InfoSecBulletin Cybersecurity for mankind
GitHub has fixed three security flaws in its Enterprise Server product. One of these flaws was critical and allowed an attacker to gain administrative privileges. The most severe issue is called CVE-2024-6800. It has a CVSS score of 9.5.
“On GitHub Enterprise Server instances that use SAML single sign-on (SSO) authentication with specific IdPs utilizing publicly exposed signed federation metadata XML, an attacker could forge a SAML response to provision and/or gain access to a user account with site administrator privileges,” GitHub said in an advisory.
AWS SNS misused for Data Exfiltration and Phishing
Researcher found non protected database form ESHYFT containig 86000 records
CVE-2024-55591 and CVE-2025-24472
New SuperBlack ransomware exploits Fortinet flaws
CVE-2025-25291 & CVE-2025-25292
Attention! GitLab Patched Critical Authentication Bypass Flaws
CVE-2025-20138
Cisco released High Security Alert for IOS XR Software
400+ IPs Exploiting Multiple SSRF Vulnerabilities
NVIDIA has released update for NVIDIA Riva
CVE-2025-24201
Apple fixes 0-day exploited in “extremely sophisticated attack”
Microsoft’s March 2025 updates fix 7 zero-day, 57 flaws
Ballista Botnet infects 6000 Unpatched TP-Link Routers
The Microsoft-owned subsidiary has also addressed a pair of medium-severity flaws –
CVE-2024-7711 (CVSS score: 5.3) – A vulnerability that could allow an attacker to make unauthorized updates to an issue in a public repository.
CVE-2024-6337 (CVSS score: 5.9) – An authorization vulnerability was found on GitHub that allows an attacker to access the contents of private repositories. This vulnerability can be exploited by a GitHub App with “read” permission for contents and “write” permission for pull requests. The issue has been fixed in versions 3.13.3, 3.12.8, 3.11.14, and 3.10.16 of GHES.
In May, GitHub fixed a serious security issue (CVE-2024-4985, CVSS score: 10.0) that could allow unauthorized access without needing authentication.
Organizations using a vulnerable self-hosted version of GHES should update to the latest version to protect against security threats.
