https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 20:29:55 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-80145 EUVD-2026-80145 https://cve.radiocsirt.org/vuln/euvd-2026-80145 https://cve.radiocsirt.org/vuln/fkie_cve-2017-18365 <p>The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to execute arbitrary code. This occurs because the enterprise session secret is always the same, and can be found in the product&#39;s source code. By sending a crafted cookie signed with this secret, one can call Marshal.load with arbitrary data, which is a problem because the Marshal data format allows Ruby objects.</p> <p>The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to execute arbitrary code. This occurs because the enterprise session secret is always the same, and can be found in the product&#39;s source code. By sending a crafted cookie signed with this secret, one can call Marshal.load with arbitrary data, which is a problem because the Marshal data format allows Ruby objects.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2017-18365 https://cve.radiocsirt.org/vuln/ghsa-cg2q-c8hj-pqc3 <p>The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to execute arbitrary code. This occurs because the enterprise session secret is always the same, and can be found in the product&#39;s source code. By sending a crafted cookie signed with this secret, one can call Marshal.load with arbitrary data, which is a problem because the Marshal data format allows Ruby objects.</p> <p>The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to execute arbitrary code. This occurs because the enterprise session secret is always the same, and can be found in the product&#39;s source code. By sending a crafted cookie signed with this secret, one can call Marshal.load with arbitrary data, which is a problem because the Marshal data format allows Ruby objects.</p> https://cve.radiocsirt.org/vuln/ghsa-cg2q-c8hj-pqc3 https://cve.radiocsirt.org/vuln/gsd-2017-18365 gsd-2017-18365 https://cve.radiocsirt.org/vuln/gsd-2017-18365