1357 matches found
CVE-2020-16197: Improper Certificate Validation
An issue was discovered in Octopus Deploy 3.4. A deployment target can be configured with an Account or Certificate that is outside the scope of the deployment target. An authorised user can potentially use a certificate that they are not in scope to use. An authorised user is also able to obtain...
CVE-2020-14470
In Octopus Deploy 2018.8.0 through 2019.x before 2019.12.2, an authenticated user with could trigger a deployment that leaks the Helm Chart repository password...
CVE-2020-14470
In Octopus Deploy 2018.8.0 through 2019.x before 2019.12.2, an authenticated user with could trigger a deployment that leaks the Helm Chart repository password...
Default credentials
In Octopus Deploy 2018.8.0 through 2019.x before 2019.12.2, an authenticated user with could trigger a deployment that leaks the Helm Chart repository password...
CVE-2020-14470
In Octopus Deploy 2018.8.0 through 2019.x before 2019.12.2, an authenticated user with could trigger a deployment that leaks the Helm Chart repository password...
CVE-2020-14470
In Octopus Deploy, versions 2018.8.0 through 2019.x before 2019.12.2 are affected by CVE-2020-14470. An authenticated user could trigger a deployment that leaks the Helm Chart repository password. Root cause details are not fully enumerated in the provided documents, but the vulnerability is link...
PT-2020-14024
Name of the Vulnerable Software and Affected Versions Octopus Deploy versions 2018.8.0 through 2019.x before 2019.12.2 Description The issue allows an authenticated user to trigger a deployment that leaks the Helm Chart repository password. Recommendations For versions 2018.8.0 through 2019.x...
CVE-2020-14470: Insertion of Sensitive Information into Log File
In Octopus Deploy 2018.8.0 through 2019.x before 2019.12.2, an authenticated user with could trigger a deployment that leaks the Helm Chart repository password...
Octopus Scanner Sinks Tentacles into GitHub Repositories
The Octopus Scanner malware, which targets the Apache NetBeans Java integrated development environment IDE, has been nesting in at least 26 GitHub source-code repositories, according to researchers – waiting to take over developer machines. A team from GitHub Security Labs, acting on a tip from a...
Octopus Deploy Information Disclosure Vulnerability (CNVD-2020-27449)
Octopus Deploy is an automation tool for .NET, Java and other application development and deployment from Octopus Deploy Australia. A security vulnerability exists in Octopus Deploy versions prior to 2019.12.9 and 2020.1.12. An attacker could use the vulnerability to view server tasks that only...
CVE-2020-12286
In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not scoped to any dimension. For example, a scoped user who is scoped to only one tenant can view server tasks scoped to any other tenant...
CVE-2020-12286
In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not scoped to any dimension. For example, a scoped user who is scoped to only one tenant can view server tasks scoped to any other tenant...
Design/Logic Flaw
In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not scoped to any dimension. For example, a scoped user who is scoped to only one tenant can view server tasks scoped to any other tenant...
CVE-2020-12286
In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not scoped to any dimension. For example, a scoped user who is scoped to only one tenant can view server tasks scoped to any other tenant...
CVE-2020-12286
CVE-2020-12286 describes an information-disclosure vulnerability in Octopus Deploy where the TaskView permission is not scoped to any dimension. In versions before 2019.12.9 and before 2020.1.12, a user scoped to a single tenant could view server tasks for other tenants, indicating a missing scop...
CVE-2020-12286: Undefined Security Weakness
In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not scoped to any dimension. For example, a scoped user who is scoped to only one tenant can view server tasks scoped to any other tenant...
PT-2020-13095
Name of the Vulnerable Software and Affected Versions Octopus Deploy versions prior to 2019.12.9 Octopus Deploy versions prior to 2020.1.12 Description The TaskView permission is not properly scoped, allowing a user with limited scope to view tasks outside their intended scope. For instance, a us...
UPDATE: Octopus v1.0
Octopus v1.0 is now available. A brief mention about this tool can be found in my previous post titled List of Open Source C2 Post-Exploitation Frameworks. This is the first stable version of Octopus C2 which now supports Cobalt Strike deployment, auto kill functionality, command logging, bug fix...
Octopus Deploy elevation of privilege vulnerability (CNVD-2020-22263)
Octopus Deploy is an automation tool for .NET, Java and other application development and deployment from Octopus Deploy Australia. An elevation of privilege vulnerability exists in Octopus Deploy versions prior to 2020.1.5, which can be exploited by an attacker to elevate privileges...