Github Enterprise Server

Path traversal in GitHub Enterprise Server leading to arbitrary file reading when building a GitHub Pages site

Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling

Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling

Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed Privilege Escalation

Incorrect Authorization in GitHub Enterprise Server leads to Action Workflow modifications without Workflow Scope

Improper authorization allows read access to issue content in GitHub Enterprise Server

Improper Privilege Management allows for access to unauthorized repository content during migration

Cross-site Scripting in the tag name pattern field in the tag protections UI in GitHub Enterprise Server allows a malicious website that requires user interaction and social engineering to make changes to a user account via CSP bypass with created CSRF tokens. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12  and was fixed in all versions of 3.11.5, 3.10.7, 3.9.10, and 3.8.15. This vulnerability was reported via the GitHub Bug Bounty program.

Missing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Copilot pull request diff summary endpoint

Authentication bypass vulnerability in GitHub Enterprise Server allowed creation of local user accounts bypassing the configured external identity provider

Missing Authorization Check in GitHub Enterprise Server Allows Unauthorized Uploads to Repository Migration Exports

Authorization Bypass Vulnerability was Identified in GitHub Enterprise Server that Allowed Unauthorized Internal Users to Access Secret Scanning Alert Data

Improper Privilege Management allows for arbitrary workflows to be run

GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Deploy Keys

Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed arbitrary JavaScript execution via crafted Discussion titles in the Q&A category

GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Search API

An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped PAT through the use of nested tags. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in version 3.10.17, 3.11.15, 3.12.9, 3.13.4, and 3.14.1. This vulnerability was reported via the GitHub Bug Bounty program.

A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attackers to steal sensitive user information via social engineering. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in version 3.10.17, 3.11.15, 3.12.9, 3.13.4, and 3.14.1. This vulnerability was reported via the GitHub Bug Bounty program.

Reflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theft

Race Condition was identified in GitHub Enterprise Server that allowed maintaining admin permissions

Race Condition allows Unauthorized Outside Collaborator

Incomplete cache verification issue in GitHub Enterprise Server leading to exposure of private repo files

An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL allowing the attacker to retrieve metadata information of a user who clicks on the URL and further exploit it to create a convincing phishing page. This required the attacker to upload malicious SVG files and phish a victim user to click on that uploaded asset URL. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.14.2, 3.13.5, 3.12.10, 3.11.16. This vulnerability was reported via the GitHub Bug Bounty program.

UI misrepresentation vulnerability in GitHub Enterprise Server allowed unauthorized organization runner management via undisclosed OAuth scope on consent screen

Stored XSS vulnerability in GitHub Enterprise Server leading to injection of arbitrary attributes

Information disclosure in GitHub Enterprise Server leading to private repository leakage

Improper access control in all versions of GitHub Enterprise Server allows unauthorized users to view private repository names via the "Get a check run" API endpoint. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected GitHub Enterprise Server version 3.7.0 and above and was fixed in version 3.17.19, 3.8.12, 3.9.7 3.10.4, and 3.11.0.

Improper authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository names via mobile upload policy API

An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server, allowing an attacker to update the title, assignees, and labels of any issue inside a public repository. This was only exploitable inside a public repository. This vulnerability affected GitHub Enterprise Server versions before 3.14 and was fixed in versions 3.13.3, 3.12.8, and 3.11.14. Versions 3.10 of GitHub Enterprise Server are not affected. This vulnerability was reported via the GitHub Bug Bounty program.

Authorization bypass in GitHub Enterprise Server secret scanning push protection allows cross-repository modification of delegated bypass reviewers

An incorrect authorization vulnerability in GitHub Enterprise Server allows issue creation in unrelated public repositories

Improper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write access

Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized access to private repository names

Incorrect Authorization in GitHub Enterprise Server allows access to issue and commit search results without repo scope

Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized read-only access

Incorrect Authorization for Issue Comments in GitHub Enterprise Server

Unsafe configuration options in GitHub Pages leading to path traversal on GitHub Enterprise Server

Information disclosure in GitHub Enterprise Server leading to unauthorized viewing of private repository names

Incorrect Authorization allows Read Access to Issue Comments in GitHub Enterprise Server

CSRF vulnerability was identified in GitHub Enterprise Server that allowed performing actions on behalf of a user