CVE-2022-1502

CVE-2022-1502 affects Octopus Server/Octopus Deploy where the API failed to properly verify permissions for projects that use Git version control. The flaw allowed a user with only ProjectView permissions to modify such projects, indicating insufficient access checks in the Git-enabled workflow. ...

CVE-2021-31817

CVE-2021-31817 affects Octopus Server when configured with an external SQL database; during initial setup, the database password is written in plaintext to the OctopusServer.txt log. Impact is exposure of credentials via logs. Connected sources confirm the same description; no remediation steps o...

CVE-2019-15507

Octopus Deploy exposes a vulnerability (CVE-2019-15507) affecting versions 2018.8.4 to 2019.7.6 where, if a web request proxy is configured and the user is authenticated, a deployment could cause the web proxy password to be logged in cleartext. The issue is fixed in 2019.7.7, with back-ports to ...

CVE-2020-16197

CVE-2020-16197 affects Octopus Deploy 3.4. An authorised user can configure a deployment target with an Account or Certificate outside the target’s scope and may use a certificate not in scope. The vulnerability also allows obtaining certificate metadata by associating a certificate with resource...

CVE-2019-19085

CVE-2019-19085 is a persistent XSS in Octopus Server (versions 3.4.0 through 2019.10.5). According to the provided documents, remote authenticated attackers could inject arbitrary web script/HTML. The sources do not specify exploitation status, affected product families beyond Octopus Server, or ...

CVE-2019-15508

In Octopus Tentacle, versions 3.0.8 through 5.0.0 are affected. When a web request proxy is configured, an authenticated user (under certain limited OctopusPrintVariables circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. The i...

CVE-2021-31816

CVE-2021-31816 affects Octopus Server when configured with an external SQL database. During initial configuration, the database password is written to the OctopusServer.txt log file in plaintext, exposing sensitive credentials. This is documented across multiple sources (NVD entry and vendor advi...

CVE-2021-30183

The CVE-2021-30183 issue affects Octopus Server across multiple versions, where during import/export operations the password used to encrypt/decrypt sensitive values is written in plaintext to logs. Root cause is cleartext storage of sensitive information in log output. Public documents confirm t...

CVE-2021-31818

CVE-2021-31818 : Affected product is Octopus Server. The vulnerability is an authenticated SQL injection in the Events REST API caused by user-supplied data not being parameterised, allowing an attacker to access database tables. This is documented across multiple sources (NVD/Red Hat/CNNVD). Exp...