20641 matches found
CVE-2025-3509
A Remote Code Execution RCE vulnerability was identified in GitHub Enterprise Server that allowed attackers to execute arbitrary code by exploiting the pre-receive hook functionality, potentially leading to privilege escalation and system compromise. The vulnerability involves using dynamically...
CVE-2025-3124 Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized access to private repository names
A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a user to see the names of private repositories that they wouldn't otherwise have access to in the Security Overview in GitHub Advanced Security. The Security Overview was required to be filtered only...
CVE-2025-3124
CVE-2025-3124 concerns a missing authorization vulnerability in GitHub Enterprise Server that allowed a user to see the names of private repositories they otherwise wouldn’t access via the Security Overview in GitHub Advanced Security. The issue affected all versions prior to 3.17 and was fixed i...
GitHub Enterprise Server 安全漏洞
GitHub Enterprise Server is an open source application from GitHub in the United States. It provides a platform for setting up your own GitHub instance as a virtual appliance, thus providing a scalable, easy-to-manage platform. A security vulnerability exists in GitHub Enterprise Server versions...
Vulnerabilities fixed in Oracle Communications
Oracle has fixed several vulnerabilities in Oracle Communications products, including Cloud Native Core and Policy Management. The vulnerabilities in Oracle Communications products allow unauthenticated attackers to gain unauthorized access to sensitive data and can lead to denial-of-service DoS...
CVE-2025-32021 Weblate VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext
Weblate is a web based localization tool. Prior to version 5.11, when creating a new component from an existing component that has a source code repository URL specified in settings, this URL is included in the client's URL parameters during the creation process. If, for example, the source code...
Use of GET Request Method With Sensitive Query Strings
Overview Affected versions of this package are vulnerable to Use of GET Request Method With Sensitive Query Strings when a new component is created based on an existing one with a source code repository URL, this URL, including any embedded credentials like a GitHub Personal Access Token and...
Weblate 安全漏洞
Weblate is a Copyleft open source web-based continuous localization system for free software. A security vulnerability exists in Weblate versions prior to 5.11, which stems from the possibility that credentials in the code repository URL may be disclosed in plaintext...
📄 Anant Addons for Elementor 1.1.5 CSRF / Arbitrary Plugin Installation
Anant Addons for Elementor versions 1.1.5 and below cross site request forgery proof of concept that allows for arbitrary plugin installation. 🛡️ Anant Addons for Elementor Anant Addons for Elementor body background-color: 111; color: 0f0; font-family: monospace;...
Linux Distros Unpatched Vulnerability : CVE-2024-37303
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and cachi...
CVE-2025-27892
creationtimestamp| type| source ---|---|--- 2025-04-10 14:38:56+00:00| seen| https://bsky.app/profile/campuscodi.risky.biz/post/3lmhq7wh5zk2w 2025-04-15 22:43:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmv5megosj2j 2025-04-16 01:49:06+00:00| seen|...
GO-2025-3594 MinIO performs incomplete signature validation for unsigned-trailer uploads in github.com/minio/minio
MinIO performs incomplete signature validation for unsigned-trailer uploads in github.com/minio/minio...
GHSA-794X-2RPG-RFGR Jujutsu does not have SHA-1 collision detection
Summary Jujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. Details This is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide...
gitGRAB - This Tool Is Designed To Interact With The GitHub API And Retrieve Specific User Details, Repository Information, And Commit Emails For A Given User
This tool is designed to interact with the GitHub API and retrieve specific user details, repository information, and commit emails for a given user. Install Requests pip install requests Execute the program python3 gitgrab.py Download gitGRAB...
CVE-2025-31479
canonical/get-workflow-version-action is a GitHub composite action to get commit SHA that GitHub Actions reusable workflow was called with. Prior to 1.0.1, if the get-workflow-version-action step fails, the exception output may include the GITHUBTOKEN. If the full token is included in the excepti...
CVE-2025-30370 jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal"
jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $. These directory names are allowed in macOS and a majority of Linux distributions. If...
CVE-2025-30370 jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal"
jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $. These directory names are allowed in macOS and a majority of Linux distributions. If...
BIT-DOLIBARR-2023-5842 Cross-site Scripting (XSS) - Stored in dolibarr/dolibarr
Cross-site Scripting XSS - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.5...