Skip to content
OpenAdvisories
High WID-SEC-2026-3530 3 CVEs

Microsoft GitHub Enterprise Server: Mehrere Schwachstellen

Published Sep 22, 2026 · Updated Sep 22, 2026 · de-DE

Vendor: Microsoft Product: GitHub Enterprise

Summary

Ein Angreifer kann mehrere Schwachstellen in Microsoft GitHub Enterprise Server ausnutzen, um Informationen offenzulegen, Daten zu manipulieren, beliebigen Code auszuführen oder Cross-Site-Scripting-Angriffe durchzuführen.

Product

GitHub ist ein netzbasierter Dienst zur Versionsverwaltung für Software-Entwicklungsprojekte.

Vulnerabilities 3

  • Critical 9.3
    CVE-2026-77987

    GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery

    A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to i…

    GitHub Enterprise Server
  • High 7.4
    CVE-2026-77912

    Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline

    A stored cross-site scripting (XSS) vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in …

    GitHub Enterprise Server
  • Medium 6.0
    CVE-2026-75101

    Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision

    An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull reque…

    GitHub Enterprise Server

Revision history

  1. #1

    Initiale Fassung

References