Netflix
Products
12Recent CVEs
15| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-7093 | Cri | 0.61 | — | 0.01 | Aug 1, 2024 | Dispatch's notification service uses Jinja templates to generate messages to users. Jinja permits code execution within blocks, which were neither properly sanitized nor sandboxed. This vulnerability enables users to construct command line scripts in their custom message… | ||
| CVE-2024-4701 | Cri | 0.59 | 9.9 | 0.25 | May 14, 2024 | A path traversal issue potentially leading to remote code execution in Genie for all versions prior to 4.3.18 | ||
| CVE-2025-26074 | Cri | 0.57 | 9.8 | 0.01 | Jun 30, 2025 | Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes. | ||
| CVE-2024-5023 | Cri | 0.54 | — | 0.01 | May 16, 2024 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Netflix ConsoleMe allows Command Injection.This issue affects ConsoleMe: before 1.4.0. | ||
| CVE-2015-7764 | Hig | 0.42 | 7.5 | 0.02 | Aug 9, 2017 | Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode. | ||
| CVE-2017-7266 | Med | 0.33 | 6.1 | 0.01 | Mar 26, 2017 | Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespective of the Host header. | ||
| CVE-2023-40171 | 0.00 | — | 0.01 | Aug 17, 2023 | Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the `Dispatch Plugin - Basic Authentication Provider` plugin encounters an error when attempting to decode a JWT token.… | |||
| CVE-2023-30797 | 0.00 | — | 0.01 | Apr 19, 2023 | Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur. | |||
| CVE-2021-20172 | 0.00 | — | 0.00 | Dec 30, 2021 | All known versions of the Netgear Genie Installer for macOS contain a local privilege escalation vulnerability. The installer of the macOS version of Netgear Genie handles certain files in an insecure way. A malicious actor who has local access to the endpoint on which the… | |||
| CVE-2020-9299 | 0.00 | — | 0.01 | Nov 9, 2020 | There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting name and description parameters of Incident Priority, Incident Type, Tag Type, and Incident Filter. This vulnerability can be exploited by an authenticated user. | |||
| CVE-2020-9300 | 0.00 | — | 0.01 | Nov 9, 2020 | The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin, users adding themselves as a participant in a restricted incident, and users able to view restricted incidents via the search feature. If your install has… | |||
| CVE-2020-9297 | 0.00 | — | 0.02 | Jul 14, 2020 | Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker… | |||
| CVE-2020-9296 | 0.00 | — | 0.02 | Jun 16, 2020 | Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message… | |||
| CVE-2016-11058 | 0.00 | — | 0.01 | Apr 28, 2020 | The NETGEAR genie application before 2.4.34 for Android is affected by mishandling of hard-coded API keys and session IDs. | |||
| CVE-2019-10028 | 0.00 | — | 0.01 | Jun 21, 2019 | Denial of Service (DOS) in Dial Reference Source Code Used before June 18th, 2019. |
- risk 0.61cvss —epss 0.01
Dispatch's notification service uses Jinja templates to generate messages to users. Jinja permits code execution within blocks, which were neither properly sanitized nor sandboxed. This vulnerability enables users to construct command line scripts in their custom message…
- risk 0.59cvss 9.9epss 0.25
A path traversal issue potentially leading to remote code execution in Genie for all versions prior to 4.3.18
- risk 0.57cvss 9.8epss 0.01
Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes.
- risk 0.54cvss —epss 0.01
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Netflix ConsoleMe allows Command Injection.This issue affects ConsoleMe: before 1.4.0.
- risk 0.42cvss 7.5epss 0.02
Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.
- risk 0.33cvss 6.1epss 0.01
Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespective of the Host header.
- CVE-2023-40171Aug 17, 2023risk 0.00cvss —epss 0.01
Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the `Dispatch Plugin - Basic Authentication Provider` plugin encounters an error when attempting to decode a JWT token.…
- CVE-2023-30797Apr 19, 2023risk 0.00cvss —epss 0.01
Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur.
- CVE-2021-20172Dec 30, 2021risk 0.00cvss —epss 0.00
All known versions of the Netgear Genie Installer for macOS contain a local privilege escalation vulnerability. The installer of the macOS version of Netgear Genie handles certain files in an insecure way. A malicious actor who has local access to the endpoint on which the…
- CVE-2020-9299Nov 9, 2020risk 0.00cvss —epss 0.01
There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting name and description parameters of Incident Priority, Incident Type, Tag Type, and Incident Filter. This vulnerability can be exploited by an authenticated user.
- CVE-2020-9300Nov 9, 2020risk 0.00cvss —epss 0.01
The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin, users adding themselves as a participant in a restricted incident, and users able to view restricted incidents via the search feature. If your install has…
- CVE-2020-9297Jul 14, 2020risk 0.00cvss —epss 0.02
Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker…
- CVE-2020-9296Jun 16, 2020risk 0.00cvss —epss 0.02
Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message…
- CVE-2016-11058Apr 28, 2020risk 0.00cvss —epss 0.01
The NETGEAR genie application before 2.4.34 for Android is affected by mishandling of hard-coded API keys and session IDs.
- CVE-2019-10028Jun 21, 2019risk 0.00cvss —epss 0.01
Denial of Service (DOS) in Dial Reference Source Code Used before June 18th, 2019.