CWE-93: CRLF Injection
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Also known as Improper Neutralization of CRLF Sequences.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- nodejs undiciundici vulnerable to HTTP header injection via Set-Cookie percent-decoding5.9 Medium
- flarum frameworkCRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay8.9 High
- crawl4aiCrawl4AI - Arbitrary File Write via output_path Symlink and TOCTOU9.2 Critical
- aio-libs aiohttpAIOHTTP: CRLF injection in multipart headers2.7 Low
- nodemailerNodemailer before 9.1.0 Denial of Service via addressparser8.7 High
- cole aiosmtplibaiosmtplib: SMTP command injection via CR/LF in sender/recipient address6.9 Medium
- form-data, red hat cluster observability operator 1.5.0, cryostat 4 +77 more +79 moreform-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)8.7 High
github.com/apple/swift-nioSwiftURLSwiftNIO: CRLF Injection in outbound HTTP request URI via NIOHTTPRequestHeadersValidator6.3 Medium- apache cxfApache CXF: OAuth2: Log Injection via Unsanitized Client Identifier5.3 Medium
- guzzle psr7, guzzlephp psr-7 +1 moreguzzlehttp/psr7 has CRLF Injection via URI Host Component5.3 Medium
- pevans metrics::any::adapter::signalfx, metrics\ +1 moreMetrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections6.5 Medium
- pevans metrics::any::adapter::dogstatsd, metrics\ +1 moreMetrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections9.1 Critical
- pevans metrics::any::adapter::statsd, metrics\ +1 moreMetrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections8.2 High
- ruby net-imapNet::IMAP: Command Injection via ID command argument5.8 Medium
- ruby net-imapNet::IMAP: Command Injection via non-synchronizing literal in "raw" argument5.8 Medium
- wojtekmach reqMultipart form-data header injection in Req via unescaped name/filename/content_type2.1 Low
- binary datadog::dogstatsd, datadog\ +1 moreDataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags9.8 Critical
- binary datadog::dogstatsd, datadog\ +1 moreDataDog::DogStatsd versions through 0.07 for Perl allow metric injections9.1 Critical
- freedesktop libinputIn libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output...7.4 High
- sanbeg etsy::statsd, etsy\ +1 moreEtsy::StatsD versions through 1.002002 for Perl allow metric injections7.5 High
- cosimo net::statsd, net\ +1 moreNet::Statsd versions before 0.13 for Perl allow metric injections5.3 Medium
- team net::async::statsd::client, net\ +1 moreNet::Async::Statsd::Client versions through 0.005 for Perl allow metric injections6.5 Medium
- elixir-tesla teslaCRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection2.1 Low
- elixir-mint mintCRLF injection in HTTP/1 request line via unvalidated method in Mint2.1 Low
- yhirose cpp-httplibcpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection9.9 Critical
- musicplayerdaemon mpdMusic Player Daemon < 0.24.11 CRLF Injection via XspfPlaylistPlugin.cxx6.9 Medium
- go standard library mime, sensiolabs symfony +1 moreSymfony: Email Header Injection via Non-Token Characters in Mime Parameter Names6.3 Medium
- symfonySymfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address6.3 Medium
- rrwo mojolicious::plugin::statsdMojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections5.3 Medium
- benoitc hackneyCRLF injection in WebSocket upgrade request in hackney6.9 Medium
- benoitc hackneyCR/LF injection in query parameter in hackney6.8 Medium
- benoitc hackneyCRLF injection in cookie domain/path options in hackney2.1 Low
- rrwo net::statsd::liteNet::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections7.3 High
- rrwo net::statsd::tinyNet::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections8.2 High
- rrwo net::statsd::liteNet::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections6.5 Medium
- webpros cpanel, wp squared +1 moreImproper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint...8.3 High
- subnet solutions powersystem center 2020, powersystem center 2024, powersystem center 2026 +2 moreSubnet Solutions PowerSYSTEM Center CRLF injection5.1 Medium
- ninenines cowlibCR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/16.3 Medium
- ninenines cowlibCookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/12.1 Low
- rexxars eventsource-encodereventsource-encoder: SSE event injection via unsanitized event and id fields5.8 Medium
- rexxars sse-channelsse-channel: SSE Injection via unsanitized event fields6.6 Medium
- wwbn avideoWWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing4.3 Medium
- pi-hole ftl, ftldns +1 morePi-hole FTL remote code execution via newline injection in dns.interface configuration8.7 High
- sandboxie-plus sandboxieSandboxie-Plus privilege escalation via INI CRLF injection bypassing EditAdminOnly9.3 Critical
- ruby net-imap, ruby-lang net\ +1 morenet-imap: Command Injection via "raw" arguments to multiple commands5.8 Medium
- ruby net-imap, red hat 3scale api management platform 2, enterprise linux 10 +19 more +21 morenet-imap: Command Injection via unvalidated Symbol inputs5.8 Medium
- tubitak bilgem software technologies research institute pardus updateAuthorization Bypass in TUBITAK BILGEM's Pardus Update8.8 High
- axiosAxios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream5.3 Medium
phpunit/phpunitPackagistPHPUnit: Argument injection via newline in PHP INI values forwarded to child processes7.8 High- zinoui http headersHTTP Headers <= 1.19.2 - Authenticated (Administrator+) CRLF Injection via Custom Header Values5.5 Medium
- Show moreLoading…