Nathan Willoughby

**Name of the Vulnerable Software and Affected Versions** Octopus Server (affected versions not specified) **Description** Users with certain scoped permission sets can execute arbitrary scripts in an environment without the necessary authorization. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Octopus Server (affected versions not specified) **Description** An authenticated user with permissions to edit an Environment or Project can provide specifically crafted JSON content for the object. This leads to insecure deserialization, which allows the user to execute arbitrary code within the Octopus Server process. Insecure deserialization occurs when untrusted data is used to abuse the logic of an application to execute unintended code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.