spring-cloud-netflix-hystrix-dashboard-cve-2021-22053

CVE-2021-22053: Spring Cloud Netflix Hystrix Dashboard template resolution vulnerability Severity High Vendor Spring by VMware Description Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI...

chaosmonkey

Chaos Monkey randomly terminates virtual machine instances and containers that run inside of your production environment. Exposing engineers to failures more frequently incentivizes them to build resilient services. See the documentation for info on how to use Chaos Monkey. Chaos Monkey is an...

Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Execution

Spring Cloud Netflix Hystrix Dashboard prior to version 2.2.10 is susceptible to remote code execution. Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view...

security-bulletins

Security Bulletins Below are notifications for security and privacy events within Netflix Open Source applications. Date| Type| Subject ---|---|--- Septeember 27, 2024| High| Path Traversal in E2Nest August 1, 2024| Critical| Server-Side Template Injection in Dispatch Message Templates May 16,...

CVE-2024-4701-POC

CVE-2024-4701-POC POC for CVE-2024-4701 Download the genie docker file from https://netflix.github.io/genie/docs/4.3.0/demo/docker-compose.yml or this repo run docker-compose up Download the attached http payload loadlib Run the following command nc -w 5 localhost 8080 loadlib You may need to...

CVE-2026-71307

creationtimestamp| type| source ---|---|--- 2026-08-18 22:35:11+00:00| published-proof-of-concept| https://github.com/Netflix/lemur/security/advisories/GHSA-6c8m-q6g9-vrw3 2026-08-19 06:44:38+00:00| seen| https://gist.github.com/alon710/d3bb7a8e835fd653e6c886cd85f28aa2...

PYSEC-2026-919 Netflix Security Monkey Open Redirect vulnerability

Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespective of the Host header...

GHSA-J8PH-6FXJ-G533 Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch

Summary DataCenterInfo.FromJson throws ArgumentException for any name value other than "MyOwn" or "Amazon", despite the Java Eureka specification defining a third valid value: "Netflix". The exception propagates through the entire registry deserialization chain and is swallowed by the periodic...

EUVD-2026-37806

Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch...

Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch

Summary DataCenterInfo.FromJson throws ArgumentException for any name value other than "MyOwn" or "Amazon", despite the Java Eureka specification defining a third valid value: "Netflix". The exception propagates through the entire registry deserialization chain and is swallowed by the periodic...

PT-2026-55399

Summary DataCenterInfo.FromJson throws ArgumentException for any name value other than "MyOwn" or "Amazon", despite the Java Eureka specification defining a third valid value: "Netflix". The exception propagates through the entire registry deserialization chain and is swallowed by the periodic...

CVE-2026-55165

creationtimestamp| type| source ---|---|--- 2026-06-26 00:35:05+00:00| published-proof-of-concept| https://github.com/Netflix/lemur/security/advisories/GHSA-r9gp-7f88-9r54...

CVE-2026-55166

creationtimestamp| type| source ---|---|--- 2026-06-26 00:35:02+00:00| published-proof-of-concept| https://github.com/Netflix/lemur/security/advisories/GHSA-v2wp-frmc-5q3v 2026-08-18 20:01:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtez2cbezq2m 2026-08-18...

CVE-2026-55162

creationtimestamp| type| source ---|---|--- 2026-06-25 22:35:02+00:00| published-proof-of-concept| https://github.com/Netflix/lemur/security/advisories/GHSA-54vg-pfh7-jq95...

CVE-2026-50196

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Discovery.Eureka prior to versions 4.2.0 and 3.4.0, DataCenterInfo.FromJson throws ArgumentException for any name value other than "MyOwn" or "Amazon", despite...

CVE-2026-50196

CVE-2026-50196 – Steeltoe.Discovery.Eureka : In Steeltoe.Discovery.Eureka before versions 4.2.0 and 3.4.0, DataCenterInfo.FromJson throws an ArgumentException for any DataCenterInfo.name other than MyOwn, Amazon, or Netflix, causing the registry deserialization to fail and the cache refresh to sw...

CVE-2026-50196 Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Discovery.Eureka prior to versions 4.2.0 and 3.4.0, DataCenterInfo.FromJson throws ArgumentException for any name value other than "MyOwn" or "Amazon", despite...

CVE-2026-50196 Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Discovery.Eureka prior to versions 4.2.0 and 3.4.0, DataCenterInfo.FromJson throws ArgumentException for any name value other than "MyOwn" or "Amazon", despite...

PT-2026-50555

Name of the Vulnerable Software and Affected Versions Steeltoe.Discovery.Eureka versions prior to 3.4.0 Steeltoe.Discovery.Eureka versions prior to 4.2.0 Description The DataCenterInfo.FromJson function throws an ArgumentException when it encounters any name value other than "MyOwn" or "Amazon"...

INTERPOL Operation Takes Down Sniper Dz Phishing Platform, Arrests Administrator

An INTERPOL-led operation last month resulted in the disruption of Sniper Dz , a decade-long phishing-as-a-service PhaaS platform, Group-IB said Thursday. The effort, codenamed Operation Ramz, took place between October 2025 and February 2026, and saw authorities from 13 countries in the Middle...