CVE Program partner

netflix

Netflix, Inc.

API
CVEs, 365 days024 all time, 10 rejected
Quality-median 99%
CVSS by the CNA-share of records
CWE-share of records
Affected versions-not n/a or unspecified
CVSS added by CISA-lower is better
OrganisationNetflix, Inc.
RoleCNA
TypeVendor, Open Source
Reports tomitre
ScopeCurrent versions of Netflix Mobile Streaming Application for iOS, Android, and Windows Mobile, plus all Netflix Open Source projects hosted on <a href='https://github.com/Netflix/' target='_blank'>https://github.com/Netflix/</a> and <a href='https://github.com/spinnaker/' target='_blank'>https://github.com/spinnaker/</a>.
Advisorieshttps://github.com/Netflix/security-bulletins

Latest CVEs · RSS

  • CVE-2024-9301 2024-09-27 · CVSS 8.7
    A path traversal issue in E2Nest prior to commit 8a41948e553c89c56b14410c6ed395e9cfb9250a
  • CVE-2024-7093 2024-08-01 · CVSS 9.4
    Dispatch's notification service uses Jinja templates to generate messages to users. Jinja permits code execution within blocks, which were neither properly sani
  • CVE-2024-5023 2024-05-16 · CVSS 9.3
    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Netflix ConsoleMe allows Command Injection.This issue affec
  • CVE-2024-4701 2024-05-10 · CVSS 9.9
    A path traversal issue potentially leading to remote code execution in Genie for all versions prior to 4.3.18
  • CVE-2022-27177 2022-04-01
    A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to 1.2.2
  • CVE-2021-28099 2021-03-23
    In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions
  • CVE-2021-28100 2021-03-23
    Priam uses File.createTempFile, which gives the permissions on that file -rw-r--r--. An attacker with read access to the local filesystem can read anything writ
  • CVE-2020-9301 2020-12-11
    Nolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all versions prior to version 1.23.4, 1.22.4 or 1.21.5. The vulnerab
  • CVE-2020-9299 2020-11-09
    There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting name and description parameters of Incident Priority, Incident Typ
  • CVE-2020-9300 2020-11-09
    The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin, users adding themselves as a participant
  • CVE-2020-9298 2020-08-28
    The Spinnaker template resolution functionality is vulnerable to Server-Side Request Forgery (SSRF), which allows an attacker to send requests on behalf of Spin
  • CVE-2020-9297 2020-07-14
    Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint vi
  • CVE-2020-9296 2020-06-16
    Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of int
  • CVE-2019-10028 2019-06-21
    Denial of Service (DOS) in Dial Reference Source Code Used before June 18th, 2019.

All CVE Program partners