Cross site scripting

Cross-site scripting XSS vulnerability in Octopus Deploy 3.7.0-3.17.13 fixed in 3.17.14 allows remote authenticated users to inject arbitrary web script or HTML via the Step Template Name parameter...

CVE-2017-16801

Cross-site scripting XSS vulnerability in Octopus Deploy 3.7.0-3.17.13 fixed in 3.17.14 allows remote authenticated users to inject arbitrary web script or HTML via the Step Template Name parameter...

CVE-2017-16801

Cross-site scripting XSS vulnerability in Octopus Deploy 3.7.0-3.17.13 fixed in 3.17.14 allows remote authenticated users to inject arbitrary web script or HTML via the Step Template Name parameter...

CVE-2017-16801

Cross-site scripting XSS vulnerability in Octopus Deploy 3.7.0-3.17.13 fixed in 3.17.14 allows remote authenticated users to inject arbitrary web script or HTML via the Step Template Name parameter...

CVE-2017-16801

Octopus Deploy XSS (CVE-2017-16801) affects versions 3.7.0–3.17.13; fixed in 3.17.14. The vulnerability allows remote authenticated users to inject arbitrary web script or HTML via the Step Template Name parameter. Impact is reflected/partial integrity risk as per CVSS entries (MEDIUM in CVSS v3....

Octopus Deploy Elevation of Privilege Vulnerability

Octopus is an automated tool for development and deployment of .NET from Octopus Deploy Australia. A security vulnerability exists in versions of Octopus prior to 3.17.7. An attacker could exploit the vulnerability to invite users to groups with elevated privileges...

Octopus Deploy Information Disclosure Vulnerability

Octopus Deploy is the automated deployment and release management server. An information disclosure vulnerability exists in Octopus Deploy prior to version 3.17.7. When a special client user account is granted CertificateExportPrivateKey privileges and "client access" is enabled on the Octopus...

Octopus Information Disclosure Vulnerability

Octopus is an automated tool for development and deployment of .NET from Octopus Deploy Australia. A security vulnerability exists in Octopus versions prior to 3.17.7. An attacker can exploit the vulnerability to obtain sensitive plaintext information...

CVE-2017-15610

An issue was discovered in Octopus before 3.17.7. When the special Guest user account is granted the CertificateExportPrivateKey permission, and Guest Access is enabled for the Octopus Server, an attacker can sign in as the Guest account and export Certificates managed by Octopus, including the...

Code injection

In Octopus before 3.17.7, an authenticated user who was explicitly granted the permission to invite new users aka UserInvite can invite users to teams with escalated privileges...

Design/Logic Flaw

An issue was discovered in Octopus before 3.17.7. When the special Guest user account is granted the CertificateExportPrivateKey permission, and Guest Access is enabled for the Octopus Server, an attacker can sign in as the Guest account and export Certificates managed by Octopus, including the...

CVE-2017-15609

Octopus before 3.17.7 allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets...

CVE-2017-15609

Octopus before 3.17.7 allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets...

CVE-2017-15611

In Octopus before 3.17.7, an authenticated user who was explicitly granted the permission to invite new users aka UserInvite can invite users to teams with escalated privileges...

Code injection

Octopus before 3.17.7 allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets...

CVE-2017-15611

In Octopus before 3.17.7, an authenticated user who was explicitly granted the permission to invite new users aka UserInvite can invite users to teams with escalated privileges...

CVE-2017-15610

An issue was discovered in Octopus before 3.17.7. When the special Guest user account is granted the CertificateExportPrivateKey permission, and Guest Access is enabled for the Octopus Server, an attacker can sign in as the Guest account and export Certificates managed by Octopus, including the...

CVE-2017-15611

In Octopus before 3.17.7, an authenticated user who was explicitly granted the permission to invite new users aka UserInvite can invite users to teams with escalated privileges...

CVE-2017-15610

The CVE describes a vulnerability in Octopus Deploy where, prior to version 3.17.7, granting the CertificateExportPrivateKey permission to the special Guest user and enabling Guest Access allows an attacker to sign in as Guest and export certificates managed by Octopus, including private keys. Af...

CVE-2017-15609

Octopus Deploy is affected under CVE-2017-15609 up to version 3.17.7. The vulnerability, described by OpenVAS as: “Octopus allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets,” stems from reading an insecu...