CVE-2020-27155: Undefined Security Weakness

An issue was discovered in Octopus Deploy through 2020.4.4. If enabled, the websocket endpoint may allow an untrusted tentacle host to present itself as a trusted one...

Octopus Deploy Information Disclosure Vulnerability (CNVD-2020-59032)

Octopus Deploy is an automated deployment and release management tool. An information disclosure vulnerability exists in Octopus Deploy versions 3.1.0 through 2020.4.0. The vulnerability stems from certain scripts that display sensitive information to users in task logs. An attacker can exploit...

CVE-2020-25825

In Octopus Deploy 3.1.0 to 2020.4.0, certain scripts can reveal sensitive information to the user in the task logs...

CVE-2020-25825

In Octopus Deploy 3.1.0 to 2020.4.0, certain scripts can reveal sensitive information to the user in the task logs...

Design/Logic Flaw

In Octopus Deploy 3.1.0 to 2020.4.0, certain scripts can reveal sensitive information to the user in the task logs...

CVE-2020-25825

CVE-2020-25825 affects Octopus Deploy versions 3.1.0 through 2020.4.0. The root cause is that certain scripts display sensitive information to users in task logs, causing information disclosure. Impact is information exposure to logged-in users, as described in CNVD-2020-59032 and corroborated by...

CVE-2020-25825

In Octopus Deploy 3.1.0 to 2020.4.0, certain scripts can reveal sensitive information to the user in the task logs...

PT-2020-16228

Name of the Vulnerable Software and Affected Versions Octopus Deploy versions 3.1.0 through 2020.4.0 Description The issue allows certain scripts to reveal sensitive information to the user in the task logs. Recommendations For versions 3.1.0 through 2020.4.0, update to a version that contains a...

CVE-2020-25825: Undefined Security Weakness

In Octopus Deploy 3.1.0 to 2020.4.0, certain scripts can reveal sensitive information to the user in the task logs...

CVE-2020-24566

In Octopus Deploy 2020.3.x before 2020.3.4 and 2020.4.x before 2020.4.1, if an authenticated user creates a deployment or runbook process using Azure steps and sets the step's execution location to run on the server/worker, then under certain circumstances the account password is exposed in...

Design/Logic Flaw

In Octopus Deploy 2020.3.x before 2020.3.4 and 2020.4.x before 2020.4.1, if an authenticated user creates a deployment or runbook process using Azure steps and sets the step's execution location to run on the server/worker, then under certain circumstances the account password is exposed in...

CVE-2020-24566

In Octopus Deploy 2020.3.x before 2020.3.4 and 2020.4.x before 2020.4.1, if an authenticated user creates a deployment or runbook process using Azure steps and sets the step's execution location to run on the server/worker, then under certain circumstances the account password is exposed in...

CVE-2020-24566

Octopus Deploy CVE-2020-24566 affects Octopus Deploy 2020.3.x before 2020.3.4 and 2020.4.x before 2020.4.1. When an authenticated user creates a deployment or runbook process using Azure steps and sets the step’s execution location to run on the server/worker, the account password may be exposed ...

PT-2020-15740

Name of the Vulnerable Software and Affected Versions Octopus Deploy versions 2020.3.x through 2020.3.3 Octopus Deploy versions 2020.4.x through 2020.4.0 Description The issue exposes an account password in cleartext in the verbose task logs output under certain circumstances. This occurs when an...

CVE-2020-24566: Insertion of Sensitive Information into Log File

In Octopus Deploy 2020.3.x before 2020.3.4 and 2020.4.x before 2020.4.1, if an authenticated user creates a deployment or runbook process using Azure steps and sets the step's execution location to run on the server/worker, then under certain circumstances the account password is exposed in...

Octopus Deploy Override Vulnerability

Octopus Deploy is an automation tool for .NET, Java and other application development and deployment from Octopus Deploy Australia. A security vulnerability exists in Octopus Deploy 3.4. A. The vulnerability allows the use of accounts or certificates to configure targets outside the scope of...

CVE-2020-16197

An issue was discovered in Octopus Deploy 3.4. A deployment target can be configured with an Account or Certificate that is outside the scope of the deployment target. An authorised user can potentially use a certificate that they are not in scope to use. An authorised user is also able to obtain...

Input validation

An issue was discovered in Octopus Deploy 3.4. A deployment target can be configured with an Account or Certificate that is outside the scope of the deployment target. An authorised user can potentially use a certificate that they are not in scope to use. An authorised user is also able to obtain...

CVE-2020-16197

An issue was discovered in Octopus Deploy 3.4. A deployment target can be configured with an Account or Certificate that is outside the scope of the deployment target. An authorised user can potentially use a certificate that they are not in scope to use. An authorised user is also able to obtain...

CVE-2020-16197

CVE-2020-16197 affects Octopus Deploy 3.4. An authorised user can configure a deployment target with an Account or Certificate outside the target’s scope and may use a certificate not in scope. The vulnerability also allows obtaining certificate metadata by associating a certificate with resource...