1357 matches found
CVE-2019-19376: Improper Input Validation
In Octopus Deploy before 2019.10.6, an authenticated user with TeamEdit permission could send a malformed Team API request that bypasses input validation and causes an application level denial of service condition. The fix for this was also backported to LTS 2019.9.8 and LTS 2019.6.14...
PT-2019-15826
Name of the Vulnerable Software and Affected Versions Octopus Deploy versions prior to 2019.10.7 Octopus Deploy versions 2019.6 prior to 2019.6.14 Octopus Deploy versions 2019.9 prior to 2019.9.8 Description The issue arises in configurations where SSL offloading is enabled, leading to the CSRF...
CVE-2019-19375: Cross-Site Request Forgery (CSRF)
In Octopus Deploy before 2019.10.7, in a configuration where SSL offloading is enabled, the CSRF cookie was sometimes sent without the secure attribute. The fix for this was backported to LTS versions 2019.6.14 and 2019.9.8...
Octopus Deploy Cross-Site Scripting Vulnerability (CNVD-2019-42443)
Octopus Deploy is an automation tool for .NET, Java and other application development and deployment from Octopus Deploy Australia. A cross-site scripting vulnerability exists in Octopus Server, which stems from the lack of proper validation of client-side data by the WEB application and can be...
Octopus Deploy Code Issue Vulnerability
Octopus Deploy is an automation tool for .NET, Java and other application development and deployment from Octopus Deploy Australia. A code issue vulnerability exists in Octopus Deploy, which can be exploited by an attacker with the help of a specially crafted package to disclose underlying...
CVE-2019-19084
In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted package, triggering an exception that exposes underlying operating system details...
CVE-2019-19085
A persistent cross-site scripting XSS vulnerability in Octopus Server 3.4.0 through 2019.10.5 allows remote authenticated attackers to inject arbitrary web script or HTML...
CVE-2019-19085
A persistent cross-site scripting XSS vulnerability in Octopus Server 3.4.0 through 2019.10.5 allows remote authenticated attackers to inject arbitrary web script or HTML...
CVE-2019-19084
In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted package, triggering an exception that exposes underlying operating system details...
Design/Logic Flaw
In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted package, triggering an exception that exposes underlying operating system details...
CVE-2019-19085
CVE-2019-19085 is a persistent XSS in Octopus Server (versions 3.4.0 through 2019.10.5). According to the provided documents, remote authenticated attackers could inject arbitrary web script/HTML. The sources do not specify exploitation status, affected product families beyond Octopus Server, or ...
CVE-2019-19085
A persistent cross-site scripting XSS vulnerability in Octopus Server 3.4.0 through 2019.10.5 allows remote authenticated attackers to inject arbitrary web script or HTML...
CVE-2019-19084
CVE-2019-19084 affects Octopus Deploy server (versions 3.3.0–2019.10.4). An authenticated user with PackagePush permission can upload a specially crafted package, triggering an exception that reveals underlying operating system details. Consequences are exposure of OS information via error handli...
CVE-2019-19084
In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted package, triggering an exception that exposes underlying operating system details...
CVE-2019-19085: Improper Neutralization of Input During Web Page Generation
A persistent cross-site scripting XSS vulnerability in Octopus Server 3.4.0 through 2019.10.5 allows remote authenticated attackers to inject arbitrary web script or HTML...
PT-2019-15768
Name of the Vulnerable Software and Affected Versions Octopus Deploy versions 3.3.0 through 2019.10.4 Description The issue allows an authenticated user with PackagePush permission to upload a maliciously crafted package. This can trigger an exception that exposes underlying operating system...
PT-2019-15769
Name of the Vulnerable Software and Affected Versions Octopus Server versions 3.4.0 through 2019.10.5 Description A persistent cross-site scripting XSS issue allows remote authenticated attackers to inject arbitrary web script or HTML. Recommendations For versions 3.4.0 through 2019.10.5, update ...
CVE-2019-19084: Unrestricted Upload of File with Dangerous Type
In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted package, triggering an exception that exposes underlying operating system details...