CVE-2026-44305 | Medium | 6.8 | 2026-05-12 | Lemur manages TLS certificate creation. Prior to 1.9.0, when LDAP TLS is enabled (LDAP_USE_TLS = True), Lemur's LDAP authentication module unconditionally disa… |
CVE-2026-44304 | High | 8.1 | 2026-05-12 | Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitize… |
CVE-2024-9301 | High | 7.5 | 2024-09-27 | A path traversal issue in E2Nest prior to commit 8a41948e553c89c56b14410c6ed395e9cfb9250a |
CVE-2024-7093 | | | 2024-08-01 | Dispatch's notification service uses Jinja templates to generate messages to users. Jinja permits code execution within blocks, which were neither properly san… |
CVE-2024-5023 | | | 2024-05-16 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Netflix ConsoleMe allows Command Injection.This issue affe… |
CVE-2024-4701 | Critical | 9.9 | 2024-05-14 | A path traversal issue potentially leading to remote code execution in Genie for all versions prior to 4.3.18 |
CVE-2023-40171 | Critical | 9.1 | 2023-08-17 | Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when… |
CVE-2023-30797 | High | 7.5 | 2023-04-19 | Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacke… |
CVE-2022-27177 | Critical | 9.8 | 2022-04-01 | A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to 1.2.2 |
CVE-2021-28100 | Medium | 5.5 | 2021-03-23 | Priam uses File.createTempFile, which gives the permissions on that file -rw-r--r--. An attacker with read access to the local filesystem can read anything wri… |
CVE-2021-28099 | Medium | 4.4 | 2021-03-23 | In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permission… |
CVE-2020-2323 | Medium | 5.3 | 2020-12-03 | Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read permission to access t… |
CVE-2020-2322 | High | 7.5 | 2020-12-03 | Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to ge… |
CVE-2020-9300 | Medium | 6.5 | 2020-11-09 | The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin, users adding themselves as a participan… |
CVE-2020-9299 | Medium | 5.4 | 2020-11-09 | There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting name and description parameters of Incident Priority, Incident Ty… |
CVE-2020-9297 | Critical | 9.8 | 2020-07-14 | Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint v… |
CVE-2020-9296 | Critical | 9.8 | 2020-06-16 | Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of in… |
CVE-2019-10028 | High | 7.5 | 2019-06-21 | Denial of Service (DOS) in Dial Reference Source Code Used before June 18th, 2019. |
CVE-2015-7764 | High | 7.5 | 2017-08-09 | Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode. |
CVE-2017-7266 | Medium | 6.1 | 2017-03-26 | Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespecti… |