Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL

Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision

Missing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Copilot pull request diff summary endpoint

Authentication bypass vulnerability in GitHub Enterprise Server allowed creation of local user accounts bypassing the configured external identity provider

Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized merging of pull requests

Missing Authorization Check in GitHub Enterprise Server Allows Unauthorized Uploads to Repository Migration Exports

Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed GitHub Apps to grant themselves write access

Authorization Bypass Vulnerability was Identified in GitHub Enterprise Server that Allowed Unauthorized Internal Users to Access Secret Scanning Alert Data

Incorrect Authorization allows read access to issues in GitHub Enterprise Server

Improper authorization allows read access to issue content in GitHub Enterprise Server

Cross Site Request Forgery was identified in GitHub Enterprise Server that allowed write in a user owned repository

Denial of Service vulnerability was identified in GitHub Enterprise Server that allowed resource exhaustion

Improper Privilege Management allows for access to unauthorized repository content during migration

Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed Privilege Escalation

Improper Authorization in GitHub Enterprise Server allowed unauthorized workflow execution

Path traversal vulnerability in GitHub Enterprise Server that allowed arbitrary file read with a specially crafted GitHub Pages artifact upload

Sensitive Information in Log File in GitHub Enterprise Server

An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff in a re-opened Pull Request

An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff in a re-opened Pull Request

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site

An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository-scoped token with read/write access to modify Action Workflow files…

An improper privilege management vulnerability was identified in GitHub Enterprise Server that allowed users with improper privileges to create or delete pages via the API

A path traversal vulnerability was identified in GitHub Pages builds on GitHub Enterprise Server that could allow an attacker to read system files

A path traversal vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed access tokens generated from a GitHub App's web authentication flow to read…

Reflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theft

Insufficient HTML Sanitization Allows User-Controlled DOM Elements to Overwrite Server-Initialized Data Islands and Trigger Unintended Server-Side POST Requests

A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attackers to steal sensitive user…

Cross-site Scripting in the tag name pattern field in the tag protections UI in GitHub Enterprise Server allows a malicious website that requires user interaction and social…

Server-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL Endpoint

Race Condition was identified in GitHub Enterprise Server that allowed maintaining admin permissions

Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via deeply nested YAML in release notes configuration

Sensitive Information in Log File in GitHub Enterprise Server

Incomplete cache verification issue in GitHub Enterprise Server leading to exposure of private repo files

UI misrepresentation vulnerability in GitHub Enterprise Server allowed unauthorized organization runner management via undisclosed OAuth scope on consent screen

Improper Privilege Management allows for arbitrary workflows to be run

Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline

Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed arbitrary JavaScript execution via crafted Discussion titles in the Q&A category

Improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting via task list content and enabled arbitrary HTML injection

Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed rendering of malicious HTML

Stored XSS vulnerability in GitHub Enterprise Server leading to injection of arbitrary attributes

Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed reading private repository metadata via delegated bypass rule suites

GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Deploy Keys

Security misconfiguration was identified in GitHub Enterprise Server that allowed sensitive data exposure

Improper authorization allows persistent access in GitHub Enterprise Server

Improper access control in all versions of GitHub Enterprise Server allows unauthorized users to view private repository names via the "Get a check run" API endpoint

An authorization/sensitive information disclosure vulnerability was identified in GitHub Enterprise Server that allowed a fork to retain read access to an upstream repository…

An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff

An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to modify other users' secret gists by authenticating…

An incorrect authorization vulnerability in GitHub Enterprise Server allows issue creation in unrelated public repositories