Filtered by vendor Netflix
Subscribe
Total
12 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-2322 | 1 Netflix | 1 Chaos Monkey | 2022-10-20 | 5.0 MEDIUM | 7.5 HIGH |
| Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to generate load and to generate memory leaks. | |||||
| CVE-2022-27177 | 1 Netflix | 1 Consoleme | 2022-04-11 | 7.5 HIGH | 9.8 CRITICAL |
| A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to 1.2.2 | |||||
| CVE-2020-9297 | 1 Netflix | 1 Titus | 2021-07-21 | 7.5 HIGH | 9.8 CRITICAL |
| Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passed to ConstraintValidatorContext.buildConstraintViolationWithTemplate() argument, they will be able to run arbitrary Java code. | |||||
| CVE-2019-10028 | 1 Netflix | 1 Dial Reference | 2021-07-21 | 5.0 MEDIUM | 7.5 HIGH |
| Denial of Service (DOS) in Dial Reference Source Code Used before June 18th, 2019. | |||||
| CVE-2020-9296 | 1 Netflix | 1 Conductor | 2021-07-21 | 7.5 HIGH | 9.8 CRITICAL |
| Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passed to ConstraintValidatorContext.buildConstraintViolationWithTemplate() argument, they will be able to run arbitrary Java code. | |||||
| CVE-2021-28100 | 1 Netflix | 1 Priam | 2021-03-26 | 2.1 LOW | 5.5 MEDIUM |
| Priam uses File.createTempFile, which gives the permissions on that file -rw-r--r--. An attacker with read access to the local filesystem can read anything written there by the Priam process. | |||||
| CVE-2021-28099 | 1 Netflix | 1 Hollow | 2021-03-26 | 3.6 LOW | 4.4 MEDIUM |
| In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated. | |||||
| CVE-2020-2323 | 1 Netflix | 1 Chaos Monkey | 2020-12-07 | 5.0 MEDIUM | 5.3 MEDIUM |
| Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions. | |||||
| CVE-2020-9300 | 1 Netflix | 1 Dispatch | 2020-11-18 | 4.0 MEDIUM | 6.5 MEDIUM |
| The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin, users adding themselves as a participant in a restricted incident, and users able to view restricted incidents via the search feature. If your install has followed the secure deployment guidelines the risk of this is lowered, as this may only be exploited by an authenticated user. | |||||
| CVE-2020-9299 | 1 Netflix | 1 Dispatch | 2020-11-17 | 3.5 LOW | 5.4 MEDIUM |
| There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting name and description parameters of Incident Priority, Incident Type, Tag Type, and Incident Filter. This vulnerability can be exploited by an authenticated user. | |||||
| CVE-2015-7764 | 1 Netflix | 1 Lemur | 2019-12-11 | 5.0 MEDIUM | 7.5 HIGH |
| Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode. | |||||
| CVE-2017-7266 | 1 Netflix | 1 Security Monkey | 2017-03-28 | 5.8 MEDIUM | 6.1 MEDIUM |
| Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespective of the Host header. | |||||