RSS   Podatności dla 'Server'   RSS

2022-05-04
 
CVE-2022-1502

CWE-863
 
 
Permissions were not properly verified in the API on projects using version control in Git. This allowed projects to be modified by users with only ProjectView permissions.

 
2021-07-08
 
CVE-2021-31816

CWE-312
 
 
When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServer.txt log file in plaintext.

 
 
CVE-2021-31817

CWE-312
 
 
When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServer.txt log file in plaintext.

 
2021-06-17
 
CVE-2021-31818

CWE-89
 
 
Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API request isn�??t parameterised correctly. Exploiting this vulnerability could allow unauthorised access to database tables.

 
2020-08-25
 
CVE-2020-16197

CWE-295
 
 
An issue was discovered in Octopus Deploy 3.4. A deployment target can be configured with an Account or Certificate that is outside the scope of the deployment target. An authorised user can potentially use a certificate that they are not in scope to use. An authorised user is also able to obtain certificate metadata by associating a certificate with certain resources that should fail scope validation.

 
2019-11-18
 
CVE-2019-19085

CWE-79
 
 
A persistent cross-site scripting (XSS) vulnerability in Octopus Server 3.4.0 through 2019.10.5 allows remote authenticated attackers to inject arbitrary web script or HTML.

 
2019-08-23
 
CVE-2019-15508

CWE-532
 
 
In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintVariables circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 5.0.1. The fix was back-ported to 4.0.7.

 
 
CVE-2019-15507

CWE-532
 
 
In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an authenticated user (in certain limited special-characters circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 2019.7.7. The fix was back-ported to LTS 2019.6.7 as well as LTS 2019.3.8.

 

 >>> Vendor: Octopus 3 Produkty
Octopus deploy
Server
Halibut

Copyright 2024, cxsecurity.com

 

Back to Top