CVE-2025-0589

CVE-2025-0589 affects Octopus Deploy when using Active Directory for authentication. An unauthenticated actor can issue API requests to two endpoints and retrieve data from the associated AD: one endpoint returns user profile details (Email address/UPN and Display name); the other returns group i...

PT-2025-6191 · Unknown · Octopus Deploy

Name of the Vulnerable Software and Affected Versions: Octopus Deploy affected versions not specified Description: The issue allows uploading files to unexpected locations on the host using an API endpoint. This is due to a lack of validation in a field, which could potentially result in ways to...

PT-2025-6171 · Unknown · Octopus Deploy

Name of the Vulnerable Software and Affected Versions: Octopus Deploy affected versions not specified Description: In affected versions of Octopus Deploy where customers are using Active Directory for authentication, it was possible for an unauthenticated user to make an API request against two...

Octopus SQL Injection Vulnerability

Octopus Deploy is an automation tool for .NET, Java and other application development and deployment from Octopus Deploy Australia. An SQL injection vulnerability exists in Octopus version 1.0, which stems from the parameter ancestors in the file /system/dept/edit that can lead to SQL injection...

Octopus Cross-Site Scripting Vulnerability

Octopus Deploy is an automation tool for .NET, Java and other application development and deployment from Octopus Deploy Australia. A cross-site scripting vulnerability exists in Octopus version 1.0, which stems from the fact that passing the parameter description can lead to cross-site scripting...

Octopus Deploy SQL Injection Vulnerability

Octopus Deploy is an automation tool for .NET, Java and other application development and deployment from Octopus Deploy Australia. A SQL injection vulnerability exists in Octopus Deploy version 1.0, which stems from /system/role/list containing unknown functions that cause SQL injection via the...

CVE-2022-2416

In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment...

CVE-2022-2416

In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment...

Design/Logic Flaw

In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment...

CVE-2022-2416

In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment...

CVE-2022-2416

In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment...

CVE-2022-2416

CVE-2022-2416 affects Octopus Deploy. A low-privileged guest can craft a request that allows enumeration of an environment, per the CVE descriptions across NVD/Red Hat/other sources. The connected documents confirm the existence of the vulnerability and its basic impact (environment enumeration) ...

CVE-2022-2346

In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints...

CVE-2022-2346

In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints...

Code injection

In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints...

CVE-2022-2346

In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints...

CVE-2022-2346

CVE-2022-2346 affects Octopus Deploy. The public records describe a vulnerability where a low privileged guest user can interact with extension endpoints. The sources do not specify affected versions, exact vulnerable component, or root cause in a way that enables precise remediation steps. Repor...

CVE-2022-2346

In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints...

Octopus Deploy Security Vulnerability

Octopus Deploy is an automation tool for .NET, Java, and other application development and deployment from Octopus Deploy Australia. Octopus Deploy suffers from a security vulnerability that stems from the ability of a user with low privileges to interact with an extension endpoint...

PT-2023-12744 · Unknown · Octopus Deploy

Name of the Vulnerable Software and Affected Versions: Octopus Deploy affected versions not specified Description: The issue allows a low-privileged guest user to craft a request that enables enumeration or reconnaissance of an environment. Recommendations: At the moment, there is no information...