Page 6 of 41 results (0.015 seconds)

CVSS: 5.8EPSS: 0%CPEs: 4EXPL: 0

CVE-2023-6803 – Race Condition allows Unauthorized Outside Collaborator

https://notcve.org/view.php?id=CVE-2023-6803

A race condition in GitHub Enterprise Server allows an outside collaborator to be added while a repository is being transferred. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1. Una condición de ejecución en GitHub Enterprise Server permite agregar un colaborador externo mientras se transfiere un repositorio. Esta vulnerabilidad afectó a todas las versiones de GitHub Enterprise Server desde la 3.8 y se solucionó en las versiones 3.8.12, 3.9.7, 3.10.4 y 3.11.1. • https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1 https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12 https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •

CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0

CVE-2023-6802 – Sensitive Information in Log File in GitHub Enterprise Server

https://notcve.org/view.php?id=CVE-2023-6802

An insertion of sensitive information into the log file in the audit log in GitHub Enterprise Server was identified that could allow an attacker to gain access to the management console. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server appliance, a backup archive created with GitHub Enterprise Server Backup Utilities, or a service which received streamed logs. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1. Se identificó una inserción de información confidencial en el archivo de registro del registro de auditoría en GitHub Enterprise Server que podría permitir que un atacante obtenga acceso a la consola de administración. Para explotar esto, un atacante necesitaría acceso a los archivos de registro del dispositivo GitHub Enterprise Server, un archivo de respaldo creado con GitHub Enterprise Server Backup Utilities o un servicio que recibiera registros transmitidos. • https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1 https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12 https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7 • CWE-532: Insertion of Sensitive Information into Log File •

CVSS: 8.1EPSS: 0%CPEs: 5EXPL: 0

CVE-2023-6746 – Sensitive Information in Log File in GitHub Enterprise Server

https://notcve.org/view.php?id=CVE-2023-6746

An insertion of sensitive information into log file vulnerability was identified in the log files for a GitHub Enterprise Server back-end service that could permit an `adversary in the middle attack` when combined with other phishing techniques. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server appliance, a backup archive created with GitHub Enterprise Server Backup Utilities, or a service which received streamed logs. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1. Se identificó una vulnerabilidad de inserción de información confidencial en el archivo de registro en los archivos de registro de un servicio back-end de GitHub Enterprise Server que podría permitir un ataque de "adversary in the middle" cuando se combina con otras técnicas de phishing. Para explotar esto, un atacante necesitaría acceso a los archivos de registro del dispositivo GitHub Enterprise Server, un archivo de respaldo creado con GitHub Enterprise Server Backup Utilities o un servicio que recibiera registros transmitidos. • https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1 https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.19 https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12 https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7 • CWE-532: Insertion of Sensitive Information into Log File •

CVSS: 3.9EPSS: 0%CPEs: 4EXPL: 0

CVE-2023-6690

https://notcve.org/view.php?id=CVE-2023-6690

A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on transferred repositories by making a GraphQL mutation to alter repository permissions during the transfer. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1. Una condición de ejecución en GitHub Enterprise Server permitió a un administrador existente mantener los permisos en los repositorios transferidos al realizar una mutación GraphQL para alterar los permisos del repositorio durante la transferencia. Esta vulnerabilidad afectó a GitHub Enterprise Server versión 3.8.0 y superiores y se solucionó en las versiones 3.8.12, 3.9.7, 3.10.4 y 3.11.1. • https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1 https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12 https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •

CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0

CVE-2023-46646

https://notcve.org/view.php?id=CVE-2023-46646

Improper access control in all versions of GitHub Enterprise Server allows unauthorized users to view private repository names via the "Get a check run" API endpoint. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected GitHub Enterprise Server version 3.7.0 and above and was fixed in version 3.17.19, 3.8.12, 3.9.7 3.10.4, and 3.11.0. El control de acceso inadecuado en todas las versiones de GitHub Enterprise Server permite a usuarios no autorizados ver nombres de repositorios privados a través del endpoint API "Get a check run". Esta vulnerabilidad no permitía el acceso no autorizado a ningún contenido del repositorio además del nombre. • https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.19 https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12 https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7 • CWE-639: Authorization Bypass Through User-Controlled Key •