Octopus Deploy Cross-Site Scripting Vulnerability (CNVD-2019-42443)

Octopus Deploy is an automation tool for .NET, Java and other application development and deployment from Octopus Deploy Australia. A cross-site scripting vulnerability exists in Octopus Server, which stems from the lack of proper validation of client-side data by the WEB application and can be...

Octopus Deploy Code Issue Vulnerability

Octopus Deploy is an automation tool for .NET, Java and other application development and deployment from Octopus Deploy Australia. A code issue vulnerability exists in Octopus Deploy, which can be exploited by an attacker with the help of a specially crafted package to disclose underlying...

CVE-2019-19084

In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted package, triggering an exception that exposes underlying operating system details...

CVE-2019-19084

In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted package, triggering an exception that exposes underlying operating system details...

Design/Logic Flaw

In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted package, triggering an exception that exposes underlying operating system details...

CVE-2019-19084

In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted package, triggering an exception that exposes underlying operating system details...

CVE-2019-19084

CVE-2019-19084 affects Octopus Deploy server (versions 3.3.0–2019.10.4). An authenticated user with PackagePush permission can upload a specially crafted package, triggering an exception that reveals underlying operating system details. Consequences are exposure of OS information via error handli...

PT-2019-15768

Name of the Vulnerable Software and Affected Versions Octopus Deploy versions 3.3.0 through 2019.10.4 Description The issue allows an authenticated user with PackagePush permission to upload a maliciously crafted package. This can trigger an exception that exposes underlying operating system...

CVE-2019-19084: Unrestricted Upload of File with Dangerous Type

In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted package, triggering an exception that exposes underlying operating system details...

CVE-2019-15698

In Octopus Deploy 2019.7.3 through 2019.7.9, in certain circumstances, an authenticated user with VariableView permissions could view sensitive values. This is fixed in 2019.7.10...

CVE-2019-15698

In Octopus Deploy 2019.7.3 through 2019.7.9, in certain circumstances, an authenticated user with VariableView permissions could view sensitive values. This is fixed in 2019.7.10...

Design/Logic Flaw

In Octopus Deploy 2019.7.3 through 2019.7.9, in certain circumstances, an authenticated user with VariableView permissions could view sensitive values. This is fixed in 2019.7.10...

CVE-2019-15698

In Octopus Deploy 2019.7.3 through 2019.7.9, in certain circumstances, an authenticated user with VariableView permissions could view sensitive values. This is fixed in 2019.7.10...

CVE-2019-15698

CVE-2019-15698 affects Octopus Deploy versions 2019.7.3 through 2019.7.9. In certain circumstances, an authenticated user with VariableView permissions could view sensitive values. The issue has been fixed in 2019.7.10. According to NVD, the CVSS scores are low-to-medium: CVSSv2 base 4.0 (Medium)...

Octopus Deploy Information Disclosure Vulnerability (CNVD-2019-29123)

Octopus Deploy is an automation tool for .NET, Java and other application development and deployment from Octopus Deploy Australia. An information disclosure vulnerability exists in Octopus Deploy versions 2018.8.4 through 2019.7.6, which can be exploited by unauthorized attackers to obtain...

PT-2019-14330

Name of the Vulnerable Software and Affected Versions Octopus Deploy versions 2019.7.3 through 2019.7.9 Description The issue allows an authenticated user with VariableView permissions to view sensitive values under certain circumstances. Recommendations For versions 2019.7.3 through 2019.7.9,...

CVE-2019-15698: Undefined Security Weakness

In Octopus Deploy 2019.7.3 through 2019.7.9, in certain circumstances, an authenticated user with VariableView permissions could view sensitive values. This is fixed in 2019.7.10...

CVE-2019-15507

In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an authenticated user in certain limited special-characters circumstances could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 2019.7.7. T...

CVE-2019-15507

In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an authenticated user in certain limited special-characters circumstances could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 2019.7.7. T...

Cross site request forgery (csrf)

In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an authenticated user in certain limited special-characters circumstances could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 2019.7.7. T...