Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

162 results · page 2 of 4

Aug 1, 2023In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints.CVE-2022-2346 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.5
In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
May 17, 2023In affected versions of Octopus Deploy it is possible to discover network details via error messageCVE-2022-4870 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.3
In affected versions of Octopus Deploy it is possible to discover network details via error message
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
May 10, 2023In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of ServiceCVE-2022-4008 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.5
In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service
Product
Octopus Tentacle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
May 2, 2023In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview functionCVE-2023-2247 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.3
In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Apr 19, 2023In affected versions of Octopus Deploy it is possible to render user supplied input into the webpageCVE-2022-2507 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.3
In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Mar 16, 2023In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creationCVE-2022-4009 · Other software · Octopus Deploy · reported by security@octopus.comHigh 8.8
In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Mar 13, 2023In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view these itemsCVE-2022-2259 · Other software · Octopus Deploy · reported by security@octopus.comMedium 4.3
In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view these items
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Mar 13, 2023In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these itemsCVE-2022-2258 · Other software · Octopus Deploy · reported by security@octopus.comMedium 4.3
In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these items
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Feb 21, 2023In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of ServiceCVE-2022-2883 · Other software · Octopus Deploy · reported by security@octopus.comHigh 7.5
In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Jan 30, 2023In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link.CVE-2022-4898 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.4
In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially resolved in advisory 2022-07 however it was identified that the fix could be bypassed in certain circumstances. A different approach was taken to prevent the possibility of the support link being susceptible to XSS
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Jan 20, 2023A null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows attackers to cause denCVE-2022-47021 · Other software · Xiph · reported by MITREHigh 7.8
A null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows attackers to cause denial of service or other unspecified impacts.
Product
Opusfile
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 2, 2023In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be redirectCVE-2022-3614 · Other software · Octopus Deploy · reported by security@octopus.comMedium 6.1
In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be redirected to the configured redirect url without any validation.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Jan 2, 2023In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview.CVE-2022-3460 · Other software · Octopus Deploy · reported by security@octopus.comHigh 7.5
In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Nov 25, 2022In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verboCVE-2022-2721 · Other software · Octopus Deploy · reported by security@octopus.comHigh 7.5
In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verbose logging is enabled.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Oct 31, 2022In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deletCVE-2022-2572 · Other software · Octopus Deploy · reported by security@octopus.comCritical 9.8
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Oct 27, 2022Crash in the OPUS protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture fileCVE-2022-3725 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 6.3
Crash in the OPUS protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file
Product
Wireshark
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com gitlab.com
Oct 27, 2022In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters.CVE-2022-2782 · Other software · Octopus Deploy · reported by security@octopus.comCritical 9.1
In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Oct 27, 2022In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose errorCVE-2022-2508 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.3
In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose error messaging.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Oct 14, 2022In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the pCVE-2022-2780 · Other software · Octopus Deploy · reported by security@octopus.comHigh 8.1
In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the potential for an NTLM relay attack.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Oct 13, 2022In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerabilCVE-2022-2828 · Other software · Octopus Deploy · reported by security@octopus.comMedium 6.5
In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerability
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Oct 12, 2022In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value masking will only partiallCVE-2022-2720 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.3
In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value masking will only partially work.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Oct 6, 2022In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF tokenCVE-2022-2783 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.3
In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Oct 6, 2022In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables.CVE-2022-2781 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.3
In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Sep 30, 2022In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.CVE-2022-2778 · Other software · Octopus Deploy · reported by security@octopus.comCritical 9.8
In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Sep 28, 2022In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a resCVE-2022-2760 · Other software · Octopus Deploy · reported by security@octopus.comMedium 4.3
In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a resource is part of another Space.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Sep 9, 2022In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing packages.CVE-2022-2528 · Other software · Octopus Deploy · reported by security@octopus.comMedium 6.5
In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing packages.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Aug 19, 2022In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build information request validation.CVE-2022-2075 · Other software · Octopus Deploy · reported by security@octopus.comHigh 7.5
In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build information request validation.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Aug 19, 2022In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project Template.CVE-2022-2074 · Other software · Octopus Deploy · reported by security@octopus.comHigh 7.5
In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project Template.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Aug 19, 2022In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function.CVE-2022-2049 · Other software · Octopus Deploy · reported by security@octopus.comHigh 7.5
In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Aug 19, 2022In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview.CVE-2022-1901 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.3
In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Aug 15, 2022Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho ManageEngine Analytics Plus before 4350 allows remote attackers to run aCVE-2020-21642 · Email & office · Zohocorp · reported by MITRECritical 9.8
Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho ManageEngine Analytics Plus before 4350 allows remote attackers to run arbitrary code.
Product
Manageengine Analytics Plus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record manageengine.com manageengine.com
Aug 1, 2022Pligg CMS v2.0.2 was discovered to contain a time-based SQL injection vulnerability via the page_size parameter at load_data_for_topusers.php.CVE-2022-34955 · Other software · Pligg · reported by MITRECritical 9.8
Pligg CMS v2.0.2 was discovered to contain a time-based SQL injection vulnerability via the page_size parameter at load_data_for_topusers.php.
Product
Pligg CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 19, 2022In affected versions of Octopus Deploy, there is no logging of changes to artifacts within Octopus Deploy.CVE-2022-30532 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.3
In affected versions of Octopus Deploy, there is no logging of changes to artifacts within Octopus Deploy.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Jul 15, 2022In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link.CVE-2022-29890 · Other software · Octopus Deploy · reported by security@octopus.comMedium 6.1
In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Jul 15, 2022In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports fromCVE-2022-1881 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.3
In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports from a Project they do not have permissions to access. This vulnerability only impacts projects within the same Space.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Jun 17, 2022All versions of package @discordjs/opus are vulnerable to Denial of Service (DoS) when trying to encode using an encoder with zero channels, or a non-initializeCVE-2022-25345 · Other software · Discordjs · reported by report@snyk.ioHigh 7.5
All versions of package @discordjs/opus are vulnerable to Denial of Service (DoS) when trying to encode using an encoder with zero channels, or a non-initialized buffer. This leads to a hard crash.
Product
Opus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com snyk.io
Jun 12, 2022In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental feature flag all new users would have accCVE-2022-2013 · Other software · Octopus Deploy · reported by security@octopus.comHigh 7.5
In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental feature flag all new users would have access to the Script Console within their private space.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
May 19, 2022When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users.CVE-2022-1670 · Other software · Octopus Deploy · reported by security@octopus.comHigh 7.5
When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users. It was possible to bypass this restriction of validity to create extra user accounts above the initial number of invited users.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
May 4, 2022Permissions were not properly verified in the API on projects using version control in Git.CVE-2022-1502 · Other software · Octopus Deploy · reported by security@octopus.comMedium 4.3
Permissions were not properly verified in the API on projects using version control in Git. This allowed projects to be modified by users with only ProjectView permissions.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Feb 6, 2022In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server will allow open redirects.CVE-2022-23184 · Other software · Octopus Deploy · reported by security@octopus.comMedium 6.1
In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server will allow open redirects.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Jan 19, 2022When the Windows Tentacle docker image starts up it logs all the commands that it runs along with the arguments, which writes the Octopus Server API key in plaiCVE-2021-31821 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.5
When the Windows Tentacle docker image starts up it logs all the commands that it runs along with the arguments, which writes the Octopus Server API key in plaintext. This does not affect the Linux Docker image
Product
Octopus Tentacle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Nov 24, 2021When Octopus Tentacle is installed on a Linux operating system, the systemd service file permissions are misconfigured.CVE-2021-31822 · Other software · Octopus Deploy · reported by security@octopus.comHigh 7.8
When Octopus Tentacle is installed on a Linux operating system, the systemd service file permissions are misconfigured. This could lead to a local unprivileged user modifying the contents of the systemd service file to gain privileged access.
Product
Octopus Tentacle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Oct 6, 2021When Octopus Tentacle is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loadiCVE-2021-26557 · Other software · Octopus Deploy · reported by security@octopus.comHigh 7.8
When Octopus Tentacle is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loading to gain privileged access.
Product
Octopus Tentacle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Oct 6, 2021When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loadingCVE-2021-26556 · Other software · Octopus Deploy · reported by security@octopus.comHigh 7.8
When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loading to gain privileged access.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Sep 21, 2021In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other baseCVE-2021-31819 · Other software · Octopus Deploy · reported by security@octopus.comCritical 9.8
In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other based on certificate verification.
Product
Halibut
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Aug 18, 2021In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in plaintext in the UICVE-2021-31820 · Other software · Octopus Deploy · reported by security@octopus.comHigh 7.5
In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in plaintext in the UI.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Jul 8, 2021When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServeCVE-2021-31817 · Other software · Octopus Deploy · reported by security@octopus.comHigh 7.5
When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServer.txt log file in plaintext.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Jul 8, 2021When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServeCVE-2021-31816 · Other software · Octopus Deploy · reported by security@octopus.comHigh 7.5
When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServer.txt log file in plaintext.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
Jun 17, 2021Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API requeCVE-2021-31818 · Other software · Octopus Deploy · reported by security@octopus.comMedium 4.3
Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API request isn’t parameterised correctly. Exploiting this vulnerability could allow unauthorised access to database tables.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com advisories.octopus.com
May 14, 2021Cleartext storage of sensitive information in multiple versions of Octopus Server where in certain situations when running import or export processes, the passwCVE-2021-30183 · Other software · Octopus · reported by MITREHigh 7.5
Cleartext storage of sensitive information in multiple versions of Octopus Server where in certain situations when running import or export processes, the password used to encrypt and decrypt sensitive values would be written to the logs in plaintext.
Product
Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.