Netflix

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-9301 1Netflix 1E2nest Jun 17, 2026 Sep 27, 2024 8.7 HIGH· v4 7.5 HIGH· v3 N/A· v2 A path traversal issue in E2Nest prior to commit 8a41948e553c89c56b14410c6ed395e9cfb9250a
CVE-2023-40171 1Netflix 1Dispatch Jun 17, 2026 Aug 17, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the `Dispatch Plugin - Basic Authentication Provider` plugin...Show more Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the `Dispatch Plugin - Basic Authentication Provider` plugin encounters an error when attempting to decode a JWT token. Any Dispatch users who own their instance and rely on the `Dispatch Plugin - Basic Authentication Provider` plugin for authentication may be impacted, allowing for any account to be taken over within their own instance. This could be done by using the secret to sign attacker crafted JWTs. If you think that you may be impacted, we strongly suggest you to rotate the secret stored in the `DISPATCH_JWT_SECRET` envvar in the `.env` file. This issue has been addressed in commit `b1942a4319` which has been included in the `20230817` release. users are advised to upgrade. There are no known workarounds for this vulnerability.Show less
CVE-2023-30797 1Netflix 1Lemur Jul 15, 2026 Apr 19, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources manag...Show more Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur.Show less
CVE-2022-27177 1Netflix 1Consoleme Jun 17, 2026 Apr 1, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to 1.2.2
CVE-2021-28100 1Netflix 1Priam Jun 17, 2026 Mar 23, 2021 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 Priam uses File.createTempFile, which gives the permissions on that file -rw-r--r--. An attacker with read access to the local filesystem can read anything written there by the Priam process.
CVE-2021-28099 1Netflix 1Hollow Jun 17, 2026 Mar 23, 2021 N/A· v4 4.4 MEDIUM· v3 3.6 LOW· v2 In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is us...Show more In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.Show less
CVE-2020-2323 1Netflix 1Chaos Monkey Jun 17, 2026 Dec 3, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions.
CVE-2020-2322 1Netflix 1Chaos Monkey Jun 17, 2026 Dec 3, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to generate load and to generate memory leaks.
CVE-2020-9300 1Netflix 1Dispatch Jun 17, 2026 Nov 9, 2020 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin, users adding themselves as a participant in a restricted incident, and users able to view restricted...Show more The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin, users adding themselves as a participant in a restricted incident, and users able to view restricted incidents via the search feature. If your install has followed the secure deployment guidelines the risk of this is lowered, as this may only be exploited by an authenticated user.Show less
CVE-2020-9299 1Netflix 1Dispatch Jun 17, 2026 Nov 9, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting name and description parameters of Incident Priority, Incident Type, Tag Type, and Incident Filter. This vulnerability can be...Show more There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting name and description parameters of Incident Priority, Incident Type, Tag Type, and Incident Filter. This vulnerability can be exploited by an authenticated user.Show less
CVE-2020-9297 1Netflix 1Titus Jun 17, 2026 Jul 14, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are...Show more Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passed to ConstraintValidatorContext.buildConstraintViolationWithTemplate() argument, they will be able to run arbitrary Java code.Show less
CVE-2020-9296 1Netflix 1Conductor Jun 17, 2026 Jun 16, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If...Show more Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passed to ConstraintValidatorContext.buildConstraintViolationWithTemplate() argument, they will be able to run arbitrary Java code.Show less
CVE-2019-10028 1Netflix 1Dial Reference Jun 17, 2026 Jun 21, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Denial of Service (DOS) in Dial Reference Source Code Used before June 18th, 2019.
CVE-2015-7764 1Netflix 1Lemur May 13, 2026 Aug 9, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.
CVE-2017-7266 1Netflix 1Security Monkey May 13, 2026 Mar 26, 2017 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespective of the Host header.