Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (109 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2017-15611 1 Octopus 1 Octopus Deploy 2025-04-20 N/A
In Octopus before 3.17.7, an authenticated user who was explicitly granted the permission to invite new users (aka UserInvite) can invite users to teams with escalated privileges.
CVE-2017-15609 1 Octopus 1 Octopus Deploy 2025-04-20 N/A
Octopus before 3.17.7 allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets.
CVE-2017-16810 1 Octopus 1 Octopus Deploy 2025-04-20 N/A
Cross-site scripting (XSS) vulnerability in the All Variables tab in Octopus Deploy 3.4.0-3.13.6 (fixed in 3.13.7) allows remote attackers to inject arbitrary web script or HTML via the Variable Set Name parameter.
CVE-2022-3460 1 Octopus 1 Octopus Server 2025-04-10 7.5 High
In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview.
CVE-2022-3614 1 Octopus 1 Octopus Server 2025-04-10 6.1 Medium
In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be redirected to the configured redirect url without any validation.
CVE-2022-4898 1 Octopus 1 Octopus Server 2025-03-27 5.4 Medium
In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially resolved in advisory 2022-07 however it was identified that the fix could be bypassed in certain circumstances. A different approach was taken to prevent the possibility of the support link being susceptible to XSS
CVE-2022-2883 1 Octopus 1 Octopus Server 2025-03-11 7.5 High
In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service
CVE-2022-2259 1 Octopus 1 Octopus Server 2025-03-03 4.3 Medium
In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view these items
CVE-2022-2258 1 Octopus 1 Octopus Server 2025-02-27 4.3 Medium
In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these items
CVE-2022-4009 1 Octopus 1 Octopus Server 2025-02-26 8.8 High
In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation
CVE-2022-2507 1 Octopus 1 Octopus Server 2025-02-05 5.3 Medium
In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage
CVE-2022-4008 1 Octopus 1 Octopus Server 2025-01-28 5.5 Medium
In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service
CVE-2022-4870 1 Octopus 1 Octopus Server 2025-01-21 5.3 Medium
In affected versions of Octopus Deploy it is possible to discover network details via error message
CVE-2023-1904 1 Octopus 1 Octopus Server 2024-11-21 4.2 Medium
In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server.
CVE-2022-30532 3 Linux, Microsoft, Octopus 3 Linux Kernel, Windows, Octopus Server 2024-11-21 5.3 Medium
In affected versions of Octopus Deploy, there is no logging of changes to artifacts within Octopus Deploy.
CVE-2022-2783 1 Octopus 1 Octopus Server 2024-11-21 5.3 Medium
In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token
CVE-2022-2781 1 Octopus 1 Octopus Server 2024-11-21 5.3 Medium
In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables.
CVE-2022-2528 1 Octopus 1 Octopus Server 2024-11-21 6.5 Medium
In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing packages.
CVE-2022-2416 1 Octopus 1 Octopus Server 2024-11-21 5.5 Medium
In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment.
CVE-2022-2346 1 Octopus 1 Octopus Server 2024-11-21 5.5 Medium
In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints.