GE
Product
GitHub Enterprise Server
24
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 4Medium 17Low 1
Watch
Add GitHub Enterprise Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-6800 | 9.8 | Aug 20 | An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizing publicly exposed… Affected: 3.13.0 through 3.13.2; 3.12.0 through 3.12.7; 3.11.0 through 3.11.13; 3.10.0 through 3.10.15 |
| CVE-2022-23739 | 9.8 | Jan 17 | Incorrect authorization check in GitHub Enterprise Server leading to escalation of privileges in GraphQL API requests from GitHub Apps using scoped user-to-server tokens Affected: 3.3 before 3.3.16; 3.4 before 3.4.11; 3.5 before 3.5.8; 3.6 before 3.6.4; 3.7 before 3.7.1 |
| CVE-2022-23734 | 8.8 | Oct 19 | Deserialization of Untrusted Data vulnerability in GitHub Enterprise Server leading to Remote Code Execution Affected: 3.2 before 3.2.16; 3.3 before 3.3.11; 3.4 before 3.4.6; 3.5 before 3.5.3 |
| CVE-2025-3246 | 7.6 | Apr 17 | Markdown math block sanitization bypass allows privilege escalation and unauthorized workflow triggers Affected: 3.16 through 3.16.1 |
| CVE-2024-5746 | 7.2 | Jun 20 | A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain arbitrary code execution… Affected: 3.9.0 through 3.9.15; 3.10.0 through 3.10.12; 3.11.0 through 3.11.10; 3.12.0 through 3.12.4 |
| CVE-2024-2443 | 7.2 | Mar 20 | Improper input validation vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console Affected: 3.8.0 before 3.8.17; 3.9.0 before 3.9.12; 3.10.0 before 3.10.9; 3.11.0 before 3.11.7; 3.12.0 before 3.12.1 |
| CVE-2024-6337 | 6.5 | Aug 20 | Incorrect Authorization allows read access to issues in GitHub Enterprise Server Affected: 3.10.0 through 3.10.15; 3.11.0 through 3.11.14; 3.12.0 through 3.12.7; 3.13.0 through 3.13.2 |
| CVE-2024-5817 | 6.5 | Jul 16 | Improper authorization allows read access to issue content in GitHub Enterprise Server Affected: 3.10.0 through 3.10.13; 3.11.0 through 3.11.11; 3.12.0 through 3.12.5; 3.13 through 3.13.0; 3.9.0 through 3.9.16 |
| CVE-2024-5815 | 6.5 | Jul 16 | Cross Site Request Forgery was identified in GitHub Enterprise Server that allowed write in a user owned repository Affected: 3.9.0 through 3.9.16; 3.10.0 through 3.10.13; 3.11.0 through 3.11.11; 3.12.0 through 3.12.5; 3.13 through 3.13.0 |
| CVE-2024-5795 | 6.5 | Jul 16 | Denial of Service vulnerability was identified in GitHub Enterprise Server that allowed resource exhaustion Affected: 3.9.0 through 3.9.16; 3.10.0 through 3.10.13; 3.11.0 through 3.11.11; 3.12.0 through 3.12.5; 3.13 through 3.13.0 |
| CVE-2024-5566 | 6.5 | Jul 16 | Improper Privilege Management allows for access to unauthorized repository content during migration Affected: 3.9.0 through 3.9.16; 3.10.0 through 3.10.13; 3.11.0 through 3.11.11; 3.12.0 through 3.12.5; 3.13 through 3.13.0 |
| CVE-2023-22380 | 6.5 | Feb 16 | Path traversal in GitHub Enterprise Server leading to arbitrary file reading when building a GitHub Pages site Affected: 3.7 before 3.7.6 |
| CVE-2022-46258 | 6.5 | Jan 9 | Incorrect Authorization in GitHub Enterprise Server leads to Action Workflow modifications without Workflow Scope Affected: 3.3 before 3.3.16; 3.4 before 3.4.11; 3.5 before 3.5.8; 3.6 before 3.6.4 |
| CVE-2024-8770 | 6.1 | Sep 23 | A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attackers to steal sensitive user… Affected: 3.14 through 3.14.0; 3.13.0 through 3.13.3; 3.12.0 through 3.12.8; 3.11.0 through 3.11.14; 3.10.0 through 3.10.16 |
| CVE-2022-23738 | 5.7 | Nov 1 | Incomplete cache verification issue in GitHub Enterprise Server leading to exposure of private repo files Affected: 3.2 before 3.2.20; 3.3 before 3.3.15; 3.4 before 3.4.10; 3.5 before 3.5.7; 3.6 before 3.6.3 |
| CVE-2022-23733 | 5.4 | Aug 2 | Stored XSS vulnerability in GitHub Enterprise Server leading to injection of arbitrary attributes Affected: 3.3 before 3.3.11; 3.4 before 3.4.6; 3.5 before 3.5.3 |
| CVE-2024-6395 | 5.3 | Jul 16 | GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Deploy Keys Affected: 3.10.0 through 3.10.13; 3.11.0 through 3.11.11; 3.12.0 through 3.12.5; 3.13 through 3.13.0; 3.9.0 through 3.9.16 |
| CVE-2024-6336 | 5.3 | Jul 16 | Security misconfiguration was identified in GitHub Enterprise Server that allowed sensitive data exposure Affected: 3.10.0 through 3.10.13; 3.11.0 through 3.11.11; 3.12.0 through 3.12.5; 3.13 through 3.13.0; 3.9.0 through 3.9.16 |
| CVE-2024-5816 | 5.3 | Jul 16 | Improper authorization allows persistent access in GitHub Enterprise Server Affected: 3.10.0 through 3.10.13; 3.11.0 through 3.11.11; 3.12.0 through 3.12.5; 3.13 through 3.13.0; 3.9.0 through 3.9.16 |
| CVE-2025-6600 | 4.3 | Jul 1 | GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Search API Affected: 3.17.0 through 3.17.1 |
| CVE-2024-9539 | 4.3 | Oct 11 | An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL allowing the attacker to retrieve metadata information of a user… Affected: 3.14.0 through 3.14.1; 3.13.0 through 3.13.4; 3.12.0 through 3.12.9; 3.11.0 through 3.11.15 |
| CVE-2024-7711 | 4.3 | Aug 20 | An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server, allowing an attacker to update the title, assignees, and labels of any issue inside a public… Affected: 3.11.0 through 3.11.13; 3.12.0 through 3.12.7; 3.13.0 through 3.13.2 |
| CVE-2022-46257 | 4.3 | Mar 7 | Information disclosure in GitHub Enterprise Server leading to unauthorized viewing of private repository names Affected: 3.3 before 3.3.17; 3.4 before 3.4.12; 3.5 before 3.5.9; 3.6 before 3.6.5 |
| CVE-2024-8263 | 2.7 | Sep 23 | An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped PAT through the use of nested tags Affected: 3.14 through 3.14.0; 3.13.0 through 3.13.3; 3.12.0 through 3.12.8; 3.11.0 through 3.11.14; 3.10.0 through 3.10.16 |
Showing 24