Github Enterprise Server vulnerabilities

CVE-2022-46257 [MEDIUM] CWE-200 CVE-2022-46257: An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed priv An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub Actions runner group via the API by a user who did not have access to those repositories, resulting in the repository names being shown in the UI. To exploit this vulnerability, an attacker would need access to

CVE-2025-6600 [MEDIUM] CWE-200 CVE-2025-6600: An exposure of sensitive information vulnerability was identified in GitHub Enterprise Server that c An exposure of sensitive information vulnerability was identified in GitHub Enterprise Server that could allow an attacker to disclose the names of private repositories within an organization. This issue could be exploited by leveraging a user-to-server token with no scopes via the Search API endpoint. Successful exploitation required an organization

CVE-2024-8263 [LOW] CWE-269 CVE-2024-8263: An improper privilege management vulnerability allowed arbitrary workflows to be committed using an An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped PAT through the use of nested tags. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in version 3.10.17, 3.11.15, 3.12.9, 3.13.4, and 3.14.1. This vulnerability was reported via the GitHub Bug Bounty progr