Login Request a demo
SE
Product
Server
by Octopus · last CVE May 4, 2022
9
CVEs
0
On KEV
7.5
Max CVSS
0
New 30D
Vulnerabilities9In the news2Timeline
Severity mix
Critical 0High 3Medium 6Low 0
Severity
All severities9Critical0High3Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Server to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2021-31817
7.5
1%
Jul 8
When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServer.txt log file in…
Affected: 2020.6.0 before 2020.6.5146; 2021.1.0 before 2021.1.7316
CVE-2021-31816
7.5
1%
Jul 8
When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServer.txt log file in…
Affected: before 2020.6.5146; 2021.1.0 before 2021.1.7316
CVE-2021-30183
7.5
1%
May 14
Cleartext storage of sensitive information in multiple versions of Octopus Server where in certain situations when running import or export processes, the password used to encrypt…
Affected: before 2020.5.329; 2020.6.0 before 2020.6.4847; 2021.1.0 before 2021.1.6959
CVE-2019-15508
6.5
1%
Aug 23
In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintVariables circumstances) could trigger a…
Affected: 3.0.8 through 2019.7.6
CVE-2019-15507
6.5
1%
Aug 23
In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an authenticated user (in certain limited special-characters circumstances) could trigger…
Affected: 2018.8.4 through 2019.7.6
CVE-2019-19085
5.4
1%
Nov 18
A persistent cross-site scripting (XSS) vulnerability in Octopus Server 3.4.0 through 2019.10.5 allows remote authenticated attackers to inject arbitrary web script or HTML
Affected: 3.4.0 through 2019.10.5
CVE-2022-1502
4.3
1%
May 4
Permissions were not properly verified in the API on projects using version control in Git
Affected: 2021.3 before 2021.3.12725; 2022.1 before 2022.1.2454
CVE-2021-31818
4.3
1%
Jun 17
Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API request isn’t…
Affected: 2018.9.17 before 2018.13.0; 2020.0.0 before 2020.6.0; 2020.6.0 before 2020.6.5146; 2021.1.0 before 2021.1.7316
CVE-2020-16197
4.3
1%
Aug 25
An issue was discovered in Octopus Deploy 3.4
Affected: 3.4.0
Showing 9