575 matches found
GHSA-R798-QX7R-V3GW Jenkins Octopus Deploy Plugin stores credentials in plain text
Jenkins Octopus Deploy Plugin stores credentials unencrypted in its global configuration file hudson.plugins.octopusdeploy.OctopusDeployPlugin.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...
Octopus Deploy SQL注入漏洞
Octopus Deploy is an automation tool for .NET, Java, and other application development and deployment from Octopus Deploy Australia. An SQL injection vulnerability exists in Octopus Server that stems from the data provided by a user in an Events REST API request not being properly parameterized...
CVE-2021-21270
OctopusDSC is a PowerShell module with DSC resources that can be used to install and configure an Octopus Deploy Server and Tentacle agent. In OctopusDSC version 4.0.977 and earlier a customer API key used to connect to Octopus Server is exposed via logging in plaintext. This vulnerability is...
Design/Logic Flaw
OctopusDSC is a PowerShell module with DSC resources that can be used to install and configure an Octopus Deploy Server and Tentacle agent. In OctopusDSC version 4.0.977 and earlier a customer API key used to connect to Octopus Server is exposed via logging in plaintext. This vulnerability is...
Octopus DSC Security Breach
Octopus DSC is a PowerShell module with DSC resources that can be used to install and configure Octopus Deploy servers and reach agents. A security vulnerability exists in Octopus DSC version 4.0.977 and earlier, which stems from a vulnerability that allows client API keys used to connect to the...
Octopus Deploy Input Validation Error Vulnerability
Octopus Deploy is an automation tool for .NET, Java and other application development and deployment from Octopus Deploy Australia. A security vulnerability exists in Octopus Deploy versions prior to 2020.4.2 that allows an attacker to redirect users to an external site via a modified HTTP Host...
CVE-2020-26161
In Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host header...
CVE-2020-26161
In Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host header...
Design/Logic Flaw
In Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host header...
CVE-2020-26161
In Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host header...
CVE-2020-26161
CVE-2020-26161 affects Octopus Deploy up to version 2020.4.2. The vulnerability arises from a flaw where an attacker could cause a user to be redirected to an external site by supplying a modified HTTP Host header. Multiple connected sources corroborate this description (e.g., Red Hat, CNVD, NVD/...
CVE-2020-26161: URL Redirection to Untrusted Site
In Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host header...
PT-2020-16318
Name of the Vulnerable Software and Affected Versions Octopus Deploy versions through 2020.4.2 Description An issue exists where an attacker could redirect users to an external site via a modified HTTP Host header. Recommendations For versions through 2020.4.2, update to a version later than...
CVE-2020-27155
An issue was discovered in Octopus Deploy through 2020.4.4. If enabled, the websocket endpoint may allow an untrusted tentacle host to present itself as a trusted one...
CVE-2020-27155
An issue was discovered in Octopus Deploy through 2020.4.4. If enabled, the websocket endpoint may allow an untrusted tentacle host to present itself as a trusted one...
CVE-2020-27155
An issue was discovered in Octopus Deploy through 2020.4.4. If enabled, the websocket endpoint may allow an untrusted tentacle host to present itself as a trusted one...
Code injection
An issue was discovered in Octopus Deploy through 2020.4.4. If enabled, the websocket endpoint may allow an untrusted tentacle host to present itself as a trusted one...
CVE-2020-27155
An issue was discovered in Octopus Deploy through 2020.4.4. If enabled, the websocket endpoint may allow an untrusted tentacle host to present itself as a trusted one...
CVE-2020-27155
CVE-2020-27155 affects Octopus Deploy up to version 2020.4.4. The issue is that, if the websocket endpoint is enabled, an untrusted tentacle host can present itself as a trusted one, enabling impersonation. The available connected documents confirm the vulnerability description but do not provide...
PT-2020-16643
Name of the Vulnerable Software and Affected Versions Octopus Deploy versions through 2020.4.4 Description An issue was discovered that may allow an untrusted tentacle host to present itself as a trusted one if the websocket endpoint is enabled. Recommendations For versions through 2020.4.4,...