Github Enterprise Server (Github) - vulnerabilities (CVEs)

46 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2025-07-01. Vendor: Github.

CVEs of Github Enterprise Server

CVE-2025-6600 - CVSS 6.3 (medium), 2025-07-01: An exposure of sensitive information vulnerability was identified in GitHub Enterprise Server that could allow an attacker to disclose the names of private…
CVE-2025-3246 - CVSS 8.6 (high), 2025-04-17: An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting in GitHub Markdown that used…
CVE-2024-9539 - CVSS 5.7 (medium), 2024-10-11: An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL allowing the attacker to retrieve metadata…
CVE-2024-8770 - CVSS 6.1 (medium), 2024-09-23: A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attackers to steal…
CVE-2024-8263 - CVSS 6.2 (medium), 2024-09-23: An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped PAT through the use of nested tags. This…
CVE-2024-7711 - CVSS 5.3 (medium), 2024-08-20: An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server, allowing an attacker to update the title, assignees, and labels of any…
CVE-2024-6800 - CVSS 9.8 (critical), 2024-08-20: An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers…
CVE-2024-6337 - CVSS 6.5 (medium), 2024-08-20: An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a GitHub App with only content: read and pull_request_write:…
CVE-2024-6395 - CVSS 6.3 (medium), 2024-07-16: An exposure of sensitive information vulnerability in GitHub Enterprise Server would allow an attacker to enumerate the names of private repositories that…
CVE-2024-5815 - CVSS 6.8 (medium), 2024-07-16: A Cross-Site Request Forgery vulnerability in GitHub Enterprise Server allowed write operations on a victim-owned repository by exploiting incorrect request…
CVE-2024-6336 - CVSS 6.9 (medium), 2024-07-16: A Security Misconfiguration vulnerability in GitHub Enterprise Server allowed sensitive information disclosure to unauthorized users in GitHub Enterprise…
CVE-2024-5795 - CVSS 7.7 (high), 2024-07-16: A Denial of Service vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause unbounded resource exhaustion by sending a…
CVE-2024-5817 - CVSS 6.5 (medium), 2024-07-16: An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed read access to issue content via GitHub Projects. This was…
CVE-2024-5816 - CVSS 6.9 (medium), 2024-07-16: An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a suspended GitHub App to retain access to the repository via…
CVE-2024-5566 - CVSS 6.5 (medium), 2024-07-16: An improper privilege management vulnerability allowed users to migrate private repositories without having appropriate scopes defined on the related Personal…
CVE-2024-5746 - CVSS 7.6 (high), 2024-06-20: A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain…
CVE-2024-2443 - CVSS 9.1 (critical), 2024-03-20: A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain…
CVE-2022-46257 - CVSS 4.3 (medium), 2023-03-07: An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub Actions runner…
CVE-2023-22380 - CVSS 6.5 (medium), 2023-02-16: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit…
CVE-2022-23739 - CVSS 9.8 (critical), 2023-01-17: An incorrect authorization vulnerability was identified in GitHub Enterprise Server, allowing for escalation of privileges in GraphQL API requests from GitHub…
CVE-2022-46258 - CVSS 6.5 (medium), 2023-01-09: An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository-scoped token with read/write access to modify…
CVE-2022-23741 - CVSS 7.2 (high), 2022-12-14: An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner…
CVE-2022-46256 - CVSS 8.8 (high), 2022-12-14: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit…
CVE-2022-46255 - CVSS 9.8 (critical), 2022-12-14: An improper limitation of a pathname to a restricted directory vulnerability was identified in GitHub Enterprise Server that enabled remote code execution. A…
CVE-2022-23737 - CVSS 6.5 (medium), 2022-12-01: An improper privilege management vulnerability was identified in GitHub Enterprise Server that allowed users with improper privileges to create or delete…
CVE-2022-23740 - CVSS 8.8 (high), 2022-11-23: CRITICAL: An improper neutralization of argument delimiters in a command vulnerability was identified in GitHub Enterprise Server that enabled remote code…
CVE-2022-23738 - CVSS 5.7 (medium), 2022-11-01: An improper cache key vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to access private repository files through a…
CVE-2022-23734 - CVSS 8.8 (high), 2022-10-19: A deserialization of untrusted data vulnerability was identified in GitHub Enterprise Server that could potentially lead to remote code execution on the…
CVE-2022-23733 - CVSS 5.4 (medium), 2022-08-02: A stored XSS vulnerability was identified in GitHub Enterprise Server that allowed the injection of arbitrary attributes. This injection was blocked by…
CVE-2022-23732 - CVSS 8.8 (high), 2022-04-05: A path traversal vulnerability was identified in GitHub Enterprise Server management console that allowed the bypass of CSRF protections. This could…
CVE-2021-41599 - CVSS 8.8 (high), 2022-02-18: A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. To exploit this…
CVE-2021-41598 - CVSS 8.8 (high), 2022-01-25: A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's…
CVE-2021-22870 - CVSS 6.5 (medium), 2021-11-10: A path traversal vulnerability was identified in GitHub Pages builds on GitHub Enterprise Server that could allow an attacker to read system files. To exploit…
CVE-2021-22869 - CVSS 9.8 (critical), 2021-09-24: An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted runner group it should not have had…
CVE-2021-22868 - CVSS 4.3 (medium), 2021-09-24: A path traversal vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled…
CVE-2021-22867 - CVSS 6.5 (medium), 2021-07-14: A path traversal vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled…
CVE-2021-22866 - CVSS 8.8 (high), 2021-05-14: A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's…
CVE-2021-22865 - CVSS 6.5 (medium), 2021-04-02: An improper access control vulnerability was identified in GitHub Enterprise Server that allowed access tokens generated from a GitHub App's web…
CVE-2021-22864 - CVSS 8.8 (high), 2021-03-23: A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled…
CVE-2021-22861 - CVSS 6.5 (medium), 2021-03-03: An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to…
CVE-2021-22863 - CVSS 8.1 (high), 2021-03-03: An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify…
CVE-2021-22862 - CVSS 6.5 (medium), 2021-03-03: An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository…
CVE-2020-10519 - CVSS 8.8 (high), 2021-03-03: A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled…
CVE-2020-10517 - CVSS 4.3 (medium), 2020-08-27: An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to determine the names of…
CVE-2020-10518 - CVSS 8.8 (high), 2020-08-27: A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled…
CVE-2020-10516 - CVSS 9.8 (critical), 2020-06-03: An improper access control vulnerability was identified in the GitHub Enterprise Server API that allowed an organization member to escalate permissions and…