Lucene search

K

Netflix Security Vulnerabilities

cve
cve

CVE-2024-4701

A path traversal issue potentially leading to remote code execution in Genie for all versions prior to...

9.9CVSS

7.7AI Score

0.0004EPSS

2024-05-14 03:44 PM
36
cve
cve

CVE-2024-5023

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Netflix ConsoleMe allows Command Injection.This issue affects ConsoleMe: before...

6.8AI Score

0.0004EPSS

2024-05-16 06:15 PM
27
cve
cve

CVE-2020-2323

Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of...

5.3CVSS

5.1AI Score

0.001EPSS

2020-12-03 04:15 PM
32
cve
cve

CVE-2020-2322

Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to generate load and to generate memory...

7.5CVSS

7.4AI Score

0.002EPSS

2020-12-03 04:15 PM
34
cve
cve

CVE-2023-40171

Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the Dispatch Plugin - Basic Authentication Provider plugin encounters an error when attempting to decode a JWT token. Any Dispatch users...

9.1CVSS

7.5AI Score

0.001EPSS

2023-08-17 10:15 PM
2328
cve
cve

CVE-2021-28099

In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically...

4.4CVSS

4.6AI Score

0.0004EPSS

2021-03-23 09:15 PM
61
cve
cve

CVE-2023-30797

Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by...

7.5CVSS

7.5AI Score

0.002EPSS

2023-04-19 08:15 PM
15
2
cve
cve

CVE-2020-9296

Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being...

9.8CVSS

9.3AI Score

0.002EPSS

2020-06-16 02:15 PM
47
3
cve
cve

CVE-2022-27177

A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to...

9.8CVSS

9.4AI Score

0.004EPSS

2022-04-01 11:15 PM
82
cve
cve

CVE-2021-28100

Priam uses File.createTempFile, which gives the permissions on that file -rw-r--r--. An attacker with read access to the local filesystem can read anything written there by the Priam...

5.5CVSS

5.2AI Score

0.0004EPSS

2021-03-23 09:15 PM
57
cve
cve

CVE-2020-9300

The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin, users adding themselves as a participant in a restricted incident, and users able to view restricted incidents via the search feature. If your install has followed the secure...

6.5CVSS

6.5AI Score

0.001EPSS

2020-11-09 03:15 PM
16
cve
cve

CVE-2020-9299

There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting name and description parameters of Incident Priority, Incident Type, Tag Type, and Incident Filter. This vulnerability can be exploited by an authenticated...

5.4CVSS

5.3AI Score

0.001EPSS

2020-11-09 03:15 PM
22
cve
cve

CVE-2020-9297

Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary....

9.8CVSS

9.3AI Score

0.002EPSS

2020-07-14 08:15 PM
23
cve
cve

CVE-2019-10028

Denial of Service (DOS) in Dial Reference Source Code Used before June 18th,...

7.5CVSS

7.6AI Score

0.001EPSS

2019-06-21 09:15 PM
321
cve
cve

CVE-2015-7764

Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC...

7.5CVSS

7.5AI Score

0.002EPSS

2017-08-09 04:29 PM
18
cve
cve

CVE-2017-7266

Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespective of the Host...

6.1CVSS

6.2AI Score

0.002EPSS

2017-03-26 05:59 AM
27