Octopus Deploy Security Vulnerabilities and Issues — Octopus Deploy CVE List

Lucene search

OctopusOctopus Deploy

3 matches found

CVE•added 2019/11/18 4:15 p.m.•51 views

CVE-2019-19084

In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted package, triggering an exception that exposes underlying operating system details.

4.3CVSS4.5AI score0.00575EPSS

CVE•added 2019/11/28 5:15 p.m.•37 views

CVE-2019-19375

In Octopus Deploy before 2019.10.7, in a configuration where SSL offloading is enabled, the CSRF cookie was sometimes sent without the secure attribute. (The fix for this was backported to LTS versions 2019.6.14 and 2019.9.8.)

5.3CVSS5.2AI score0.00167EPSS

CVE•added 2019/11/28 5:15 p.m.•30 views

CVE-2019-19376

In Octopus Deploy before 2019.10.6, an authenticated user with TeamEdit permission could send a malformed Team API request that bypasses input validation and causes an application level denial of service condition. (The fix for this was also backported to LTS 2019.9.8 and LTS 2019.6.14.)

6.5CVSS6.3AI score0.00231EPSS