CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2024-10001 – Code Injection Vulnerability in GitHub Enterprise Server Allows Arbitrary Code Execution via Message Handling
https://notcve.org/view.php?id=CVE-2024-10001
29 Jan 2025 — A Code Injection vulnerability was identified in GitHub Enterprise Server that allowed attackers to inject malicious code into the query selector via the identity property in the message handling function. This enabled the exfiltration of sensitive data by manipulating the DOM, including authentication tokens. To execute the attack, the victim must be logged into GitHub and interact with the attacker controlled malicious webpage containing the hidden iframe. This vulnerability occurs due to an improper sequ... • https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.17 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.6EPSS: 0%CPEs: 4EXPL: 2CVE-2025-23369 – Improper Verification of Cryptographic Signature in GitHub Enterprise Server Allows Signature Spoofing by Improper Validation
https://notcve.org/view.php?id=CVE-2025-23369
21 Jan 2025 — An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized internal users. Instances not utilizing SAML single sign-on or where the attacker is not already an existing user were not impacted. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12.14, 3.13.10, 3.14.7, 3.15.2, and 3.16.0. This vulnerability was reported via the GitHub Bug Bounty program. • https://github.com/hakivvi/CVE-2025-23369 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2023-51380 – Incorrect Authorization allows Read Access to Issue Comments in GitHub Enterprise Server
https://notcve.org/view.php?id=CVE-2023-51380
21 Dec 2023 — An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be read with an improperly scoped token. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1. Se identificó una vulnerabilidad de autorización incorrecta en GitHub Enterprise Server que permitía leer los comentarios del problema con un token con un alcance incorrecto. Esta vulnerabilidad afectó a todas... • https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 • CWE-863: Incorrect Authorization •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2023-51379 – Incorrect Authorization for Issue Comments in GitHub Enterprise Server
https://notcve.org/view.php?id=CVE-2023-51379
21 Dec 2023 — An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be updated with an improperly scoped token. This vulnerability did not allow unauthorized access to any repository content as it also required contents:write and issues:read permissions. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.17.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1. Se identificó una vulnerabilidad de autorización incorrecta en... • https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 • CWE-863: Incorrect Authorization •
CVSS: 8.1EPSS: 0%CPEs: 5EXPL: 0CVE-2023-6746 – Sensitive Information in Log File in GitHub Enterprise Server
https://notcve.org/view.php?id=CVE-2023-6746
21 Dec 2023 — An insertion of sensitive information into log file vulnerability was identified in the log files for a GitHub Enterprise Server back-end service that could permit an `adversary in the middle attack` when combined with other phishing techniques. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server appliance, a backup archive created with GitHub Enterprise Server Backup Utilities, or a service which received streamed logs. This vulnerability affected all versions o... • https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2023-46646
https://notcve.org/view.php?id=CVE-2023-46646
21 Dec 2023 — Improper access control in all versions of GitHub Enterprise Server allows unauthorized users to view private repository names via the "Get a check run" API endpoint. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected GitHub Enterprise Server version 3.7.0 and above and was fixed in version 3.17.19, 3.8.12, 3.9.7 3.10.4, and 3.11.0. El control de acceso inadecuado en todas las versiones de GitHub Enterprise Server permite a usuarios n... • https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 8.8EPSS: 0%CPEs: 46EXPL: 0CVE-2020-9523
https://notcve.org/view.php?id=CVE-2020-9523
17 Apr 2020 — Insufficiently protected credentials vulnerability on Micro Focus enterprise developer and enterprise server, affecting all version prior to 4.0 Patch Update 16, and version 5.0 Patch Update 6. The vulnerability could allow an attacker to transmit hashed credentials for the user account running the Micro Focus Directory Server (MFDS) to an arbitrary site, compromising that account's security. Una vulnerabilidad de credenciales insuficientemente protegidas en el desarrollador empresarial y el servidor empres... • https://softwaresupport.softwaregrp.com/doc/KM03634936 • CWE-522: Insufficiently Protected Credentials •
CVSS: 6.1EPSS: 0%CPEs: 68EXPL: 0CVE-2019-11651
https://notcve.org/view.php?id=CVE-2019-11651
02 Oct 2019 — Reflected XSS on Micro Focus Enterprise Developer and Enterprise Server, all versions prior to version 3.0 Patch Update 20, version 4.0 Patch Update 12, and version 5.0 Patch Update 2. The vulnerability could be exploited to redirect a user to a malicious page or forge certain types of web requests. Una vulnerabilidad de tipo XSS Reflejado en Micro Focus Enterprise Developer y Enterprise Server, todas las versiones anteriores a la versión 3.0 Patch Update 20, versión 4.0 Patch Update 12 y versión 5.0 Patch ... • https://softwaresupport.softwaregrp.com/doc/KM03532232 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 12EXPL: 0CVE-2018-12469
https://notcve.org/view.php?id=CVE-2018-12469
12 Oct 2018 — Incorrect handling of an invalid value for an HTTP request parameter by Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 Update 2 and earlier, 3.0 before Patch Update 12, and 4.0 before Patch Update 2 causes a null pointer dereference (CWE-476) and subsequent denial of service due to process termination. La gestión incorrecta de un valor inválido para un parámetro de petición HTTP por parte de Directory Server (también conocido como... • https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29624/enterprise-server-security-fix-october-2018 • CWE-476: NULL Pointer Dereference •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-1917
https://notcve.org/view.php?id=CVE-2016-1917
22 Apr 2016 — Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-1918. Vulnerabilidad de XSS en la Management Console en BlackBerry Enterprise Server (BES) 12 en versiones anteriores a 12.4.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipulada, una vulnerabilidad diferen... • http://www.blackberry.com/btsc/KB38118 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •