Github
Page 2 of 2 — Github CVEs from a corpus of 145, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-51380 | Low | 2.7 | 2023-12-21 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be read with an improperly scoped token. Thi… |
CVE-2023-51379 | Medium | 4.9 | 2023-12-21 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be updated with an improperly scoped token… |
CVE-2023-46649 | Medium | 6.3 | 2023-12-21 | A race condition in GitHub Enterprise Server was identified that could allow an attacker administrator access. To exploit this, an organization needs to be con… |
CVE-2023-46648 | High | 8.3 | 2023-12-21 | An insufficient entropy vulnerability was identified in GitHub Enterprise Server (GHES) that allowed an attacker to brute force a user invitation to the GHES M… |
CVE-2023-46647 | High | 8.0 | 2023-12-21 | Improper privilege management in all versions of GitHub Enterprise Server allows users with authorized access to the management console with an editor role to… |
CVE-2023-46646 | Medium | 5.3 | 2023-12-21 | Improper access control in all versions of GitHub Enterprise Server allows unauthorized users to view private repository names via the "Get a check run" API en… |
CVE-2023-46645 | Medium | 6.8 | 2023-12-21 | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit thi… |
CVE-2023-23766 | Medium | 4.5 | 2023-09-22 | An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff in a re-opened P… |
CVE-2023-23763 | Medium | 5.3 | 2023-09-01 | An authorization/sensitive information disclosure vulnerability was identified in GitHub Enterprise Server that allowed a fork to retain read access to an upst… |
CVE-2023-23765 | Medium | 4.8 | 2023-08-30 | An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff in a re-opened P… |
CVE-2023-23764 | Medium | 4.8 | 2023-07-27 | An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff within the GitHu… |
CVE-2023-37463 | Medium | 6.4 | 2023-07-13 | cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time… |
CVE-2023-36867 | High | 7.8 | 2023-07-11 | Visual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution Vulnerability |
CVE-2023-23762 | Medium | 6.5 | 2023-04-07 | An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff. To do so, an at… |
CVE-2023-23761 | High | 7.7 | 2023-04-07 | An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to modify other users' secret gists by a… |
CVE-2023-26485 | Medium | 5.3 | 2023-03-31 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to u… |
CVE-2023-24824 | Medium | 5.3 | 2023-03-31 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to u… |
CVE-2023-23760 | Medium | 4.9 | 2023-03-08 | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this… |
CVE-2022-46257 | Medium | 4.3 | 2023-03-07 | An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub Actions runner gro… |
CVE-2023-22381 | Medium | 4.1 | 2023-03-02 | A code injection vulnerability was identified in GitHub Enterprise Server that allowed setting arbitrary environment variables from a single environment variab… |
CVE-2023-22380 | Medium | 6.5 | 2023-02-16 | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit thi… |
CVE-2023-22486 | Low | 3.5 | 2023-01-26 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a polynomial time com… |
CVE-2023-22485 | Medium | 5.3 | 2023-01-24 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior 0.29.0.gfm.7, a crafted markdown document c… |
CVE-2023-22484 | Low | 3.5 | 2023-01-23 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial ti… |
CVE-2023-22483 | Low | 3.5 | 2023-01-23 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to several polynom… |
CVE-2022-23739 | Critical | 9.8 | 2023-01-17 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server, allowing for escalation of privileges in GraphQL API requests from GitHub… |
CVE-2022-46258 | Medium | 6.5 | 2023-01-09 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository-scoped token with read/write access to modify Act… |
CVE-2015-10031 | Medium | 5.5 | 2023-01-08 | A vulnerability classified as critical was found in purpleparrots 491-Project. This vulnerability affects unknown code of the file update.php of the component… |
CVE-2022-23741 | High | 7.2 | 2022-12-14 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner… |
CVE-2022-46256 | High | 8.8 | 2022-12-14 | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this… |
CVE-2022-46255 | Critical | 9.8 | 2022-12-14 | An improper limitation of a pathname to a restricted directory vulnerability was identified in GitHub Enterprise Server that enabled remote code execution. A c… |
CVE-2022-23737 | Medium | 6.5 | 2022-12-01 | An improper privilege management vulnerability was identified in GitHub Enterprise Server that allowed users with improper privileges to create or delete pages… |
CVE-2022-23740 | High | 8.8 | 2022-11-23 | CRITICAL: An improper neutralization of argument delimiters in a command vulnerability was identified in GitHub Enterprise Server that enabled remote code exec… |
CVE-2022-23738 | Medium | 5.7 | 2022-11-01 | An improper cache key vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to access private repository files through a… |
CVE-2022-39321 | High | 8.8 | 2022-10-25 | GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow. The actions runner invokes the docker cli directly in order to run job… |
CVE-2022-23734 | High | 8.8 | 2022-10-19 | A deserialization of untrusted data vulnerability was identified in GitHub Enterprise Server that could potentially lead to remote code execution on the SVNBri… |
CVE-2022-39209 | High | 7.5 | 2022-09-15 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexit… |
CVE-2022-35954 | Medium | 5.0 | 2022-08-15 | The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The `core.exportVariable` function uses a well known delimiter that atta… |
CVE-2022-23733 | Medium | 5.4 | 2022-08-02 | A stored XSS vulnerability was identified in GitHub Enterprise Server that allowed the injection of arbitrary attributes. This injection was blocked by Github'… |
CVE-2022-31026 | Medium | 5.9 | 2022-06-09 | Trilogy is a client library for MySQL. When authenticating, a malicious server could return a specially crafted authentication packet, causing the client to re… |
CVE-2022-23732 | High | 8.8 | 2022-04-05 | A path traversal vulnerability was identified in GitHub Enterprise Server management console that allowed the bypass of CSRF protections. This could potentiall… |
CVE-2022-24724 | High | 8.8 | 2022-03-03 | cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow i… |
CVE-2022-24722 | High | 8.1 | 2022-03-02 | VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability th… |
CVE-2021-41599 | High | 8.8 | 2022-02-18 | A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. To exploit this vul… |
CVE-2022-21687 | Medium | 6.8 | 2022-02-01 | gh-ost is a triggerless online schema migration solution for MySQL. Versions prior to 1.1.3 are subject to an arbitrary file read vulnerability. The attacker m… |
CVE-2021-41598 | High | 8.8 | 2022-01-25 | A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authoriz… |
CVE-2021-22870 | Medium | 6.5 | 2021-11-10 | A path traversal vulnerability was identified in GitHub Pages builds on GitHub Enterprise Server that could allow an attacker to read system files. To exploit… |
CVE-2021-22869 | Critical | 9.8 | 2021-09-24 | An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted runner group it should not have had acc… |
CVE-2021-22868 | Medium | 4.3 | 2021-09-24 | A path traversal vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configurat… |
CVE-2021-37700 | Medium | 6.5 | 2021-08-12 | @github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before ve… |
CVE-2021-22867 | Medium | 6.5 | 2021-07-14 | A path traversal vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configurat… |
CVE-2021-32638 | Medium | 4.4 | 2021-05-25 | Github's CodeQL action is provided to run CodeQL-based code scanning on non-GitHub CI/CD systems and requires a GitHub access token to connect to a GitHub repo… |
CVE-2021-22866 | High | 8.8 | 2021-05-14 | A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authoriz… |
CVE-2021-22865 | Medium | 6.5 | 2021-04-02 | An improper access control vulnerability was identified in GitHub Enterprise Server that allowed access tokens generated from a GitHub App's web authentication… |
CVE-2021-22864 | High | 8.8 | 2021-03-23 | A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled con… |
CVE-2021-22863 | High | 8.1 | 2021-03-03 | An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify… |
CVE-2021-22862 | Medium | 6.5 | 2021-03-03 | An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to… |
CVE-2021-22861 | Medium | 6.5 | 2021-03-03 | An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to un… |
CVE-2020-10519 | High | 8.8 | 2021-03-03 | A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled con… |
CVE-2020-10518 | High | 8.8 | 2020-08-27 | A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled con… |
CVE-2020-10517 | Medium | 4.3 | 2020-08-27 | An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to determine the names of… |
CVE-2020-5238 | Medium | 6.5 | 2020-07-01 | The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown tab… |
CVE-2020-10516 | Critical | 9.8 | 2020-06-03 | An improper access control vulnerability was identified in the GitHub Enterprise Server API that allowed an organization member to escalate permissions and gai… |
CVE-2019-16765 | High | 7.4 | 2019-11-25 | If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code… |
CVE-2017-18365 | Critical | 9.8 | 2019-03-28 | The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to execute arbitrary co… |
CVE-2014-0177 | | 2014-05-27 | The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file. | |
CVE-2012-5814 | | 2012-11-04 | Weberknecht, as used in GitHub Gaug.es and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or… | |
CVE-2012-2055 | High | 7.5 | 2012-04-05 | GitHub Enterprise before 20120304 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set… |