Michaelnoonan

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `Variable Set Name` parameter in the All Variables tab.

A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML via the `Step Template Name` parameter. This could potentially lead to unauthorized actions on the affected system.

An issue was discovered where an attacker can sign in as the Guest account and export Certificates managed by Octopus, including the private key, when the special Guest user account is granted the CertificateExportPrivateKey permission and Guest Access is enabled for the Octopus Server.