CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-26161
https://notcve.org/view.php?id=CVE-2020-26161
26 Oct 2020 — In Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host header. En Octopus Deploy versiones hasta 2020.4.2, un atacante podría redireccionar a usuarios a un sitio externo por medio de un encabezado HTTP Host modificado • https://github.com/OctopusDeploy • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-27155
https://notcve.org/view.php?id=CVE-2020-27155
22 Oct 2020 — An issue was discovered in Octopus Deploy through 2020.4.4. If enabled, the websocket endpoint may allow an untrusted tentacle host to present itself as a trusted one. Se detectó un problema en Octopus Deploy versiones hasta 2020.4.4. Si está habilitado, el endpoint websocket puede permitir a un host de tentacle no confiable presentarse como uno confiable • https://github.com/OctopusDeploy •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-25825
https://notcve.org/view.php?id=CVE-2020-25825
12 Oct 2020 — In Octopus Deploy 3.1.0 to 2020.4.0, certain scripts can reveal sensitive information to the user in the task logs. En Octopus Deploy versiones 3.1.0 hasta 2020.4.0, determinados scripts pueden revelar información confidencial al usuario en los registros de tareas • https://github.com/OctopusDeploy/Issues/issues/6604 •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2020-24566
https://notcve.org/view.php?id=CVE-2020-24566
09 Sep 2020 — In Octopus Deploy 2020.3.x before 2020.3.4 and 2020.4.x before 2020.4.1, if an authenticated user creates a deployment or runbook process using Azure steps and sets the step's execution location to run on the server/worker, then (under certain circumstances) the account password is exposed in cleartext in the verbose task logs output. En Octopus Deploy versiones 2020.3.x anteriores a 2020.3.4 y versiones 2020.4.x anteriores a 2020.4.1, si un usuario autenticado crea un proceso de implementación o runbook us... • https://github.com/OctopusDeploy/Issues/issues/6563 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-16197
https://notcve.org/view.php?id=CVE-2020-16197
25 Aug 2020 — An issue was discovered in Octopus Deploy 3.4. A deployment target can be configured with an Account or Certificate that is outside the scope of the deployment target. An authorised user can potentially use a certificate that they are not in scope to use. An authorised user is also able to obtain certificate metadata by associating a certificate with certain resources that should fail scope validation. Se detectó un problema en Octopus Deploy versión 3.4. • https://github.com/OctopusDeploy/Issues/issues/6529 • CWE-295: Improper Certificate Validation •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-14470
https://notcve.org/view.php?id=CVE-2020-14470
19 Jun 2020 — In Octopus Deploy 2018.8.0 through 2019.x before 2019.12.2, an authenticated user with could trigger a deployment that leaks the Helm Chart repository password. En Octopus Deploy versiones 2018.8.0 hasta 2019.x anteriores a 2019.12.2, un usuario autenticado podría desencadenar una implementación que filtre la contraseña del repositorio Helm Chart • https://github.com/OctopusDeploy/Issues/issues/6438 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-12286
https://notcve.org/view.php?id=CVE-2020-12286
28 Apr 2020 — In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not scoped to any dimension. For example, a scoped user who is scoped to only one tenant can view server tasks scoped to any other tenant. En Octopus Deploy versiones anteriores a 2019.12.9 y versiones 2020 anteriores a 2020.1.12, el permiso TaskView no se extiende a ninguna dimensión. Por ejemplo, un usuario con alcance que solo tiene un inquilino puede visualizar las tareas del servidor enfocadas a cualquier otro inqu... • https://github.com/OctopusDeploy/Issues/issues/6331 •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-10678
https://notcve.org/view.php?id=CVE-2020-10678
19 Mar 2020 — In Octopus Deploy before 2020.1.5, for customers running on-premises Active Directory linked to their Octopus server, an authenticated user can leverage a bug to escalate privileges. En Octopus Deploy versiones anteriores a 2020.1.5, para los clientes que ejecutan Active Directory en sitio vinculado a su servidor de Octopus, un usuario autenticado puede aprovechar un bug para escalar privilegios. • https://github.com/OctopusDeploy/Issues/issues/6258 •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2019-19376
https://notcve.org/view.php?id=CVE-2019-19376
28 Nov 2019 — In Octopus Deploy before 2019.10.6, an authenticated user with TeamEdit permission could send a malformed Team API request that bypasses input validation and causes an application level denial of service condition. (The fix for this was also backported to LTS 2019.9.8 and LTS 2019.6.14.) En Octopus Deploy versiones anteriores a la versión 2019.10.6, un usuario autenticado con permiso TeamEdit podría enviar una petición a la API Team malformada que omita la comprobación de entrada y cause una condición de de... • https://github.com/OctopusDeploy/Issues/issues/6005 • CWE-20: Improper Input Validation CWE-476: NULL Pointer Dereference •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2019-19375
https://notcve.org/view.php?id=CVE-2019-19375
28 Nov 2019 — In Octopus Deploy before 2019.10.7, in a configuration where SSL offloading is enabled, the CSRF cookie was sometimes sent without the secure attribute. (The fix for this was backported to LTS versions 2019.6.14 and 2019.9.8.) En Octopus Deploy versiones anteriores a la versión 2019.10.7, en una configuración donde la descarga SSL está habilitada, la cookie CSRF algunas veces fue enviada sin el atributo seguro. (La corrección para esto fue incluida en las versiones LTS 2019.6.14 y 2019.9.8.) • https://github.com/OctopusDeploy/Issues/issues/5998 • CWE-352: Cross-Site Request Forgery (CSRF) •