Octopus Server
9 CVEs affecting Octopus Server. Latest disclosed: 2022-05-04. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-31817 | High | 7.5 | 2021-07-08 | When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServ… |
CVE-2021-31816 | High | 7.5 | 2021-07-08 | When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServ… |
CVE-2021-30183 | High | 7.5 | 2021-05-14 | Cleartext storage of sensitive information in multiple versions of Octopus Server where in certain situations when running import or export processes, the pass… |
CVE-2019-15508 | Medium | 6.5 | 2019-08-23 | In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintVariables circumstan… |
CVE-2019-15507 | Medium | 6.5 | 2019-08-23 | In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an authenticated user (in certain limited special-characters circumsta… |
CVE-2019-19085 | Medium | 5.4 | 2019-11-18 | A persistent cross-site scripting (XSS) vulnerability in Octopus Server 3.4.0 through 2019.10.5 allows remote authenticated attackers to inject arbitrary web s… |
CVE-2022-1502 | Medium | 4.3 | 2022-05-04 | Permissions were not properly verified in the API on projects using version control in Git. This allowed projects to be modified by users with only ProjectView… |
CVE-2021-31818 | Medium | 4.3 | 2021-06-17 | Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API requ… |
CVE-2020-16197 | Medium | 4.3 | 2020-08-25 | An issue was discovered in Octopus Deploy 3.4. A deployment target can be configured with an Account or Certificate that is outside the scope of the deployment… |