GitHub Enterprise Server 安全漏洞

GitHub Enterprise Server is an open source application from GitHub in the United States. It provides a platform for setting up your own GitHub instance as a virtual appliance, thus providing a scalable, easy-to-manage platform. A security vulnerability exists in GitHub Enterprise Server versions...

PT-2025-50626

In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata...

PT-2025-50649

An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed user-supplied HTML to inject DOM elements with IDs that collided with server-initialized data islands. These collisions could overwrite or shadow critical application state objects used by...

GHSA-VG28-83RP-8XX4

creationtimestamp| type| source ---|---|--- 2025-12-10 23:03:38+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3m7o66wzd6q2a 2025-12-11 00:05:03+00:00| seen| https://bsky.app/profile/nixpkgs-prs-bot.bsky.social/post/3m7obmrdszu2x...

GHSA-QHR6-6CGV-6638

creationtimestamp| type| source ---|---|--- 2025-12-10 22:38:36+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115697668298607011...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the port-change endpoint in the web port configuration process. An attacker can cause service disruption or loss of access by tricking an authenticated user into submitting a crafted request, which...

CVE-2025-13073

creationtimestamp| type| source ---|---|--- 2025-12-10 07:15:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7mj7nlnar2e 2025-12-10 07:44:51+00:00| seen| https://gist.github.com/Darkcrai86/10212c9ef8a3f93c33ffb74d9cf5b7f6 2025-12-10 08:07:20+00:00| seen|...

CVE-2025-64671 GitHub Copilot for Jetbrains Remote Code Execution Vulnerability

...

CVE-2025-64671

CVE-2025-64671 is a remote code execution vulnerability in the GitHub Copilot for JetBrains plugin caused by improper neutralization of command elements (command injection). The Nessus/NVL documentation indicates the issue affects versions prior to 1.5.60; upgrading to 1.5.60 or later is the reme...

CVE-2025-64671 GitHub Copilot for Jetbrains Remote Code Execution Vulnerability

...

CVE-2025-63054

creationtimestamp| type| source ---|---|--- 2025-12-09 15:32:19+00:00| seen| https://gist.github.com/Darkcrai86/de1ee7a665de8f760aa934b36459fbe4...

Code to Cloud Attacks: From Github PAT to Cloud Control Plane

How attackers are leveraging compromised employee GitHub Personal Access Tokens to compromise cloud environments...

CVE-2025-66568

creationtimestamp| type| source ---|---|--- 2025-12-09 07:28:49+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m7jzihnz362v 2025-12-09 07:33:35+00:00| seen| https://infosec.exchange/users/offseq/statuses/115688447292985606 2025-12-09 07:33:37+00:00| seen|...

KLA90816 ACE vulnerability in Microsoft Copilot Plugin

A remote code execution vulnerability was found in Microsoft Copilot Studio. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2025-64671 Related products GitHub-Copilot-Plugin CVE list CVE-2025-64671 critical KB list Solution Install necessary...

GO-2025-4183 CVE-2017-18870 in github.com/mattermost/mattermost-server

CVE-2017-18870 in github.com/mattermost/mattermost-server...

Exploit for Deserialization of Untrusted Data in Facebook React

🛡️ GitHub Vulnerability Scanner for CVE-2025-55182 React/Next...

Exploit for CVE-2025-66478

Next.js CVE Auto-Patcher Automation tool written in Go to sca...

CVE-2025-66629

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for social login providers such as Google, GitHub, GitLab, Facebook or Dropbox lack CSRF protection, since they don't send a state parameter and verify the respon...

Researcher Uncovers 30+ Flaws in AI Coding Tools Enabling Data Theft and RCE Attacks

Over 30 security vulnerabilities have been disclosed in various artificial intelligence AI-powered Integrated Development Environments IDEs that combine prompt injection primitives with legitimate features to achieve data exfiltration and remote code execution. The security shortcomings have been...

CVE-2025-66629

HedgeDoc versions prior to 1.10.4 are affected by missing CSRF protection in OAuth2 endpoints for social logins (Google, GitHub, GitLab, Facebook, Dropbox) due to not sending/verifying a state parameter. This could allow attackers to hijack user authentication sessions. The issue is fixed in 1.10...