CVE-2017-16801: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Octopus Deploy 3.7.0-3.17.13 fixed in 3.17.14 allows remote authenticated users to inject arbitrary web script or HTML via the Step Template Name parameter...

Octopus Information Disclosure Vulnerability

Octopus is an automated tool for development and deployment of .NET from Octopus Deploy Australia. A security vulnerability exists in Octopus versions prior to 3.17.7. An attacker can exploit the vulnerability to obtain sensitive plaintext information...

Octopus Deploy Elevation of Privilege Vulnerability

Octopus is an automated tool for development and deployment of .NET from Octopus Deploy Australia. A security vulnerability exists in versions of Octopus prior to 3.17.7. An attacker could exploit the vulnerability to invite users to groups with elevated privileges...

Octopus Deploy Information Disclosure Vulnerability

Octopus Deploy is the automated deployment and release management server. An information disclosure vulnerability exists in Octopus Deploy prior to version 3.17.7. When a special client user account is granted CertificateExportPrivateKey privileges and "client access" is enabled on the Octopus...

CVE-2017-15609

Octopus before 3.17.7 allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets...

CVE-2017-15611

In Octopus before 3.17.7, an authenticated user who was explicitly granted the permission to invite new users aka UserInvite can invite users to teams with escalated privileges...

Design/Logic Flaw

The Deploy to container Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins master local file system access, or users with Extended Read access to the jobs it is used in, to retrieve those passwords. The Deploy to container Plugin now integrates with...

CVE-2017-1000113: Exposure of Sensitive Information to an Unauthorized Actor

The Deploy to container Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins master local file system access, or users with Extended Read access to the jobs it is used in, to retrieve those passwords. The Deploy to container Plugin now integrates with...

CVE-2017-1000113

The Deploy to container Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins master local file system access, or users with Extended Read access to the jobs it is used in, to retrieve those passwords. The Deploy to container Plugin now integrates with...

PT-2017-10817

Name of the Vulnerable Software and Affected Versions Deploy to container Plugin affected versions not specified Description The issue concerns the storage of passwords in the Deploy to container Plugin. Previously, passwords were stored unencrypted as part of the plugin's configuration, allowing...

CloudBees Jenkins Deploy to Container Plugin Information Disclosure Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and a number of timed tasks . Deploy to Container...

CVE-2017-11348

In Octopus Deploy 3.x before 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, potentially overwriting other packages or modifying system files. This is a directory traversal in the PackageId value...

CVE-2017-11348

In Octopus Deploy 3.x before 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, potentially overwriting other packages or modifying system files. This is a directory traversal in the PackageId value...

Directory traversal

In Octopus Deploy 3.x before 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, potentially overwriting other packages or modifying system files. This is a directory traversal in the PackageId value...

PT-2017-11949

Name of the Vulnerable Software and Affected Versions Octopus Deploy versions prior to 3.15.4 Description The issue allows an authenticated user with PackagePush permission to upload a maliciously crafted NuGet package. This could potentially lead to overwriting other packages or modifying system...

CVE-2017-11348

Octopus Deploy 3.x pre-3.15.4 is affected. An authenticated user with PackagePush permission can upload a malicious NuGet package that may overwrite other packages or modify system files due to a directory traversal flaw in the PackageId value. Affected component: package upload handling in Octop...

Octopus Deploy PackageId Value Directory Traversal Vulnerability

Octopus Deploy is an automation tool from Octopus Deploy Australia for development and deployment of . A security vulnerability exists in version 3.x of Octopus Deploy prior to 3.15.4. An attacker can exploit this vulnerability by uploading maliciously crafted NuGet packets to overwrite other...

CVE-2017-11348: Improper Limitation of a Pathname to a Restricted Directory

In Octopus Deploy 3.x before 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, potentially overwriting other packages or modifying system files. This is a directory traversal in the PackageId value...

CVE-2017-11348

In Octopus Deploy 3.x before 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, potentially overwriting other packages or modifying system files. This is a directory traversal in the PackageId value...

Octopus Deploy Authentication Code Execution Vulnerability

Octopus is a deployment tool for .NET automation. An authentication code execution vulnerability exists in Octopus Deploy. Arbitrary code execution occurs due to poor filtering of the program during the authentication process...