419 matches found
Octopus Server 日志信息泄露漏洞
Octopus Server is an automated deployment platform. An information disclosure vulnerability exists in Octopus Server versions 2022.2.6729 and later through 2022.2.7965 and 2022.3.348 and later through 2022.3.9163. An attacker can exploit this vulnerability to obtain sensitive information...
CVE-2022-2721
In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verbose logging is enabled...
CVE-2022-2721: Insertion of Sensitive Information into Log File
In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verbose logging is enabled...
CVE-2022-2721
In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verbose logging is enabled...
PT-2022-18297 · Unknown · Octopus Server
Name of the Vulnerable Software and Affected Versions: Octopus Server affected versions not specified Description: The issue allows target discovery to print certain sensitive values to log files in plain-text when verbose logging is enabled. Recommendations: At the moment, there is no informatio...
CVE-2022-2721
CVE-2022-2721 affects Octopus Server and describes an information-disclosure vulnerability where target discovery can print values marked as sensitive to log files in plain text when verbose logging is enabled. Multiple sources (NVD entry, Red Hat advisory, CNVD/CNNVD, and other trackers) corrobo...
CVE-2022-2572
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked...
CVE-2022-2572
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked...
Authentication flaw
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked...
Octopus Server 授权问题漏洞
Octopus Server is an automated deployment platform. An authorization issue vulnerability exists in Octopus Server that stems from access rights being managed by an external authentication provider, where disabling or deleting a user's API key may still be valid after access rights have been...
PT-2022-17478 · Unknown · Octopus Server
Name of the Vulnerable Software and Affected Versions: Octopus Server affected versions not specified Description: The issue concerns Octopus Server versions where access is managed by an external authentication provider. In these versions, it was possible for the API key/keys of a disabled or...
CVE-2022-2572
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked...
CVE-2022-2572: Improper Authentication
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked...
CVE-2022-2572
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked...
CVE-2022-2572
CVE-2022-2572 affects Octopus Server when authentication is managed by an external provider. The issue: API keys of disabled/deleted users remain valid after access is revoked, enabling potential unauthorized use. Documented impact is high (CVSS 3.1: CRITICAL, 9.8), with network attack vector, no...
CVE-2022-2508
In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose error messaging...
CVE-2022-2782
In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters...
CVE-2022-2782
In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters...