GitHub Vulnerabilities and Affected Products
Vulnerabilities associated with github.
Products
Clear product- Enterprise Server82 vulnerabilities
- GitHub Enterprise Server46 vulnerabilities
- enterprise_server15 vulnerabilities
- cmark-gfm10 vulnerabilities
- Opensearch3 vulnerabilities
- cli2 vulnerabilities
- codeql-action2 vulnerabilities
- copilot-cli2 vulnerabilities
- github-mcp-server2 vulnerabilities
- codeql-cli-binaries1 vulnerability
- github1 vulnerability
- go-gh1 vulnerability
- paste-markdown1 vulnerability
- secure_headers1 vulnerability
- trilogy1 vulnerability
- view_component1 vulnerability
- vscode-codeql1 vulnerability
- Webiness Inventory1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2017-18365CRITICAL | github github Deserialization of Untrusted DataThe Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to execute arbitrary code. This occurs because the enterprise session secret is always the same, and can be found in the product's source code. By sending a crafted cookie signed with this secret, one can call Marshal.load with arbitrary data, which is a problem because the Marshal data format allows Ruby objects. CWE-502Mar 28, 2019 | CVSS9.8v3.0 | EPSS21.2% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |