# GitHub Enterprise Server. Every CVE that names GitHub Enterprise Server among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first (an older page) - [GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Deploy Keys](https://agentprime.io/advisories/CVE-2024-6395.md) `CVE-2024-6395` · CVE record: GitHub GitHub Enterprise Server · CVSS 6.3 Medium · Not analysed yet · Published 16 Jul 2024 · Tags: Information disclosure - [Security misconfiguration was identified in GitHub Enterprise Server that allowed sensitive data exposure](https://agentprime.io/advisories/CVE-2024-6336.md) `CVE-2024-6336` · CVE record: GitHub GitHub Enterprise Server · CVSS 6.9 Medium · Not analysed yet · Published 16 Jul 2024 · Tags: Information disclosure - [Improper authorization allows read access to issue content in GitHub Enterprise Server](https://agentprime.io/advisories/CVE-2024-5817.md) `CVE-2024-5817` · CVE record: GitHub GitHub Enterprise Server · CVSS 5.9 Medium · Not analysed yet · Published 16 Jul 2024 · Tags: Broken access control - [Improper authorization allows persistent access in GitHub Enterprise Server](https://agentprime.io/advisories/CVE-2024-5816.md) `CVE-2024-5816` · CVE record: GitHub GitHub Enterprise Server · CVSS 6.9 Medium · Not analysed yet · Published 16 Jul 2024 · Tags: Broken access control - [Cross Site Request Forgery was identified in GitHub Enterprise Server that allowed write in a user owned repository](https://agentprime.io/advisories/CVE-2024-5815.md) `CVE-2024-5815` · CVE record: GitHub GitHub Enterprise Server · CVSS 6.8 Medium · Not analysed yet · Published 16 Jul 2024 · Tags: Cross-site request forgery (CSRF) - [Denial of Service vulnerability was identified in GitHub Enterprise Server that allowed resource exhaustion](https://agentprime.io/advisories/CVE-2024-5795.md) `CVE-2024-5795` · CVE record: GitHub GitHub Enterprise Server · CVSS 7.7 High · Not analysed yet · Published 16 Jul 2024 · Tags: Denial of service - [Improper Privilege Management allows for access to unauthorized repository content during migration](https://agentprime.io/advisories/CVE-2024-5566.md) `CVE-2024-5566` · CVE record: GitHub GitHub Enterprise Server · CVSS 5.8 Medium · Not analysed yet · Published 16 Jul 2024 · Tags: Privilege escalation - [Server-side request forgery in GitHub Enterprise Server](https://agentprime.io/advisories/CVE-2024-5746.md) `CVE-2024-5746` · CVE record: GitHub GitHub Enterprise Server · CVSS 7.6 High · Not analysed yet · Published 20 Jun 2024 · Tags: Server-side request forgery (SSRF) - [GitHub Enterprise Server: An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES)…](https://agentprime.io/advisories/CVE-2024-4985.md) `CVE-2024-4985` · CVE record: GitHub Enterprise Server · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 May 2024 · Tags: Authentication bypass - [Race Condition was identified in GitHub Enterprise Server that allowed maintaining admin permissions](https://agentprime.io/advisories/CVE-2024-2440.md) `CVE-2024-2440` · CVE record: GitHub Enterprise Server · CVSS 5.5 Medium · Not analysed yet · Published 19 Apr 2024 · Tags: Race condition - [Improper Privilege Management was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console](https://agentprime.io/advisories/CVE-2024-3684.md) `CVE-2024-3684` · CVE record: GitHub Enterprise Server · CVSS 8.0 High · Not analysed yet · Published 19 Apr 2024 · Tags: Command injection - [Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console](https://agentprime.io/advisories/CVE-2024-3646.md) `CVE-2024-3646` · CVE record: GitHub Enterprise Server · CVSS 8.0 High · Not analysed yet · Published 19 Apr 2024 · Tags: CWE-20 - [Repository administrator can bypass organization's ruleset using deploy keys](https://agentprime.io/advisories/CVE-2024-3470.md) `CVE-2024-3470` · CVE record: GitHub Enterprise Server · CVSS 5.9 Medium · Not analysed yet · Published 19 Apr 2024 · Tags: Privilege escalation - [CSRF vulnerability was identified in GitHub Enterprise Server that allowed performing actions on behalf of a user](https://agentprime.io/advisories/CVE-2024-2748.md) `CVE-2024-2748` · CVE record: GitHub Enterprise Server · CVSS 4.3 Medium · Not analysed yet · Published 20 Mar 2024 · Tags: Cross-site request forgery (CSRF) - [Improper input validation vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console](https://agentprime.io/advisories/CVE-2024-2443.md) `CVE-2024-2443` · CVE record: GitHub GitHub Enterprise Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Mar 2024 · Tags: CWE-20 - [Remote Code Execution in GitHub Enterprise Server Allowed Administrators to gain SSH access to the appliance](https://agentprime.io/advisories/CVE-2024-2469.md) `CVE-2024-2469` · CVE record: GitHub Enterprise Server · CVSS 8.0 High · Not analysed yet · Published 20 Mar 2024 · Tags: CWE-20 - [Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed Privilege Escalation](https://agentprime.io/advisories/CVE-2024-1908.md) `CVE-2024-1908` · CVE record: GitHub Enterprise Server · CVSS 6.3 Medium · Not analysed yet · Published 29 Feb 2024 · Tags: Privilege escalation - [Improper Authorization in GitHub Enterprise Server allowed unauthorized workflow execution](https://agentprime.io/advisories/CVE-2024-1482.md) `CVE-2024-1482` · CVE record: GitHub Enterprise Server · CVSS 7.1 High · Not analysed yet · Published 14 Feb 2024 · Tags: Broken access control - [Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console](https://agentprime.io/advisories/CVE-2024-1378.md) `CVE-2024-1378` · CVE record: GitHub Enterprise Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Feb 2024 · Tags: CWE-20 - [Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console](https://agentprime.io/advisories/CVE-2024-1374.md) `CVE-2024-1374` · CVE record: GitHub Enterprise Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Feb 2024 · Tags: CWE-20 - [Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console](https://agentprime.io/advisories/CVE-2024-1372.md) `CVE-2024-1372` · CVE record: GitHub Enterprise Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Feb 2024 · Tags: CWE-20 - [Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console](https://agentprime.io/advisories/CVE-2024-1369.md) `CVE-2024-1369` · CVE record: GitHub Enterprise Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Feb 2024 · Tags: CWE-20 - [Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console](https://agentprime.io/advisories/CVE-2024-1359.md) `CVE-2024-1359` · CVE record: GitHub Enterprise Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Feb 2024 · Tags: CWE-20 - [Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console](https://agentprime.io/advisories/CVE-2024-1355.md) `CVE-2024-1355` · CVE record: GitHub Enterprise Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Feb 2024 · Tags: Command injection, CWE-20 - [Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console](https://agentprime.io/advisories/CVE-2024-1354.md) `CVE-2024-1354` · CVE record: GitHub Enterprise Server · CVSS 8.0 High · Not analysed yet · Published 13 Feb 2024 · Tags: CWE-20 - [Path traversal vulnerability in GitHub Enterprise Server that allowed arbitrary file read with a specially crafted GitHub Pages artifact upload](https://agentprime.io/advisories/CVE-2024-1082.md) `CVE-2024-1082` · CVE record: GitHub Enterprise Server · CVSS 6.3 Medium · Not analysed yet · Published 13 Feb 2024 · Tags: Path traversal - [Cross-site scripting in GitHub Enterprise Server](https://agentprime.io/advisories/CVE-2024-1084.md) `CVE-2024-1084` · CVE record: GitHub Enterprise Server · CVSS 6.5 Medium · Not analysed yet · Published 13 Feb 2024 · Tags: Cross-site scripting (XSS) - [Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise Server](https://agentprime.io/advisories/CVE-2024-0507.md) `CVE-2024-0507` · CVE record: GitHub Enterprise Server · CVSS 6.5 Medium · EPSS 0.66 · Not analysed yet · Published 16 Jan 2024 · Tags: CWE-20 - [Unsafe Reflection in Github Enterprise Server leading to Command Injection](https://agentprime.io/advisories/CVE-2024-0200.md) `CVE-2024-0200` · CVE record: GitHub Enterprise Server · CVSS 7.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.72 · Not analysed yet · Published 16 Jan 2024 · Tags: Code injection - [Improper Authentication in GitHub Enterprise Server leading to Authentication Bypass for Public Repository Data](https://agentprime.io/advisories/CVE-2023-6847.md) `CVE-2023-6847` · CVE record: GitHub Enterprise Server · CVSS 7.5 High · Not analysed yet · Published 21 Dec 2023 · Tags: Authentication bypass - [Incorrect Authorization allows Read Access to Issue Comments in GitHub Enterprise Server](https://agentprime.io/advisories/CVE-2023-51380.md) `CVE-2023-51380` · CVE record: GitHub Enterprise Server · CVSS 2.7 Low · Not analysed yet · Published 21 Dec 2023 · Tags: Broken access control - [Incorrect Authorization for Issue Comments in GitHub Enterprise Server](https://agentprime.io/advisories/CVE-2023-51379.md) `CVE-2023-51379` · CVE record: GitHub Enterprise Server · CVSS 4.9 Medium · Not analysed yet · Published 21 Dec 2023 · Tags: Broken access control - [Insufficient Entropy in GitHub Enterprise Server Management Console Invitation Token](https://agentprime.io/advisories/CVE-2023-46648.md) `CVE-2023-46648` · CVE record: GitHub Enterprise Server · CVSS 8.3 High · Not analysed yet · Published 21 Dec 2023 · Tags: CWE-331 - [Race Condition allows Administrative Access on Organization Repositories](https://agentprime.io/advisories/CVE-2023-46649.md) `CVE-2023-46649` · CVE record: GitHub Enterprise Server · CVSS 6.3 Medium · Not analysed yet · Published 21 Dec 2023 · Tags: Race condition - [Improper Privilege Management allows for arbitrary workflows to be run](https://agentprime.io/advisories/CVE-2023-6804.md) `CVE-2023-6804` · CVE record: GitHub Enterprise Server · CVSS 6.5 Medium · Not analysed yet · Published 21 Dec 2023 · Tags: Privilege escalation - [Race Condition allows Unauthorized Outside Collaborator](https://agentprime.io/advisories/CVE-2023-6803.md) `CVE-2023-6803` · CVE record: GitHub Enterprise Server · CVSS 5.8 Medium · Not analysed yet · Published 21 Dec 2023 · Tags: Race condition - [Sensitive Information in Log File in GitHub Enterprise Server](https://agentprime.io/advisories/CVE-2023-6802.md) `CVE-2023-6802` · CVE record: GitHub Enterprise Server · CVSS 7.2 High · Not analysed yet · Published 21 Dec 2023 · Tags: Information disclosure - [Sensitive Information in Log File in GitHub Enterprise Server](https://agentprime.io/advisories/CVE-2023-6746.md) `CVE-2023-6746` · CVE record: GitHub Enterprise Server · CVSS 8.1 High · Not analysed yet · Published 21 Dec 2023 · Tags: Information disclosure - [Path traversal in GitHub Enterprise Server leading to arbitrary file reading when building a GitHub Pages site](https://agentprime.io/advisories/CVE-2023-46645.md) `CVE-2023-46645` · CVE record: GitHub Enterprise Server · CVSS 6.8 Medium · Not analysed yet · Published 21 Dec 2023 · Tags: Path traversal - [Time-of-check time-of-use race condition in GitHub Enterprise Server](https://agentprime.io/advisories/CVE-2023-6690.md) `CVE-2023-6690` · CVE record: GitHub Enterprise Server · CVSS 3.9 Low · Not analysed yet · Published 21 Dec 2023 · Tags: Race condition - [Improper Privilege Management in GitHub Enterprise Server management console leads to privilege escalation](https://agentprime.io/advisories/CVE-2023-46647.md) `CVE-2023-46647` · CVE record: GitHub Enterprise Server · CVSS 8.0 High · Not analysed yet · Published 21 Dec 2023 · Tags: Privilege escalation - [Insecure direct object reference in GitHub Enterprise Server](https://agentprime.io/advisories/CVE-2023-46646.md) `CVE-2023-46646` · CVE record: GitHub Enterprise Server · CVSS 5.3 Medium · Not analysed yet · Published 21 Dec 2023 · Tags: Broken access control - [Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling](https://agentprime.io/advisories/CVE-2023-23766.md) `CVE-2023-23766` · CVE record: GitHub Enterprise Server · CVSS 4.5 Medium · Not analysed yet · Published 22 Sept 2023 · Tags: CWE-697 - [Information disclosure in GitHub Enterprise Server leading to private repository leakage](https://agentprime.io/advisories/CVE-2023-23763.md) `CVE-2023-23763` · CVE record: GitHub Enterprise Server · CVSS 5.3 Medium · Not analysed yet · Published 1 Sept 2023 · Tags: Information disclosure - [Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling](https://agentprime.io/advisories/CVE-2023-23765.md) `CVE-2023-23765` · CVE record: GitHub Enterprise Server · CVSS 4.8 Medium · Not analysed yet · Published 30 Aug 2023 · Tags: CWE-697 - [Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling](https://agentprime.io/advisories/CVE-2023-23764.md) `CVE-2023-23764` · CVE record: GitHub Enterprise Server · CVSS 4.8 Medium · Not analysed yet · Published 27 Jul 2023 · Tags: CWE-697 - [Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling](https://agentprime.io/advisories/CVE-2023-23762.md) `CVE-2023-23762` · CVE record: GitHub Enterprise Server · CVSS 6.5 Medium · Not analysed yet · Published 7 Apr 2023 · Tags: CWE-697 - [Improper authentication vulnerability in GitHub Enterprise Server leading to modification of secret gists](https://agentprime.io/advisories/CVE-2023-23761.md) `CVE-2023-23761` · CVE record: GitHub Enterprise Server · CVSS 7.7 High · Not analysed yet · Published 7 Apr 2023 · Tags: Authentication bypass - [Path traversal in GitHub Enterprise Server leading to remote code execution](https://agentprime.io/advisories/CVE-2023-23760.md) `CVE-2023-23760` · CVE record: GitHub Enterprise Server · CVSS 4.9 Medium · Not analysed yet · Published 8 Mar 2023 · Tags: Path traversal - [Information disclosure in GitHub Enterprise Server leading to unauthorized viewing of private repository names](https://agentprime.io/advisories/CVE-2022-46257.md) `CVE-2022-46257` · CVE record: GitHub GitHub Enterprise Server · No CVSS score · Not analysed yet · Published 7 Mar 2023 · Tags: Information disclosure - [Code injection in GitHub Enterprise Server leading to arbitrary environment variables in GitHub Actions](https://agentprime.io/advisories/CVE-2023-22381.md) `CVE-2023-22381` · CVE record: GitHub Enterprise Server · CVSS 4.1 Medium · Not analysed yet · Published 2 Mar 2023 · Tags: Code injection - [Path traversal in GitHub Enterprise Server leading to arbitrary file reading when building a GitHub Pages site](https://agentprime.io/advisories/CVE-2023-22380.md) `CVE-2023-22380` · CVE record: GitHub GitHub Enterprise Server · CVSS 6.5 Medium · Not analysed yet · Published 16 Feb 2023 · Tags: Path traversal - [Incorrect authorization check in GitHub Enterprise Server leading to escalation of privileges in GraphQL API requests from GitHub Apps using scoped user-to-server tokens](https://agentprime.io/advisories/CVE-2022-23739.md) `CVE-2022-23739` · CVE record: GitHub GitHub Enterprise Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jan 2023 · Tags: Broken access control - [Incorrect Authorization in GitHub Enterprise Server leads to Action Workflow modifications without Workflow Scope](https://agentprime.io/advisories/CVE-2022-46258.md) `CVE-2022-46258` · CVE record: GitHub GitHub Enterprise Server · CVSS 6.5 Medium · Not analysed yet · Published 9 Jan 2023 · Tags: Broken access control - [Path traversal in GitHub Enterprise Server leading to remote code execution in GitHub Pages](https://agentprime.io/advisories/CVE-2022-46256.md) `CVE-2022-46256` · CVE record: GitHub GitHub Enterprise Server · CVSS 8.8 High · Not analysed yet · Published 14 Dec 2022 · Tags: Path traversal - [Improper Limitation of a Pathname to a Restricted Directory in GitHub Enterprise Server leading to RCE](https://agentprime.io/advisories/CVE-2022-46255.md) `CVE-2022-46255` · CVE record: GitHub GitHub Enterprise Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Dec 2022 · Tags: Path traversal - [Incorrect authorization in GitHub Enterprise Server token generation leading to full admin access](https://agentprime.io/advisories/CVE-2022-23741.md) `CVE-2022-23741` · CVE record: GitHub GitHub Enterprise Server · CVSS 7.2 High · Not analysed yet · Published 14 Dec 2022 · Tags: Broken access control - [Improper Privilege Management in GitHub Enterprise Server leading to page creation and deletion](https://agentprime.io/advisories/CVE-2022-23737.md) `CVE-2022-23737` · CVE record: GitHub GitHub Enterprise Server · CVSS 6.5 Medium · Not analysed yet · Published 1 Dec 2022 · Tags: Privilege escalation - [Improper Neutralization of Argument Delimiters in a Command in GitHub Enterprise Server leading to Remote Code Execution](https://agentprime.io/advisories/CVE-2022-23740.md) `CVE-2022-23740` · CVE record: GitHub GitHub Enterprise Server · CVSS 8.8 High · Not analysed yet · Published 23 Nov 2022 · Tags: Command injection - [Incomplete cache verification issue in GitHub Enterprise Server leading to exposure of private repo files](https://agentprime.io/advisories/CVE-2022-23738.md) `CVE-2022-23738` · CVE record: GitHub GitHub Enterprise Server · CVSS 5.7 Medium · Not analysed yet · Published 1 Nov 2022 · Tags: Information disclosure Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .