fixed in 3.13.7 allows remote attackers to inject arbitrary web script or HTML via the Variable Set Name parameter...

CVE-2017-16810

Cross-site scripting XSS vulnerability in the All Variables tab in Octopus Deploy 3.4.0-3.13.6 fixed in 3.13.7 allows remote attackers to inject arbitrary web script or HTML via the Variable Set Name parameter...

CVE-2017-16810

Cross-site scripting XSS vulnerability in the All Variables tab in Octopus Deploy 3.4.0-3.13.6 fixed in 3.13.7 allows remote attackers to inject arbitrary web script or HTML via the Variable Set Name parameter...

CVE-2017-16810

CVE-2017-16810 describes a cross-site scripting (XSS) vulnerability in the Octopus Deploy All Variables tab. The issue affects Octopus Deploy versions 3.4.0 through 3.13.6 and is fixed in version 3.13.7. The vulnerability allows remote attackers to inject arbitrary web script or HTML through the ...

PT-2017-14577

Name of the Vulnerable Software and Affected Versions Octopus Deploy versions 3.4.0 through 3.13.6 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the Variable Set Name parameter in the All Variables tab. Recommendations Fo...

CVE-2017-16810: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the All Variables tab in Octopus Deploy 3.4.0-3.13.6 fixed in 3.13.7 allows remote attackers to inject arbitrary web script or HTML via the Variable Set Name parameter...

Octopus Deploy Cross-Site Scripting Vulnerability

Octopus Deploy is an automation tool from Octopus Deploy Australia for development and deployment of . A cross-site scripting vulnerability exists in Octopus Deploy versions 3.7.0 through 3.17.13. The vulnerability can be exploited by a remote attacker to inject arbitrary web script or HTML using...

Octopus Deploy 'Variable Set Name' Parameter Cross-Site Scripting Vulnerability

Octopus Deploy is an automation tool from Octopus Deploy Australia for development and deployment of . A cross-site scripting vulnerability exists in the All Variables tag in Octopus Deploy versions 3.4.0-3.13.6. A remote attacker can exploit this vulnerability to inject arbitrary web script or...

CVE-2017-16801

Cross-site scripting XSS vulnerability in Octopus Deploy 3.7.0-3.17.13 fixed in 3.17.14 allows remote authenticated users to inject arbitrary web script or HTML via the Step Template Name parameter...

CVE-2017-16801

Cross-site scripting XSS vulnerability in Octopus Deploy 3.7.0-3.17.13 fixed in 3.17.14 allows remote authenticated users to inject arbitrary web script or HTML via the Step Template Name parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in Octopus Deploy 3.7.0-3.17.13 fixed in 3.17.14 allows remote authenticated users to inject arbitrary web script or HTML via the Step Template Name parameter...

CVE-2017-16801

Cross-site scripting XSS vulnerability in Octopus Deploy 3.7.0-3.17.13 fixed in 3.17.14 allows remote authenticated users to inject arbitrary web script or HTML via the Step Template Name parameter...

CVE-2017-16801

Octopus Deploy XSS (CVE-2017-16801) affects versions 3.7.0–3.17.13; fixed in 3.17.14. The vulnerability allows remote authenticated users to inject arbitrary web script or HTML via the Step Template Name parameter. Impact is reflected/partial integrity risk as per CVSS entries (MEDIUM in CVSS v3....

PT-2017-14570

Name of the Vulnerable Software and Affected Versions Octopus Deploy versions 3.7.0 through 3.17.13 Description A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via the Step Template Name parameter. This could potentially lead to unauthoriz...