Edward Prior

Name of the Vulnerable Software and Affected Versions: Octopus Deploy (affected versions not specified) Description: The issue allows uploading files to unexpected locations on the host using an API endpoint. This is due to a lack of validation in a field, which could potentially result in ways to circumvent expected workflows. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Octopus Server (affected versions not specified) Description: In affected versions of Octopus Server, a user with sufficient access could set custom headers in all server responses. By submitting a specifically crafted referrer header, the user could ensure that all subsequent server responses would return 500 errors, rendering the site mostly unusable. The user could subsequently set and unset the referrer header to control the denial of service state with a valid CSRF token, whilst new CSRF tokens could not be generated. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to the absence of a warning when a user attempts to navigate to a new protocol handler under certain conditions. This could potentially allow a remote attacker to impact data integrity.

The issue is related to the disclosure of information through registration files, potentially exposing browsing habits of users running in a private tab. This could allow a remote attacker to reveal protected information. The estimated number of potentially affected devices worldwide is not specified.

The issue is related to the incorrect functioning of `ms-cxh` and `ms-cxh-full` protocol handlers, which could be leveraged to trigger a denial of service. This affects Windows operating systems. The exploitation of this issue may allow a remote attacker to cause the application to crash using a specially crafted website.

The issue allows for unauthenticated user enumeration by interacting with an unsecured endpoint to retrieve information on each account within the system.

The application was vulnerable to a session fixation that could be used to hijack accounts.

The application is vulnerable to an authenticated Stored Cross-Site Scripting (XSS) issue in its messaging functionality. This could lead to privilege escalation or the compromise of a targeted account.

The issue allows authenticated information disclosure, enabling administrators to view unsalted user passwords. This could lead to the compromise of plaintext passwords via offline attacks.

The application is susceptible to Server-Side Request Forgery attacks. This allows the backend server to interact with unexpected endpoints, which could include internal and local services. As a result, it may lead to attacks on other downstream systems.

The application has a CSV injection issue in its data export functionality. This allows malicious code to be embedded within the export data, which can then be triggered when the exported data is viewed.

The application is vulnerable to an authenticated Stored Cross-Site Scripting (XSS) issue in the user profile data fields. This could be used to escalate privileges within the application and compromise any account that views the affected user profile.

The application is affected by an authenticated Stored Cross-Site Scripting (XSS) issue in the upload and download functionality. This could allow attackers to escalate privileges or compromise accounts by coercing them into accessing targeted files.

The application is affected by an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in the barcode generation functionality. This allows attackers to generate an unsafe link that could compromise users.

The application is vulnerable to Cross-Site Request Forgery (CSRF) attacks. This allows an attacker to coerce users into sending malicious requests to the site, potentially leading to account deletion or, in rare cases, account hijacking and the creation of additional admin accounts.