CVE-2024-0507_CVE-2024-0200-github

简介 此仓库包含我们为GitHub Enterprise漏洞CVE-2024-0507和CVE-2024-0200开发的利用程序。 查看完整文章：https://blog.convisoappsec.com/en/analysis-of-github-enterprise-vulnerabilities-cve-2024-0507-cve-2024-0200/ CVE-2024-0507 GitHub Enterprise Server 管理控制台中的代码注入导致权限提升 . CVE-2024-0200 GitHub Enterprise Server 中的不安全反射导致命令注入...

Exploit_CVE-2026-3854

ExploitCVE-2026-3854 CVE-2026-3854 は、GitHub.com および GitHub Enterprise Server におけるリモートコード実行（RCE）の脆弱性です。 この脆弱性は、以下のように git push コマンドにコマンドを注入することで悪用される可能性があります： git push -o '' origin master この脆弱性の悪用を確認するには、push オプションに「;」が含まれる push 操作について、/var/log/github-audit.log を確認することをお勧めします。 影響を受けるバージョン： GitHub...

CVE-2026-96890

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret...

CVE-2026-103620

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required...

CVE-2026-96890

A Server-Side Request Forgery (SSRF) vulnerability exists in GitHub Enterprise Server (versions 3.20, 3.21, and 3.22). The flaw stems from the secret scanning validator for GCP service account credentials , which trusted the token endpoint embedded in a committed credential and issued requests wi...

EUVD-2026-93667

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret...

CVE-2026-96890 Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret...

CVE-2026-96890 Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret...

CVE-2026-103620

A missing authorization vulnerability in GitHub Enterprise Server allows repository collaborators with write access to delete the current default branch using the GraphQL API . This flaw enables an attacker to set an attacker-controlled branch as the new default. In repositories requiring pull-re...

EUVD-2026-93666

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required...

CVE-2026-103620 Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required...

CVE-2026-103620 Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required...

PT-2026-107128

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret...

CVE-2026-96890: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret...

PT-2026-107111

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required...

ghe-push-option-rce-scanner

CVE-2026-3854 — GitHub Enterprise Server における Push Option Injection による RCE 概要 GHE における push option 値の不適切な無害化。push アクセス権を持つ攻撃者がインスタンス上で RCE を達成します。 フィールド| 値 ---|--- CVE| CVE-2026-3854 深刻度| CRITICAL 製品| GitHub Enterprise Server CISA KEV| 2026-03-10 攻撃タイプ| Push Option Injection による RCE 認証要件| なし...

CVE-2026-77912

A stored cross-site scripting XSS vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without...

CVE-2026-77987

A server-side request forgery SSRF vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other port...

CVE-2026-75101

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull request diffs and patches were scoped to th...

EUVD-2026-84874

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull request diffs and patches were scoped to th...