In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters.

In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service

In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose error messaging.

In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage