CWE-93: CRLF Injection
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Also known as Improper Neutralization of CRLF Sequences.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- nodejs undiciCRLF Injection in Nodejs ‘undici’ via Content-Type5.3 Medium
- nodejs undiciUncleared cookies on cross-host/cross-origin redirect in undici3.7 Low
- nodejs undiciCRLF injection in request headers5.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreSMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud Server5.4 Medium
matrix-org-ircnpmImproper handling of multiline messages in node-irc8.0 High- synacor zimbra collaboration suite (zcs), zimbra collaboration suite +1 moreZimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject...7.5 High
- microweber, microweber microweber/microweber +1 moreCRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in microweber/microweber7.6 High
- phpservermon phpservermon/phpservermon, phpservermonitor php server monitor +1 moreCRLF Injection in phpservermon/phpservermon6.3 Medium
- cachethq cachet, catchethq catchet +1 moreNew line injection during configuration edition8.8 High
- apache unomiApache Unomi log injection7.5 High
- flutterchina diodio vulnerable to CRLF injection with HTTP method string7.5 High
- cisco adaptive security appliance, adaptive security appliance software, adaptive security appliance (asa) software +1 more +3 moreCisco Adaptive Security Appliance Software and Firepower Threat Defense Software WebVPN CRLF Injection Vulnerability4.7 Medium
- gofiber fiberCRLF vulnerability in Fiber4.2 Medium
- httplib2, debian linux, fedoraproject fedora +2 moreCRLF injection in httplib26.8 Medium
- cisco umbrellaCisco Umbrella Carriage Return Line Feed Injection Vulnerability4.7 Medium
- hackerone nextcloud server, nextcloud server +1 moreDangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long.4.3 Medium
- cpanelcPanel before 57.9999.105 allows newline injection via LOC records (CPANEL-6923).7.5 High
- twisted, canonical ubuntu linux, fedoraproject fedora +2 more +4 moreTwisted CRLF Injection6.1 Medium
- gitlabGitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11...7.5 High
- weaver e-cologyAn issue was discovered in Weaver e-cology 9.0. There is a CRLF Injection vulnerability via the ...6.1 Medium
- python urllib3Improper Neutralization of CRLF Sequences in urllib3 library for Python6.1 Medium
- domoticzDomoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.7.5 High
- python, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 moreAn issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through...6.1 Medium
- golang go, debian linux, fedoraproject fedora +2 more +4 moreAn issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker...6.1 Medium
- python, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 moreAn issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through...6.1 Medium
- buildbotBuildbot CRLF Injection6.1 Medium
- opensuse open build service, leap +1 moreobs-service-refresh_patches can be tricked into deleting '..' or other unrelated directories3.5 Low
- red hat ansible tower, redhat cloudforms management engine +1 moreAnsible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF...5.2 Medium
- eclipse vert.x, the eclipse foundation eclipse vert.x +1 moreModerate severity vulnerability that affects io.vertx:vertx-core5.3 Medium
- apache http servermod_userdir CRLF injection6.1 Medium
- google chromeIncorrect implementation in Content Security Policy in Google Chrome prior to 67.0.3396.79...6.5 Medium
- gunicorn, debian linux +1 moreGunicorn contains Improper Neutralization of CRLF sequences in HTTP headers7.5 High
- unify openstage sip, openscape desk phone ip sip +1 moreCRLF injection vulnerability in the web-based management (WBM) interface in Unify (former Siemens...4.9 Medium
- google chrome osInsufficient restriction of IPP filters in CUPS in Google Chrome OS prior to 62.0.3202.74 allowed...7.8 High
- oxidforge eshopCRLF injection vulnerability in OXID eShop Professional Edition before 4.7.11 and 4.8.x before 4...6.1 Medium
- crushftpCrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability.6.1 Medium
- ibm en6131 firmware, ib6131 firmware +1 moreCRLF injection vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband...6.1 Medium
- ruby-lang rubyNet::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a...6.1 Medium
- openvpn access serverCRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote...6.1 Medium
- accellion file transfer applianceAn issue was discovered on Accellion FTA devices before FTA_9_12_180. There is a home/seos...6.1 Medium
- accellion file transfer applianceAn issue was discovered on Accellion FTA devices before FTA_9_12_180. There is a CRLF...6.1 Medium
- i-o data device, inc. ts-ptcam/poe, ts-wlc2, ts-wlce +10 more +12 moreHTTP header injection vulnerability in TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2...6.1 Medium
- gnu wgetCRLF injection vulnerability in the url_parse function in url.c in Wget through 1.19.1 allows...6.1 Medium
- infoblox netmriCRLF injection vulnerability in Infoblox Network Automation NetMRI before 7.1.1 allows remote...6.1 Medium
- hyperHeaders containing newline characters can split messages in hyper5.3 Medium
- bottlepy bottle, debian linux +1 morebottle.py vulnerable to CRLF Injection6.5 Medium
- redhat jboss enterprise application platform, jboss wildfly application server +1 moreImproper Neutralization of CRLF Sequences in Wildfly Undertow6.1 Medium
- vmware esxi, vcenter server +1 moreCRLF injection vulnerability in VMware vCenter Server 6.0 before U2 and ESXi 6.0 allows remote...6.1 Medium
- mail project mailMail Gem CRLF Injection vulnerability6.1 Medium
- openbsd openssh, oracle vm server +1 moreMultiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote...6.4 Medium
- Show moreLoading…