Vulnerabilities > Octopus > Octopus Deploy > 2019.7.4
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-05-02 | CVE-2023-2247 | Unspecified vulnerability in Octopus Deploy In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function | 5.3 |
| 2022-02-07 | CVE-2022-23184 | Open Redirect vulnerability in Octopus Deploy In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server will allow open redirects. | 6.1 |
| 2021-10-07 | CVE-2021-26556 | Untrusted Search Path vulnerability in Octopus Deploy When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loading to gain privileged access. | 7.8 |
| 2020-10-22 | CVE-2020-27155 | Unspecified vulnerability in Octopus Deploy An issue was discovered in Octopus Deploy through 2020.4.4. | 7.5 |
| 2020-10-12 | CVE-2020-25825 | Unspecified vulnerability in Octopus Deploy In Octopus Deploy 3.1.0 to 2020.4.0, certain scripts can reveal sensitive information to the user in the task logs. | 7.5 |
| 2020-06-19 | CVE-2020-14470 | Information Exposure Through Log Files vulnerability in Octopus Deploy In Octopus Deploy 2018.8.0 through 2019.x before 2019.12.2, an authenticated user with could trigger a deployment that leaks the Helm Chart repository password. | 6.5 |
| 2020-04-28 | CVE-2020-12286 | Unspecified vulnerability in Octopus Deploy In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not scoped to any dimension. | 4.3 |
| 2020-03-19 | CVE-2020-10678 | Unspecified vulnerability in Octopus Deploy In Octopus Deploy before 2020.1.5, for customers running on-premises Active Directory linked to their Octopus server, an authenticated user can leverage a bug to escalate privileges. | 8.8 |
| 2019-11-18 | CVE-2019-19084 | Unrestricted Upload of File with Dangerous Type vulnerability in Octopus Deploy In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted package, triggering an exception that exposes underlying operating system details. | 4.3 |