CVE-2024-0200 Unsafe Reflection in Github Enterprise Server leading to Command Injection

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the...

CVE-2023-46648

The CVE-2023-46648 entry concerns an insufficient entropy vulnerability in GitHub Enterprise Server (GHES) invitation tokens for the Management Console. The root cause is the entropy insufficiency of the invitation token mechanism, enabling brute-force attempts to identify pending user invitation...

kernel: ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init()

In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: Fix integer overflow in ghesestatuspoolinit Change numghes from int to unsigned int, preventing an overflow and causing subsequent vmalloc to fail. The overflow happens in ghesestatuspoolinit when calculating len duri...

PT-2025-18602 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel has been resolved, specifically an integer overflow in the ghes estatus pool init function. The issue occurs when calculating len during the executi...

GitHub: GHES Management console EoP (editor to site admin)

Improper privilege management in GitHub Enterprise Server allowed editor role users to escalate privileges by making requests to the bootstrapping endpoint...

PT-2022-36226 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.78 Description: The issue is related to an integer overflow in the ghes estatus pool init function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

GHSA-2C6M-6GQH-6QG3 Docker Command Escaping in the GitHub Actions Runner

Impact The actions runner invokes the docker cli directly in order to run job containers, service containers, or container actions. A bug in the logic for how the environment is encoded into these docker commands was discovered that allows an input to escape the environment variable and modify th...

CVE-2021-37940

An information disclosure via GET request server-side request forgery vulnerability was discovered with the Workplace Search Github Enterprise Server integration. Using this vulnerability, a malicious Workplace Search admin could use the GHES integration to view hosts that might not be publicly...

CVE-2021-37940

CVE-2021-37940 pertains to an information-disclosure via a GET-based server-side request forgery in the Workplace Search integration for GitHub Enterprise Server (GHES). The vulnerability allows a malicious GHES admin to leverage the Workplace Search GHES integration to view hosts that may not be...

Unbreakable Enterprise kernel-container security update

4.14.35-2025.402.2.1.el7 - powercap: restrict energy meter to root access Kanth Ghatraju Orabug: 32040805 CVE-2020-8694 CVE-2020-8695 4.14.35-2025.402.2.el7 - ocfs2: fix remounting needed after setfacl command Gang He - Fix multiple variable definition with syzkaller Hans Westgaard Ry Orabug:...

Unbreakable Enterprise kernel-container security update

4.14.35-2025.402.2.1.el7 - powercap: restrict energy meter to root access Kanth Ghatraju Orabug: 32040805 CVE-2020-8694 CVE-2020-8695 4.14.35-2025.402.2.el7 - ocfs2: fix remounting needed after setfacl command Gang He - Fix multiple variable definition with syzkaller Hans Westgaard Ry Orabug:...

RHEL 7 : kernel (RHSA-2016:0103)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0103 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. It was found that the x86 ISA Instruction Set...