GitHub Enterprise Server

• CVE-2024-10007 High 8.7 Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation 0.8%
• CVE-2024-9487 Critical 9.5 An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed when the encrypted assertions feature was enabled 25.6%
• CVE-2024-4985 Critical 10.0 An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication with the optional encrypted assertions feature. This vulnera 2.6%
• CVE-2024-2440 Medium 5.5 Race Condition was identified in GitHub Enterprise Server that allowed maintaining admin permissions 0.5%
• CVE-2024-3684 High 8.0 Improper Privilege Management was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console 1.1%
• CVE-2024-3646 High 8.0 Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console 1.7%
• CVE-2024-3470 Medium 5.9 Repository administrator can bypass organization's ruleset using deploy keys 0.6%
• CVE-2024-2748 Medium 4.3 CSRF vulnerability was identified in GitHub Enterprise Server that allowed performing actions on behalf of a user 0.2%
• CVE-2024-2469 High 8.0 Remote Code Execution in GitHub Enterprise Server Allowed Administrators to gain SSH access to the appliance 1.6%
• CVE-2024-1908 Medium 6.3 Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed Privilege Escalation 0.6%
• CVE-2024-1482 High 7.1 Improper Authorization in GitHub Enterprise Server allowed unauthorized workflow execution 0.4%
• CVE-2024-1378 Critical 9.1 Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console 2.3%
• CVE-2024-1374 Critical 9.1 Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console 2.6%
• CVE-2024-1372 Critical 9.1 Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console 2.3%
• CVE-2024-1369 Critical 9.1 Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console 2.3%
• CVE-2024-1359 Critical 9.1 Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console 2.3%
• CVE-2024-1355 Critical 9.1 Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console 2.4%
• CVE-2024-1354 High 8.0 Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console 1.7%
• CVE-2024-1082 Medium 6.3 Path traversal vulnerability in GitHub Enterprise Server that allowed arbitrary file read with a specially crafted GitHub Pages artifact upload 0.8%
• CVE-2024-1084 Medium 6.5 Cross-site Scripting in the tag name pattern field in the tag protections UI in GitHub Enterprise Server allows a malicious website that requires user interaction and social engineering to make change 0.5%
• CVE-2024-0507 Medium 6.5 Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise Server 65.8%
• CVE-2024-0200 High 7.2 Unsafe Reflection in Github Enterprise Server leading to Command Injection 71.7%
• CVE-2023-6847 High 7.5 Improper Authentication in GitHub Enterprise Server leading to Authentication Bypass for Public Repository Data 0.8%
• CVE-2023-51380 Low 2.7 Incorrect Authorization allows Read Access to Issue Comments in GitHub Enterprise Server 0.5%
• CVE-2023-51379 Medium 4.9 Incorrect Authorization for Issue Comments in GitHub Enterprise Server 0.6%
• CVE-2023-46648 High 8.3 Insufficient Entropy in GitHub Enterprise Server Management Console Invitation Token 0.7%
• CVE-2023-46649 Medium 6.3 Race Condition allows Administrative Access on Organization Repositories 0.2%
• CVE-2023-6804 Medium 6.5 Improper Privilege Management allows for arbitrary workflows to be run 0.2%
• CVE-2023-6803 Medium 5.8 Race Condition allows Unauthorized Outside Collaborator 0.2%
• CVE-2023-6802 High 7.2 Sensitive Information in Log File in GitHub Enterprise Server 0.7%
• CVE-2023-6746 High 8.1 Sensitive Information in Log File in GitHub Enterprise Server 0.5%
• CVE-2023-46645 Medium 6.8 Path traversal in GitHub Enterprise Server leading to arbitrary file reading when building a GitHub Pages site 0.8%
• CVE-2023-6690 Low 3.9 A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on transferred repositories by making a GraphQL mutation to alter repository permissions during the trans 0.3%
• CVE-2023-46647 High 8.0 Improper Privilege Management in GitHub Enterprise Server management console leads to privilege escalation 0.6%
• CVE-2023-46646 Medium 5.3 Improper access control in all versions of GitHub Enterprise Server allows unauthorized users to view private repository names via the "Get a check run" API endpoint. This vulnerability did not allow 0.5%
• CVE-2023-23766 Medium 4.5 Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling 0.7%
• CVE-2023-23763 Medium 5.3 Information disclosure in GitHub Enterprise Server leading to private repository leakage 0.7%
• CVE-2023-23765 Medium 4.8 Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling 0.6%
• CVE-2023-23764 Medium 4.8 Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling 0.6%
• CVE-2023-23762 Medium 6.5 Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling 0.6%
• CVE-2023-23761 High 7.7 Improper authentication vulnerability in GitHub Enterprise Server leading to modification of secret gists 0.5%
• CVE-2023-23760 Medium 4.9 Path traversal in GitHub Enterprise Server leading to remote code execution 1.0%
• CVE-2023-22381 Medium 4.1 Code injection in GitHub Enterprise Server leading to arbitrary environment variables in GitHub Actions 0.8%