CWE-93: CRLF Injection
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Also known as Improper Neutralization of CRLF Sequences.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- silex technology, inc. amc manager, sd-330ac, silextechnology sd-330ac firmware +2 moreSD-330AC and AMC Manager provided by silex technology, Inc. contain an improper neutralization of...6.9 Medium
- phpunit project phpunitPHPUnit: Argument injection via newline in PHP INI values forwarded to child processes7.8 High
- openfind mailaudit, mailgates +1 moreOpenfind｜MailGates/MailAudit - CRLF Injection8.7 High
- froxlorFroxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()8.5 High
- schneider electric powerchute™ serial shutdown, schneider-electric powerchute serial shutdown +1 moreCWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability exists that...5.3 Medium
- patrickjuchli basic-ftpbasic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering7.5 High
- python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreHTTP client proxy tunnel headers not validated for CR/LF5.7 Medium
- go-vikunja vikunjaVikunja has an iCalendar Property Injection via CRLF in CalDAV Task Output4.1 Medium
- aosc-dev omaoma-topic: name Field in Topic Manifests (topic.json) May Allow CRLF Injection5.2 Medium
- patrickjuchli basic-ftp, red hat developer hub 1.8, developer hub 1.9 +3 more +5 moreFTP Command Injection via CRLF in basic-ftp8.6 High
- nodemailerNodemailer before 8.0.5 SMTP Command Injection via CRLF6.9 Medium
- ci4-cms-erp ci4msCI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller8.1 High
- pi-hole ftl, ftldns +1 morePi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection8.8 High
- pi-hole ftl, ftldns +1 morePi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection8.8 High
- pi-hole ftl, ftldns +1 morePi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection8.8 High
- pi-hole ftl, ftldns +1 morePi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection8.8 High
- pi-hole ftl, ftldns +1 morePi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection8.8 High
- useplunk plunkPlunk has a CRLF Email Header Injection in raw MIME message construction allows authenticated API user to inject arbitrary email headers8.5 High
- rackRack: Header injection in multipart requests4.8 Medium
- softaculous page builder: pagelayer – drag and drop website builderPagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'5.3 Medium
- nodemailerNodemailer before 8.0.4 SMTP Command Injection via envelope.size9.3 Critical
- cisco ios xe softwareA vulnerability in the web-based Cisco IOx application hosting environment management interface...5.3 Medium
- icalendariCalendar has ICS injection via unsanitized URI property values4.3 Medium
- f5 nginx open source, nginx plus +1 moreNGINX ngx_mail_proxy_module vulnerability6.3 Medium
- h3h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields7.5 High
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: http header injection and response splitting via crlf injection in content-type header3.9 Low
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: header and http request injection via crlf injection3.9 Low
- nodejs undiciundici is vulnerable to CRLF Injection via upgrade option4.6 Medium
- red hat enterprise linux 10, enterprise linux 9, jboss core services +2 moreMod_proxy_cluster: mod_proxy_cluster: response body corruption via crlf injection4.3 Medium
- gitlabImproper Neutralization of CRLF Sequences ('CRLF Injection') in GitLab5.0 Medium
- maximmasiutin tinywebTinyWeb: HTTP Header Control Character Injection into CGI Environment9.2 Critical
- jstedfast mimekitMimeKit: CRLF Injection in Quoted Local-Part Enables SMTP Command Injection and Email Forgery6.9 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreGvfs: ftp gvfs backend: arbitrary ftp command injection via crlf sequences in file paths4.3 Medium
- devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement pluginShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action8.6 High
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: http header injection or response splitting via crlf injection in content-disposition header5.8 Medium
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: http header injection via specially crafted urls when an http proxy is configured5.8 Medium
- happyhackingspace gakidoGakido vulnerable to HTTP Header Injection (CRLF Injection)5.3 Medium
- python software foundation cpythonemail BytesGenerator header injection due to unquoted newlines6.0 Medium
- linuxcontainers incusIncus container environment configuration newline injection8.7 High
- python software foundation cpythonHeader injection in http.cookies.Morsel6.0 Medium
- python software foundation cpythonHeader injection via newlines in data URL mediatype6.0 Medium
- python software foundation cpythonFolding email comments of unfoldable characters doesn't preserve parenthesis5.7 Medium
- axllent mailpitMailpit has SMTP Header Injection via Regex Bypass5.3 Medium
- neoteroi blacksheepBlackSheep ClientSession is vulnerable to CRLF injection6.3 Medium
- comfy comfyui-managerComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler7.5 High
- yhirose cpp-httplibcpp-httplib has CRLF injection in http headers7.7 High
- kentico xperienceKentico Xperience <= 13.0.79 Routing Engine CRLF Injection6.9 Medium
- carmelo rental management systemcode-projects Rental Management System Log Transaction.java crlf injection5.3 Medium
- fortinet fortimailAn improper neutralization of crlf sequences ('crlf injection') in Fortinet FortiMail 7.6.0...3.9 Low
- com.ritense.valtimo web, pi-hole web interface +1 morePi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injection8.2 High
- Show moreLoading…