234 matches found
CVE-2023-30797
Netflix Lemur prior to version 1.3.2 is affected by insecure random number generation in default credential creation. The root cause is insufficiently random values used when generating default credentials, which may allow an attacker to guess credentials and access resources managed by Lemur. Ev...
Netflix Lemur 安全特征问题漏洞
Netflix Lemur is Netflix's tool for managing TLS credential creation. A security vulnerability exists in Netflix Lemur versions prior to 1.3.2, which stems from an insufficiently randomized value used when generating default credentials, and which could be exploited by an attacker to guess...
PT-2023-22986 · Netflix · Netflix Lemur
Name of the Vulnerable Software and Affected Versions: Netflix Lemur versions prior to 1.3.2 Description: The issue is related to Netflix Lemur using insufficiently random values when generating default credentials. This may allow an attacker to guess the credentials and gain access to resources...
Netflix’s US Password-Sharing Crackdown Isn’t Happening—Yet
Accidental revisions to a US Help Center page sparked confusion about the streamer's next moves. But restrictions on account sharing are still coming soon...
Russians Hacked JFK Airport Taxi Dispatch in Line-Skipping Scheme
Plus: An offensive US hacking operation, swatters hacking Ring cameras, a Netflix password-sharing crackdown, and more...
Sharing Netflix, Disney+, other passwords is illegal, according to new guidance
The Intellectual Property Office IPO, the UK government body overseeing intellectual property rights in the UK, has quietly released new guidance on piracy and online counterfeit goods. This campaign is a joint effort between IPO and Meta, Facebooks parent company. The general issue on piracy is...
etflix.us Cross Site Scripting vulnerability OBB-2977513
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
KrebsOnSecurity in New Netflix Series on Cybercrime
Netflix has a new documentary series airing next week -- "Web of Make Believe: Death, Lies & the Internet" -- in which Yours Truly apparently has a decent amount of screen time. The debut episode explores the far-too-common harassment tactic of "swatting" -- wherein fake bomb threats or hostage...
GHSA-J6JQ-3Q8P-XGG6 Netflix Security Monkey Open Redirect vulnerability
Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespective of the Host header...
Netflix Security Monkey Open Redirect vulnerability
Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespective of the Host header...
Netflix Can Cut Off Moochers Without a Password-Sharing Crackdown
There's a simple way to limit Netflix freeloaders—give users the ability to easily boot unknown devices linked to their accounts...
Expression Language Injection in Netflix Conductor
Netflix Conductor uses Java Bean Validation JSR 380 custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being...
GHSA-WFJ5-2MQR-7JVV Expression Language Injection in Netflix Conductor
Netflix Conductor uses Java Bean Validation JSR 380 custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being...
VMware Spring Cloud Netflix Remote Code Execution (CVE-2021-22053)
A remote code execution vulnerability exists in VMware Spring Cloud Netflix. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
Researcher Spotlight: Dr. Nestori Syynimaa’s Constant Mission Protecting Identities
"When you find the things I find, they really matter. They affect everybody’s security.” Currently streaming: The Expanse and Lost in Space on Netflix Currently listening to: Amorphis, Architects, and Killswitch Engage Currently running: 130 kilometers or 80 miles a month Currently playing:...
Researcher Spotlight: Dr. Nestori Syynimaa’s Constant Mission Protecting Identities
"When you find the things I find, they really matter. They affect everybody’s security.” Currently streaming : The Expanse and Lost in Space on Netflix Currently listening to : Amorphis, Architects, and Killswitch Engage Currently running : 130 kilometers or 80 miles a month Currently playing :...
CVE-2021-22053
Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;user-provided data, the path elements following...
Design/Logic Flaw
Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;user-provided data, the path elements following...
CVE-2021-22053
Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;user-provided data, the path elements following...