Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Microsoft GitHub Enterprise ausnutzen, um einen Cross-Site Scripting Angriff durchzuführe oder um vertrauliche Informationen offenzulegen.
Product
GitHub ist ein netzbasierter Dienst zur Versionsverwaltung für Software-Entwicklungsprojekte.
Vulnerabilities 2
-
High 7.4
Improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting via task list content and enabled arbitrary HTML injection
An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed DOM-based cross-site scripting via task list content. The task list content extraction logic did not properly re-encode browser-decoded text nodes before…
-
Medium 5.3
Incorrect Authorization in GitHub Enterprise Server allows access to issue and commit search results without repo scope
An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with a classic personal access token (PAT) lacking the repo scope to retrieve issues and commits from private and internal repositories via …
Revision history
-
#1
Initiale Fassung
References
-
GitHub Advisory Database vom 2026-03-10
https://github.com/advisories/GHSA-VG33-X66F-82H4
-
GitHub Advisory Database vom 2026-03-10
https://github.com/advisories/GHSA-W45Q-JFXP-27VQ