CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| 02/08/2023 |
| CVE-2022-2346 | 中4.3 | In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints. | 02/08/2023 |
| CVE-2022-4870 | 中5.3 | In affected versions of Octopus Deploy it is possible to discover network details via error message | 18/05/2023 |
| CVE-2022-4008 | 中5.5 | In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service | 10/05/2023 |
| CVE-2023-2247 | 中5.3 | In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function | 02/05/2023 |
| CVE-2022-2507 | 中5.3 | In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage | 19/04/2023 |
| CVE-2022-4009 | 高8.8 | In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation | 16/03/2023 |
| CVE-2022-2259 | 中4.3 | In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view these items | 13/03/2023 |
| CVE-2022-2258 | 中4.3 | In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these items | 13/03/2023 |
| CVE-2022-2883 | 高7.5 | In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service | 22/02/2023 |
| CVE-2022-4898 | 中5.4 | In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially resolved in advisory 2022-07 however it was identified that the fix could be bypassed in certain circumstances. A different approach was taken to prevent the possib | 31/01/2023 |
| CVE-2022-3614 | 中6.1 | In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be redirected to the configured redirect url without any validation. | 03/01/2023 |
| CVE-2022-3460 | 高7.5 | In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview. | 03/01/2023 |
| CVE-2022-2721 | 高7.5 | In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verbose logging is enabled. | 25/11/2022 |
| CVE-2022-2572 | 緊急9.8 | In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked. | 01/11/2022 |
| CVE-2022-2782 | 緊急9.1 | In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters. | 27/10/2022 |
| CVE-2022-2508 | 中5.3 | In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose error messaging. | 27/10/2022 |