CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2022-4870
https://notcve.org/view.php?id=CVE-2022-4870
In affected versions of Octopus Deploy it is possible to discover network details via error message • https://advisories.octopus.com/post/2023/sa2023-09 • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-4008
https://notcve.org/view.php?id=CVE-2022-4008
In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service • https://advisories.octopus.com/post/2023/sa2023-08 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2022-2507
https://notcve.org/view.php?id=CVE-2022-2507
In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage • https://advisories.octopus.com/post/2023/sa2023-06 •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-4009
https://notcve.org/view.php?id=CVE-2022-4009
In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation • https://advisories.octopus.com/post/2023/sa2023-05 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2022-2259
https://notcve.org/view.php?id=CVE-2022-2259
In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view these items • https://advisories.octopus.com/post/2023/sa2023-04 •