Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
172 results · page 2 of 4
Apr 17, 2024It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt.CVE-2023-4509 · Other software · Octopus Deploy · reported by security@octopus.comMedium 4.3
It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Apr 8, 2024A race condition was identified through which privilege escalation was possible in certain configurations.CVE-2024-2975 · Other software · Octopus Deploy · reported by security@octopus.comHigh 8.8
A race condition was identified through which privilege escalation was possible in certain configurations.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Mar 20, 2024Authentication Bypass by Primary Weakness vulnerability in XPodas Octopod allows Authentication Bypass.CVE-2024-1202 · Other software · XPodas · reported by iletisim@usom.gov.trCritical 9.8
Authentication Bypass by Primary Weakness vulnerability in XPodas Octopod allows Authentication Bypass. This issue affects Octopod: before v1. NOTE: The vendor was contacted and it was learned that the product is not supported.
- Product
- Octopod
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Mar 18, 2024OctoPrint provides a web interface for controlling consumer 3D printers.CVE-2024-28237 · Other software · OctoPrint · reported by GitHubMedium 4
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to configure or talk a victim with administrator rights into configuring a webcam snapshot URL which when tested through the "Test" button included in the web interface will execute JavaScript code in the victims browser when attempting to render the snapshot image. An attacker who successfully talked a victim with admin rights into performing a snapshot test with such a crafted URL could use this to retrieve or modify sensitive configuration settings, interrupt prints or otherwise interact with the OctoPrint instance in a malicious way. The vulnerability is patched in version 1.10.0rc3. OctoPrint administrators are strongly advised to thoroughly vet who has admin access to their installation and what settings they modify based on instructions by strangers.
- Product
- OctoPrint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2024Yocto Project is an open source collaboration project that helps developers create custom Linux-based systems regardless of the hardware architecture.CVE-2024-25626 · Other software · yoctoproject · reported by GitHubHigh 8.8
Yocto Project is an open source collaboration project that helps developers create custom Linux-based systems regardless of the hardware architecture. In Yocto Projects Bitbake before 2.6.2 (before and included Yocto Project 4.3.1), with the Toaster server (included in bitbake) running, missing input validation allows an attacker to perform a remote code execution in the server's shell via a crafted HTTP request. Authentication is not necessary. Toaster server execution has to be specifically run and is not the default for Bitbake command line builds, it is only used for the Toaster web based user interface to Bitbake. The fix has been backported to the bitbake included with Yocto Project 5.0, 3.1.31, 4.0.16, and 4.3.2.
- Product
- poky
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2024OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change theCVE-2024-23637 · Other software · OctoPrint · reported by GitHubMedium 4.2
OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0.
- Product
- OctoPrint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2024A vulnerability was found in hongmaple octopus 1.0.CVE-2024-0891 · Other software · hongmaple · reported by VulDBLow 3.5
A vulnerability was found in hongmaple octopus 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument description with the input <script>alert(document.cookie)</script> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-252043.
- Product
- octopus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2024A vulnerability was found in hongmaple octopus 1.0.CVE-2024-0890 · Other software · hongmaple · reported by VulDBMedium 6.3
A vulnerability was found in hongmaple octopus 1.0. It has been classified as critical. Affected is an unknown function of the file /system/dept/edit. The manipulation of the argument ancestors leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. VDB-252042 is the identifier assigned to this vulnerability.
- Product
- octopus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2024A vulnerability was found in hongmaple octopus 1.0.CVE-2024-0784 · Other software · hongmaple · reported by VulDBMedium 6.3
A vulnerability was found in hongmaple octopus 1.0. It has been classified as critical. Affected is an unknown function of the file /system/role/list. The manipulation of the argument dataScope leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The identifier of this vulnerability is VDB-251700.
- Product
- octopus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2023In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server.CVE-2023-1904 · Other software · Octopus Deploy · reported by security@octopus.comMedium 4.2
In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Oct 9, 2023OctoPrint is a web interface for 3D printers.CVE-2023-41047 · Other software · OctoPrint · reported by GitHubMedium 6.2
OctoPrint is a web interface for 3D printers. OctoPrint versions up until and including 1.9.2 contain a vulnerability that allows malicious admins to configure a specially crafted GCODE script that will allow code execution during rendering of that script. An attacker might use this to extract data managed by OctoPrint, or manipulate data managed by OctoPrint, as well as execute arbitrary commands with the rights of the OctoPrint process on the server system. OctoPrint versions from 1.9.3 onward have been patched. Administrators of OctoPrint instances are advised to make sure they can trust all other administrators on their instance and to also not blindly configure arbitrary GCODE scripts found online or provided to them by third parties.
- Product
- OctoPrint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2023In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment.CVE-2022-2416 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.5
In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Aug 1, 2023In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints.CVE-2022-2346 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.5
In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
May 17, 2023In affected versions of Octopus Deploy it is possible to discover network details via error messageCVE-2022-4870 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.3
In affected versions of Octopus Deploy it is possible to discover network details via error message
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
May 10, 2023In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of ServiceCVE-2022-4008 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.5
In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service
- Product
- Octopus Tentacle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
May 2, 2023In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview functionCVE-2023-2247 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.3
In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Apr 19, 2023In affected versions of Octopus Deploy it is possible to render user supplied input into the webpageCVE-2022-2507 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.3
In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Apr 2, 2023A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf servCVE-2023-28675 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentials.
- Product
- Jenkins OctoPerf Load Testing Plugin Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2023A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously cCVE-2023-28674 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentials.
- Product
- Jenkins OctoPerf Load Testing Plugin Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2023A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers with Overall/Read permission to enumerate credentiaCVE-2023-28673 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
- Product
- Jenkins OctoPerf Load Testing Plugin Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2023Jenkins OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint, allowing attackers with OvCVE-2023-28672 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint, allowing attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
- Product
- Jenkins OctoPerf Load Testing Plugin Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2023A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.0 and earlier allows attackers to connect to an attacker-spCVE-2023-28671 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
- Product
- Jenkins OctoPerf Load Testing Plugin Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creationCVE-2022-4009 · Other software · Octopus Deploy · reported by security@octopus.comHigh 8.8
In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Mar 13, 2023In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view these itemsCVE-2022-2259 · Other software · Octopus Deploy · reported by security@octopus.comMedium 4.3
In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view these items
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Mar 13, 2023In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these itemsCVE-2022-2258 · Other software · Octopus Deploy · reported by security@octopus.comMedium 4.3
In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these items
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Feb 21, 2023In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of ServiceCVE-2022-2883 · Other software · Octopus Deploy · reported by security@octopus.comHigh 7.5
In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Jan 30, 2023In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link.CVE-2022-4898 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.4
In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially resolved in advisory 2022-07 however it was identified that the fix could be bypassed in certain circumstances. A different approach was taken to prevent the possibility of the support link being susceptible to XSS
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Jan 2, 2023In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be redirectCVE-2022-3614 · Other software · Octopus Deploy · reported by security@octopus.comMedium 6.1
In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be redirected to the configured redirect url without any validation.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Jan 2, 2023In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview.CVE-2022-3460 · Other software · Octopus Deploy · reported by security@octopus.comHigh 7.5
In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Nov 25, 2022In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verboCVE-2022-2721 · Other software · Octopus Deploy · reported by security@octopus.comHigh 7.5
In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verbose logging is enabled.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Oct 31, 2022In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deletCVE-2022-2572 · Other software · Octopus Deploy · reported by security@octopus.comCritical 9.8
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Oct 27, 2022In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters.CVE-2022-2782 · Other software · Octopus Deploy · reported by security@octopus.comCritical 9.1
In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Oct 27, 2022In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose errorCVE-2022-2508 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.3
In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose error messaging.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Oct 19, 2022Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository octoprint/octoprint prior to 1.8.3.CVE-2022-3607 · Other software · octoprint · reported by security@huntr.devMedium 6
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository octoprint/octoprint prior to 1.8.3.
- Product
- octoprint/octoprint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2022In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the pCVE-2022-2780 · Other software · Octopus Deploy · reported by security@octopus.comHigh 8.1
In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the potential for an NTLM relay attack.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Oct 13, 2022In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerabilCVE-2022-2828 · Other software · Octopus Deploy · reported by security@octopus.comMedium 6.5
In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerability
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Oct 12, 2022In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value masking will only partiallCVE-2022-2720 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.3
In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value masking will only partially work.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Oct 6, 2022In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF tokenCVE-2022-2783 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.3
In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Oct 6, 2022In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables.CVE-2022-2781 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.3
In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Sep 30, 2022In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.CVE-2022-2778 · Other software · Octopus Deploy · reported by security@octopus.comCritical 9.8
In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Sep 28, 2022In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a resCVE-2022-2760 · Other software · Octopus Deploy · reported by security@octopus.comMedium 4.3
In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a resource is part of another Space.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Sep 21, 2022Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3.CVE-2022-3068 · Other software · octoprint · reported by security@huntr.devHigh 8.8
Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3.
- Product
- octoprint/octoprint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as longCVE-2022-2888 · Other software · octoprint · reported by security@huntr.devMedium 4.4
If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists.
- Product
- octoprint/octoprint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3.CVE-2022-2872 · Other software · octoprint · reported by security@huntr.devMedium 5.4
Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3.
- Product
- octoprint/octoprint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2022In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing packages.CVE-2022-2528 · Other software · Octopus Deploy · reported by security@octopus.comMedium 6.5
In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing packages.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Aug 22, 2022Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3.CVE-2022-2930 · Other software · octoprint · reported by security@huntr.devHigh 7.8
Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3.
- Product
- octoprint/octoprint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2022In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build information request validation.CVE-2022-2075 · Other software · Octopus Deploy · reported by security@octopus.comHigh 7.5
In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build information request validation.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Aug 19, 2022In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project Template.CVE-2022-2074 · Other software · Octopus Deploy · reported by security@octopus.comHigh 7.5
In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project Template.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Aug 19, 2022In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function.CVE-2022-2049 · Other software · Octopus Deploy · reported by security@octopus.comHigh 7.5
In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Aug 19, 2022In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview.CVE-2022-1901 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.3
In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.