1357 matches found
CVE-2017-15610
An issue was discovered in Octopus before 3.17.7. When the special Guest user account is granted the CertificateExportPrivateKey permission, and Guest Access is enabled for the Octopus Server, an attacker can sign in as the Guest account and export Certificates managed by Octopus, including the...
CVE-2017-15610
The CVE describes a vulnerability in Octopus Deploy where, prior to version 3.17.7, granting the CertificateExportPrivateKey permission to the special Guest user and enabling Guest Access allows an attacker to sign in as Guest and export certificates managed by Octopus, including private keys. Af...
CVE-2017-15609
Octopus before 3.17.7 allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets...
PT-2017-14130
Name of the Vulnerable Software and Affected Versions Octopus versions prior to 3.17.7 Description The issue allows an authenticated user with the permission to invite new users to invite users to teams with escalated privileges. Recommendations For versions prior to 3.17.7, update to version...
CVE-2017-15611: Incorrect Permission Assignment for Critical Resource
In Octopus before 3.17.7, an authenticated user who was explicitly granted the permission to invite new users aka UserInvite can invite users to teams with escalated privileges...
CVE-2017-15609: Missing Encryption of Sensitive Data
Octopus before 3.17.7 allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets...
PT-2017-14128
Name of the Vulnerable Software and Affected Versions Octopus versions prior to 3.17.7 Description The issue allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets. Recommendations For versions prior to 3.17....
PT-2017-14129
Name of the Vulnerable Software and Affected Versions Octopus versions prior to 3.17.7 Description An issue was discovered where an attacker can sign in as the Guest account and export Certificates managed by Octopus, including the private key, when the special Guest user account is granted the...
CVE-2017-15610: Exposure of Sensitive Information to an Unauthorized Actor
An issue was discovered in Octopus before 3.17.7. When the special Guest user account is granted the CertificateExportPrivateKey permission, and Guest Access is enabled for the Octopus Server, an attacker can sign in as the Guest account and export Certificates managed by Octopus, including the...
CVE-2017-11348
In Octopus Deploy 3.x before 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, potentially overwriting other packages or modifying system files. This is a directory traversal in the PackageId value...
CVE-2017-11348
In Octopus Deploy 3.x before 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, potentially overwriting other packages or modifying system files. This is a directory traversal in the PackageId value...
Directory traversal
In Octopus Deploy 3.x before 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, potentially overwriting other packages or modifying system files. This is a directory traversal in the PackageId value...
CVE-2017-11348
In Octopus Deploy 3.x before 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, potentially overwriting other packages or modifying system files. This is a directory traversal in the PackageId value...
PT-2017-11949
Name of the Vulnerable Software and Affected Versions Octopus Deploy versions prior to 3.15.4 Description The issue allows an authenticated user with PackagePush permission to upload a maliciously crafted NuGet package. This could potentially lead to overwriting other packages or modifying system...
CVE-2017-11348
Octopus Deploy 3.x pre-3.15.4 is affected. An authenticated user with PackagePush permission can upload a malicious NuGet package that may overwrite other packages or modify system files due to a directory traversal flaw in the PackageId value. Affected component: package upload handling in Octop...
Octopus Deploy PackageId Value Directory Traversal Vulnerability
Octopus Deploy is an automation tool from Octopus Deploy Australia for development and deployment of . A security vulnerability exists in version 3.x of Octopus Deploy prior to 3.15.4. An attacker can exploit this vulnerability by uploading maliciously crafted NuGet packets to overwrite other...
CVE-2017-11348: Improper Limitation of a Pathname to a Restricted Directory
In Octopus Deploy 3.x before 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, potentially overwriting other packages or modifying system files. This is a directory traversal in the PackageId value...
Friday Squid Blogging: Food Supplier Passes Squid Off as Octopus
According to a lawsuit main article behind paywall, "a Miami-based food vendor and its supplier have been misrepresenting their squid as octopus in an effort to boost profits." As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read m...
Octopus Deploy Authentication Code Execution Vulnerability
Octopus is a deployment tool for .NET automation. An authentication code execution vulnerability exists in Octopus Deploy. Arbitrary code execution occurs due to poor filtering of the program during the authentication process...
Octopus Deploy - (Authenticated) Code Execution (Metasploit)
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/powershell' require 'json' class MetasploitModule 'Octopus Deploy Authenticated Code Execution', 'Description' = %q This module can be used to...