Server-Side Request Forgery in GitHub Enterprise Server allowed extraction of sensitive environment variables via timing side-channel attack

Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts

Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal services

Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypass

Remote code execution via git push option injection in GitHub Enterprise Server

Improper Verification of Cryptographic Signature in GitHub Enterprise Server Allows Signature Spoofing by Improper Validation

An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Management Console

Improper privilege management in all versions of GitHub Enterprise Server allows users with authorized access to the management console with an editor role to escalate their…

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site

A code injection vulnerability was identified in GitHub Enterprise Server that allowed setting arbitrary environment variables from a single environment variable value in GitHub…

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site

CRITICAL: An improper neutralization of argument delimiters in a command vulnerability was identified in GitHub Enterprise Server that enabled remote code execution

Deserialization of Untrusted Data vulnerability in GitHub Enterprise Server leading to Remote Code Execution

A path traversal vulnerability was identified in GitHub Enterprise Server management console that allowed the bypass of CSRF protections

A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site

A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authorization web flow than…

A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authorization web flow than…

A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site

Path traversal vulnerability in GitHub Enterprise Server allowed writing files to arbitrary repository paths, including GitHub Actions workflow files, via unchecked Dependabot dependency-file paths

Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint

Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console

Markdown math block sanitization bypass allows privilege escalation and unauthorized workflow triggers

Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution

Denial of service vulnerability in GitHub Enterprise Server allowed unauthenticated service disruption via deeply nested request parameters

Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpoint

An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed a bypass of Private Mode by using a specially crafted API request

An insufficient entropy vulnerability was identified in GitHub Enterprise Server (GHES) that allowed an attacker to brute force a user invitation to the GHES Management Console

Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token

Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation

Pre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege Escalation

A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain arbitrary code execution…

Improper Privilege Management was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console

Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console

Repository administrator can bypass organization's ruleset using deploy keys

Improper input validation vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console

Remote Code Execution in GitHub Enterprise Server Allowed Administrators to gain SSH access to the appliance

An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner privileges

Code Injection Vulnerability in GitHub Enterprise Server Allows Arbitrary Code Execution via Message Handling

An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff within the GitHub pull request UI

A race condition in GitHub Enterprise Server was identified that could allow an attacker administrator access