Bartåomiej Gã³Rkiewicz

**Name of the Vulnerable Software and Affected Versions** Octopus Server (affected versions not specified) **Description** The issue allows an attacker to embed a Cross-Site Scripting payload on the audit page in affected versions of Octopus Server, given certain access levels. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Octopus Deploy (affected versions not specified) **Description** The issue allows a low privileged guest user to interact with extension endpoints. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Octopus Deploy (affected versions not specified) **Description** The issue allows a low-privileged guest user to craft a request that enables enumeration or reconnaissance of an environment. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Octopus Deploy (affected versions not specified) **Description** The issue allows an attacker to upload a zipbomb file as a task, resulting in Denial of Service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Octopus Deploy (affected versions not specified) **Description** The issue allows a user to introduce code via offline package creation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Octopus Deploy (affected versions not specified) **Description** The issue allows an attacker to upload a zipbomb file as a task, resulting in Denial of Service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Octopus Deploy (affected versions not specified) **Description** The issue allows for a Regex Denial of Service using the Variable Project Template in affected versions of Octopus Deploy. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Octopus Deploy (affected versions not specified) **Description** The issue allows for a Regex Denial of Service via the package upload function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Octopus Deploy (affected versions not specified) **Description** The issue allows for a Regex Denial of Service targeting the build information request validation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Octopus Server (affected versions not specified) **Description** The issue allows customization of the help sidebar in Octopus Server to include a Cross-Site Scripting payload in the support link. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Octopus Server (affected versions not specified) **Description** An Insecure Direct Object Reference issue exists, allowing users to download Project Exports from projects they do not have permissions to access. This issue only affects projects within the same Space. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.