Netflix records
18 published records for vendor netflix.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 3
- With a fix record
- 61.1%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-330 Use of Insufficiently Random Values2
- CWE-862 Missing Authorization2
- CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')2
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')1
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1
The weakness classes this vendor ships most often: where to look.
CWEBug bounty scope
The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.
All records
18 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
46Plan | CVE-2024-4701Proof of concept | Path Traversal vulnerability via File Uploads in Genienetflix · genie · CWE-22 | Critical9.9 | — | 24.6% | May 14, 2024 |
40Plan | CVE-2022-27177No exploit | A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to netflix · consoleme · CWE-134 | Critical9.8 | — | 2.2% | Apr 1, 2022 |
40Plan | CVE-2020-9297No exploit | Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation (JSR 380) custom constraint validators.netflix · titus · CWE-917 | Critical9.8 | — | 1.8% | Jul 14, 2020 |
40Plan | CVE-2020-9296No exploit | Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators.netflix · conductor · CWE-917 | Critical9.8 | — | 1.6% | Jun 16, 2020 |
37Monitor | CVE-2024-5023No exploit | Arbitrary File Read Vulnerability in ConsoleMe via Limited Git command RCEnetflix · consoleme · CWE-77 | Critical9.3 | — | 0.9% | May 16, 2024 |
37Monitor | CVE-2024-7093No exploit | Server-Side Template Injection in Dispatch Message Templatesnetflix · dispatch · CWE-94 | Critical9.4 | — | 0.5% | Aug 1, 2024 |
34Monitor | CVE-2024-9301No exploit | A path traversal issue in E2Nest prior to commit 8a41948e553c89c56b14410c6ed395e9cfb9250anetflix · e2nest · CWE-22 | High8.7 | — | 0.6% | Sep 27, 2024 |
30Monitor | CVE-2015-7764No exploit | Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.netflix · lemur · CWE-331 | High7.5 | — | 1.5% | Aug 9, 2017 |
30Monitor | CVE-2020-2322No exploit | Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Renetflix · chaos monkey · CWE-862 | High7.5 | — | 1.3% | Dec 3, 2020 |
30Monitor | CVE-2019-10028No exploit | Denial of Service (DOS) in Dial Reference Source Code Used before June 18th, 2019.netflix · dial reference | High7.5 | — | 1.1% | Jun 21, 2019 |
30Monitor | CVE-2023-40171No exploit | Dispatch writes JWT tokens in error messagenetflix · dispatch · CWE-209 | High7.5 | — | 0.9% | Aug 17, 2023 |
30Monitor | CVE-2023-30797No exploit | Insecure Random Generation in Netflix Lemurnetflix · lemur · CWE-330 | High7.5 | — | 0.7% | Apr 19, 2023 |
26Monitor | CVE-2020-9300No exploit | The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin, users adding themselnetflix · dispatch | Medium6.5 | — | 0.9% | Nov 9, 2020 |
24Monitor | CVE-2017-7266No exploit | Netflix Security Monkey before 0.8.0 has an Open Redirect.netflix · security monkey · CWE-601 | Medium6.1 | — | 0.9% | Mar 26, 2017 |
22Monitor | CVE-2021-28100No exploit | Priam uses File.createTempFile, which gives the permissions on that file -rw-r--r--.netflix · priam | Medium5.5 | — | 0.2% | Mar 23, 2021 |
21Monitor | CVE-2020-2323No exploit | Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read pernetflix · chaos monkey · CWE-862 | Medium5.3 | — | 0.8% | Dec 3, 2020 |
21Monitor | CVE-2020-9299No exploit | There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting name and description parameters of Incident Prnetflix · dispatch · CWE-79 | Medium5.4 | — | 0.5% | Nov 9, 2020 |
17Monitor | CVE-2021-28099No exploit | In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories wnetflix · hollow · CWE-330 | Medium4.4 | — | 0.2% | Mar 23, 2021 |
- CVE-2024-470146Plan
Path Traversal vulnerability via File Uploads in Genie
CriticalCVSS 9.9Proof of conceptEPSS 24%netflix · genieMay 14, 2024
- CVE-2022-2717740Plan
A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to
CriticalCVSS 9.8No exploitEPSS 2%netflix · consolemeApr 1, 2022
- CVE-2020-929740Plan
Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation (JSR 380) custom constraint validators.
CriticalCVSS 9.8No exploitEPSS 1%netflix · titusJul 14, 2020
- CVE-2020-929640Plan
Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators.
CriticalCVSS 9.8No exploitEPSS 1%netflix · conductorJun 16, 2020
- CVE-2024-502337Monitor
Arbitrary File Read Vulnerability in ConsoleMe via Limited Git command RCE
CriticalCVSS 9.3No exploitEPSS 0%netflix · consolemeMay 16, 2024
- CVE-2024-709337Monitor
Server-Side Template Injection in Dispatch Message Templates
CriticalCVSS 9.4No exploitEPSS 0%netflix · dispatchAug 1, 2024
- CVE-2024-930134Monitor
A path traversal issue in E2Nest prior to commit 8a41948e553c89c56b14410c6ed395e9cfb9250a
HighCVSS 8.7No exploitEPSS 0%netflix · e2nestSep 27, 2024
- CVE-2015-776430Monitor
Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.
HighCVSS 7.5No exploitEPSS 1%netflix · lemurAug 9, 2017
- CVE-2020-232230Monitor
Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Re
HighCVSS 7.5No exploitEPSS 1%netflix · chaos monkeyDec 3, 2020
- CVE-2019-1002830Monitor
Denial of Service (DOS) in Dial Reference Source Code Used before June 18th, 2019.
HighCVSS 7.5No exploitEPSS 1%netflix · dial referenceJun 21, 2019
- CVE-2023-4017130Monitor
Dispatch writes JWT tokens in error message
HighCVSS 7.5No exploitEPSS 0%netflix · dispatchAug 17, 2023
- CVE-2023-3079730Monitor
Insecure Random Generation in Netflix Lemur
HighCVSS 7.5No exploitEPSS 0%netflix · lemurApr 19, 2023
- CVE-2020-930026Monitor
The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin, users adding themsel
MediumCVSS 6.5No exploitEPSS 0%netflix · dispatchNov 9, 2020
- CVE-2017-726624Monitor
Netflix Security Monkey before 0.8.0 has an Open Redirect.
MediumCVSS 6.1No exploitEPSS 0%netflix · security monkeyMar 26, 2017
- CVE-2021-2810022Monitor
Priam uses File.createTempFile, which gives the permissions on that file -rw-r--r--.
MediumCVSS 5.5No exploitEPSS 0%netflix · priamMar 23, 2021
- CVE-2020-232321Monitor
Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read per
MediumCVSS 5.3No exploitEPSS 0%netflix · chaos monkeyDec 3, 2020
- CVE-2020-929921Monitor
There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting name and description parameters of Incident Pr
MediumCVSS 5.4No exploitEPSS 0%netflix · dispatchNov 9, 2020
- CVE-2021-2809917Monitor
In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories w
MediumCVSS 4.4No exploitEPSS 0%netflix · hollowMar 23, 2021