CWE-93: CRLF Injection
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Also known as Improper Neutralization of CRLF Sequences.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- keenetic keeneticosCRLF-injection in KeeneticOS before 4.3 at "/auth" API endpoint allows attackers to take over the...6.5 Medium
- oracle configurator, e-business suite +1 moreVulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime...7.5 High
- No product listedA CRLF injection vulnerability in Neto CMS v6.313.0 through v6.314.0 allows attackers to execute...8.8 High
- python-hyper h2h2 allows HTTP Request Smuggling due to illegal characters in headers6.9 Medium
postgresqlAlmaLinux,libpqopenEuler,pgauditAlmaLinux +54 more +56 morePostgreSQL pg_dump newline in object name executes arbitrary code in psql client and in restore target server8.8 High- keycloak, red hat build of keycloak, build of keycloak 26.0 +1 more +3 moreOrg.keycloak/keycloak-services: keycloak smtp inject vulnerability5.3 Medium
- limesurvey, tesi gandia integra total +1 moreCRLF Injection in Limesurvey5.1 Medium
- dece software geodiCRLF Injection in DECE Software's Geodi7.2 High
- ivanti connect secure, policy secure +1 moreCLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before...6.6 Medium
- esp32async espasyncwebserverESPAsyncWebServer Vulnerable to CRLF Injection in AsyncWebHeader.cpp8.7 High
- juliaweb http.jlHTTP.jl vulnerable to CR/LF Injection in URIs7.7 High
- brother industries, ltd ads-2400n, ads-2800w, ads-3000n +698 more +700 moreUnauthenticated Server Side Request Forgery (SSRF) via WS-Eventing affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, and Toshiba Tec, and Konica Minolta, Inc…5.3 Medium
- freescoutFreeScout Has Insufficient Protection Against CRLF-injection7.0 High
- aes multimedia gestnetSQL injection vulnerability in AES Multimedia's Gestnet9.3 Critical
- qnap qts, quts hero +1 moreQTS, QuTS hero7.1 High
- qnap qts, quts hero +1 moreQTS, QuTS hero5.1 Medium
- rackEscape Sequence Injection vulnerability in Rack lead to Possible Log Injection6.9 Medium
- rackPossible Log Injection in Rack::CommonLogger5.7 Medium
Umbraco.Headless.Client.NetNuGetThe Umbraco Heartcore headless client library uses a vulnerable Refit dependency packageNo score- qnap qts, quts hero +1 moreQTS, QuTS hero8.7 High
- qnap qts, quts hero +1 moreQTS, QuTS hero5.3 Medium
- reactiveui refitCRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes10.0 Critical
- lunary, lunary-ai lunary-ai/lunary +1 moreEmail Injection Vulnerability in lunary-ai/lunary5.3 Medium
- plutoPluto's http.request allows CR and LF in header values5.3 Medium
- restsharpCRLF Injection in RestSharp's `RestRequest.AddHeader` method6.1 Medium
- datex-soft e-staffA CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return (CR)...5.4 Medium
- broadcom symantec siteminderCross-Site Scripting Vulnerability in Symantec SiteMinder Web Agent8.4 High
- tornadoweb tornadoTornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient6.3 Medium
- ivanti connect secureA CRLF Injection vulnerability in Ivanti Connect Secure (9.x, 22.x) allows an authenticated high...8.2 High
- ritlabs tinyweb, tinyweb server +1 moreRitlabs TinyWeb Server Request crlf injection6.9 Medium
- filips123 pwasforfirefoxArbitrary code execution due to improper sanitization of web app properties in PWAsForFirefox9.7 Critical
- rejetto http file serverMultiple vulnerabilities in Rejetto's Http File Server7.5 High
- cisco secure clientA vulnerability in the SAML authentication process of Cisco Secure Client could allow an...8.2 High
- aio-libs aiohttpaiohttp's ClientSession is vulnerable to CRLF injection via method5.3 Medium
- manageengine desktop central, zohocorp manageengine desktop central +1 moreImproper Neutralization of CRLF Sequences in ManageEngine Desktop Central6.1 Medium
- manageengine desktop central, zohocorp manageengine desktop central +1 moreImproper Neutralization of CRLF Sequences in ManageEngine Desktop Central6.1 Medium
- nettyNetty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder5.7 Medium
- nettyNetty: STOMP CONNECT Frame Header Injection6.5 Medium
- nettyNetty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address5.5 Medium
- netty, io.netty netty-codec-redis +1 moreNetty: CRLF Injection in Netty Redis Codec Encoder6.8 Medium
- netty, red hat cryostat 4 on rhel 9, openshift serverless +32 more +34 moreNetty: HTTP Header Injection via HttpProxyHandler Disabled Validation2.9 Low
- nettyNetty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()5.3 Medium
- nettyNetty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder6.5 Medium
- nettyNetty netty-codec-smtp SMTP Command Injection Vulnerability Allowing Email Forgery5.5 Medium
- ithewei libhvAll versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user...5.4 Medium
- drogonAll versions of the package drogonframework/drogon are vulnerable to CRLF Injection when...5.4 Medium
- ami megarac sp-x, megarac spx +1 moreAMI SPx contains a vulnerability in the BMC where an Attacker may cause an improper...5.7 Medium
- cpp-httplib project cpp-httplibVersions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when...7.5 High
- nodejs node.js, undici +1 moreCRLF Injection in Nodejs ‘undici’ via host6.5 Medium
- swift project async http client, asynchttpclient project async-http-client +1 moreAsync HTTP Client has CRLF Injection vulnerability in HTTP request headers7.5 High
- Show moreLoading…