CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-30183
https://notcve.org/view.php?id=CVE-2021-30183
14 May 2021 — Cleartext storage of sensitive information in multiple versions of Octopus Server where in certain situations when running import or export processes, the password used to encrypt and decrypt sensitive values would be written to the logs in plaintext. Un almacenamiento de texto sin cifrar de información confidencial en múltiples versiones de Octopus Server, donde en determinadas situaciones cuando se ejecutan procesos de importación o exportación, la contraseña usada para cifrar y descifrar valores confiden... • https://advisories.octopus.com/adv/2021-03---Cleartext-Storage-of-Sensitive-Information-%28CVE-2021-30183%29.1817083941.html • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2019-19085
https://notcve.org/view.php?id=CVE-2019-19085
18 Nov 2019 — A persistent cross-site scripting (XSS) vulnerability in Octopus Server 3.4.0 through 2019.10.5 allows remote authenticated attackers to inject arbitrary web script or HTML. Una vulnerabilidad de tipo cross-site scripting (XSS) persistente en Octopus Server versiones 3.4.0 hasta 2019.10.5, tiene a atacantes autenticados remotos inyectar script web o HTML arbitrario. • https://github.com/OctopusDeploy/Issues/issues/5961 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-15508
https://notcve.org/view.php?id=CVE-2019-15508
23 Aug 2019 — In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintVariables circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 5.0.1. The fix was back-ported to 4.0.7. En las versiones 3.0.8 a 5.0.0 de Octopus Tentacle, cuando se configura un proxy de solicitud web, un usuario autenticado (en determinadas circunstancias limitadas de OctopusPrintVaria... • https://github.com/OctopusDeploy/Issues/issues/5750 • CWE-312: Cleartext Storage of Sensitive Information CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-5748
https://notcve.org/view.php?id=CVE-2019-5748
09 Jan 2019 — In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks. En la versión 4.2 de Traccar Server, protocol/SpotProtocolDecoder.java podría permitir ataques de XEE (XML External Entity). • https://github.com/traccar/traccar/commit/d7f6c53fd88635885914013649b6807ec53227bf • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2011-3825
https://notcve.org/view.php?id=CVE-2011-3825
24 Sep 2011 — Zend Framework 1.11.3 in Zend Server CE 5.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by Validate.php and certain other files. Zend Framework v1.11.3 en Zend Server CE v5.1.0 permite a atacantes remotos obtener información sensible a través de una petición directa a un archivo .php, lo que revela la ruta de instalación en un mensaje de error, como se demostró con Validate.php y algun... • http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •