Vulnerabilidades en Octopus Deploy
80 resultadosCVE-2022-3460HIGHIn affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed EPSS 0.6%CVE-2022-2720MEDIUMIn affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value maskinEPSS 0.6%CVE-2022-1881—In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download EPSS 0.6%CVE-2022-23184—In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server will allow open rediEPSS 0.6%CVE-2022-1901—In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview.EPSS 0.6%CVE-2022-2760MEDIUMIn affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an erroEPSS 0.5%CVE-2022-30532—In affected versions of Octopus Deploy, there is no logging of changes to artifacts within Octopus Deploy.EPSS 0.5%CVE-2022-1502—Permissions were not properly verified in the API on projects using version control in Git. This allowed projects to be modified by users wiEPSS 0.5%CVE-2022-2528—In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing pEPSS 0.5%CVE-2022-2258MEDIUMIn affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view theseEPSS 0.5%CVE-2022-29890—In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link.EPSS 0.5%CVE-2022-4870MEDIUMIn affected versions of Octopus Deploy it is possible to discover network details via error messageEPSS 0.4%CVE-2023-2247—In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview functionEPSS 0.4%CVE-2026-91778HIGHIn affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including theEPSS 0.4%CVE-2022-2259MEDIUMIn affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view tEPSS 0.4%CVE-2026-12878HIGHIn affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.EPSS 0.4%CVE-2025-0588MEDIUMIn affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By sEPSS 0.4%CVE-2022-3614MEDIUMIn affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication chEPSS 0.4%CVE-2022-2507MEDIUMIn affected versions of Octopus Deploy it is possible to render user supplied input into the webpageEPSS 0.4%CVE-2024-2975HIGHA race condition was identified through which privilege escalation was possible in certain configurations.EPSS 0.4%