CVE-2024-1084

Cross-site Scripting in the tag name pattern field in the tag protections UI in GitHub Enterprise Server allows a malicious website that requires user interaction and social engineering to make changes to a user account via CSP bypass with created CSRF tokens. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12  and was fixed in all versions of 3.11.5, 3.10.7, 3.9.10, and 3.8.15. This vulnerability was reported via the GitHub Bug Bounty program.

• CWE-79
• CWE-79

• https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.7Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.5Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.15Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.10Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.7Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.5Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.15Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.10Release Notes, Vendor Advisory

Published

Feb 13, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-10834eosphoros-ai/db-gpt version 0.6.0 contains a vulnerability i…9.1
• CVE-2024-10835In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /ap…9.8
• CVE-2024-10836The Flixita theme for WordPress is vulnerable to Reflected C…6.1
• CVE-2024-10837The SysBasics Customize My Account for WooCommerce plugin fo…6.1
• CVE-2024-10838An integer underflow during deserialization may allow any un…9.1
• CVE-2024-10839Zohocorp ManageEngine SharePoint Manager Plus versions 4503 …8.1
• CVE-2024-10840A vulnerability classified as problematic has been found in …4.8
• CVE-2024-10841A vulnerability classified as critical was found in romadebr…8
• CVE-2024-10842A vulnerability, which was classified as problematic, has be…4.8
• CVE-2024-10844A vulnerability, which was classified as critical, was found…9.8
• CVE-2024-10845A vulnerability has been found in 1000 Projects Bookstore Ma…9.8
• CVE-2024-10846The compose-go library component in versions v2.10-v2.4.0 al…5.9