CVE-2020-9296

Netflix Titus uses Java Bean Validation JSR 380 custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passe...

CVE-2020-9297

Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation JSR 380 custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary...

VulnCheck KEV: CVE-2020-5412

Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can...

Malicious code in nflx-metaflow (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1d317c47382e978342b2098c06b1d0ff46acfefdc5a5ed6ce2b531b1f5b24fe4 Packages are designed to collect basic info about the user when importing them, and have no other purpose. While they claim to do so, some packages from the sa...

Dutch DPA Fines Netflix €4.75 Million for GDPR Violations Over Data Transparency

The Dutch Data Protection Authority DPA on Wednesday fined video on-demand streaming service Netflix €4.75 million $4.93 million for not giving consumers enough information about how it used their data between 2018 and 2020. An investigation launched by the DPA in 2019 found that the tech giant d...

Netflix e2nest 安全漏洞

Netflix e2nest is a web-based platform from the American company Netflix, Inc. for media-centric video, audio and image subjective testing. A security vulnerability exists in versions prior to Netflix e2nest 16, which stems from a vulnerability that allows an unauthenticated user to perform path...

Netflix Dispatch 安全漏洞

Netflix Dispatch is a US-based Netflix software that provides deep integration with Slack, GSuite, Jira and other tools and provides security event management. Netflix Dispatch suffers from a security vulnerability that stems from allowing code to be executed within blocks that have not been...

Leave the World Behind, or don’t

I watched Leave the World Behind on Netflix recently. I was intrigued as the trailers showed an oil tanker crashing on to a beach. It was implied that it had been hacked and someone had taken control of it. Shipping security is something we know quite a bit about, having been asked to hack a larg...

The Stark Truth Behind the Resurgence of Russia’s Fin7

The Russia-based cybercrime group dubbed "Fin7," known for phishing and malware attacks that have cost victim organizations an estimated $3 billion in losses since 2013, was declared dead last year by U.S. authorities. But experts say Fin7 has roared back to life in 2024 -- setting up thousands o...

MAL-2024-3838 Malicious code in vue-netflix-slider (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in vue-netflix-slider (npm)

--- -= Per source details. Do not edit below this line.=-...

This Week in Spring - June 4th, 2024

Hi, Spring fans, from London! I'm in this fabulous country doing my level-headed best to refrain from dooing Mr. Bean bits, because, honestly, if I - an avid and prolific fan of Spring and its many beans - can't be "Mr. Bean," then I'm glad Rowan Atkinson is! I'm here for a SpringOne Tour event,...

CVE-2024-5023

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Netflix ConsoleMe allows Command Injection.This issue affects ConsoleMe: before 1.4.0...

CVE-2024-5023 Arbitrary File Read Vulnerability in ConsoleMe via Limited Git command RCE

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Netflix ConsoleMe allows Command Injection.This issue affects ConsoleMe: before 1.4.0...

CVE-2024-5023

CVE-2024-5023 affects Netflix ConsoleMe prior to 1.4.0. Root cause: improper neutralization of special elements used in a command within Template resources flow, enabling command execution via crafted inputs. Documentation indicates authenticated users can achieve limited remote code execution co...

Netflix ConsoleMe 安全漏洞

ConsoleMe is a web service that makes AWS IAM rights and credentials management easier for end users and cloud administrators. A security vulnerability exists in Netflix ConsoleMe versions prior to 1.4.0 that stems from incorrect neutralization of special elements used in commands, resulting in...

Netflix Genie 路径遍历漏洞

Netflix Genie is a federated big data orchestration and execution engine from Netflix, Inc. in the United States. A path traversal vulnerability exists in Netflix Genie versions prior to 4.3.18, which stems from the presence of a path traversal issue that could lead to remote code execution...

A Bootiful Podcast: Netflix’s Paul Bakker and Kavitha Srinivasan on scaling Spring Boot and Spring GraphQL

Hi, Spring fans! In this installment, I'm thrilled to be joined by Netflix's Paul Bakker and Kavitha Srinivasan, who explain how they're integrating and evolving Spring for GraphQL in their own GraphQL stack and how they're managing, growing, and evolving thousands of services written in Spring B...

This Week in Spring - March 12th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! And what a week it's going to be! Do this first: we need your help! Please answer some questions in our State of Spring survey! Join me for a look at the latest-and-greatest, chronicling how I got started with Spring Boot in...

This Week in Spring - December 5th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! today, Spring Cloud, based on Spring Boot 3.2, goes GA! Don't miss this! I love this blog by Spring Framework legend Sébastien Deleuze on CDS with Spring Framework 6.1 I really enjoyed this discussion with Spring Security...