GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery

Server-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusion

An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizing publicly exposed…

An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication with the optional encrypted assertions…

Unsafe Reflection in Github Enterprise Server leading to Command Injection

Incorrect authorization check in GitHub Enterprise Server leading to escalation of privileges in GraphQL API requests from GitHub Apps using scoped user-to-server tokens

Improper Limitation of a Pathname to a Restricted Directory in GitHub Enterprise Server leading to RCE

An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted runner group it should not have had access to

Improper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise Server

DOM-based Cross-Site Scripting was identified in GitHub Enterprise Server Issues search allows privilege escalation and unauthorized workflow triggers

Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance storage via the X-GitHub-Request-Id header

Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation

An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed when the encrypted assertions feature was enabled

Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console

Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console

Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console

Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console

Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console

Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console

Improper Handling of HTTP Redirects vulnerability was identified in GitHub Enterprise Server that allowed leaking of authorization token and enabled remote code execution

Server-Side Request Forgery in GitHub Enterprise Server allowed extraction of sensitive environment variables via timing side-channel attack

Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts

Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal services

Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypass

Remote code execution via git push option injection in GitHub Enterprise Server

Improper Verification of Cryptographic Signature in GitHub Enterprise Server Allows Signature Spoofing by Improper Validation

Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise Server

Improper Privilege Management in GitHub Enterprise Server management console leads to privilege escalation

Path traversal in GitHub Enterprise Server leading to remote code execution

Code injection in GitHub Enterprise Server leading to arbitrary environment variables in GitHub Actions

Path traversal in GitHub Enterprise Server leading to remote code execution in GitHub Pages

Improper Neutralization of Argument Delimiters in a Command in GitHub Enterprise Server leading to Remote Code Execution

Deserialization of Untrusted Data vulnerability in GitHub Enterprise Server leading to Remote Code Execution

A path traversal vulnerability was identified in GitHub Enterprise Server management console that allowed the bypass of CSRF protections

A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site

A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authorization web flow than…

A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authorization web flow than…

A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site

Path traversal vulnerability in GitHub Enterprise Server allowed writing files to arbitrary repository paths, including GitHub Actions workflow files, via unchecked Dependabot dependency-file paths

Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint

Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console

Markdown math block sanitization bypass allows privilege escalation and unauthorized workflow triggers

Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution

Denial of service vulnerability in GitHub Enterprise Server allowed unauthenticated service disruption via deeply nested request parameters

Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpoint

Improper Authentication in GitHub Enterprise Server leading to Authentication Bypass for Public Repository Data

Insufficient Entropy in GitHub Enterprise Server Management Console Invitation Token

Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token

Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation

Pre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege Escalation