CWE-93 · CRLF Injection (page 3)
Page 3 of 3 — CVEs classified under CWE-93, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-7472 | Medium | 6.5 | 2024-10-29 | lunary-ai/lunary v1.2.26 contains an email injection vulnerability in the Send email verification API (/v1/users/send-verification) and Sign up API (/auth/sign… |
CVE-2024-45597 | Medium | 5.3 | 2024-09-10 | Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. Scripts passing user-controlled values to http.request header values are affected… |
CVE-2024-45302 | Medium | 6.1 | 2024-08-29 | RestSharp is a Simple REST and HTTP API Client for .NET. The second argument to `RestRequest.AddHeader` (the header value) is vulnerable to CRLF injection. The… |
CVE-2024-40324 | Medium | 5.4 | 2024-07-25 | A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return (CR) and Line Feed (LF) characters into input fields, leading to HTTP… |
CVE-2024-36459 | | 2024-06-14 | A CRLF cross-site scripting vulnerability has been identified in certain configurations of the SiteMinder Web Agent for IIS Web Server and SiteMinder Web Agent… | |
CVE-2023-38551 | High | 8.2 | 2024-05-31 | A CRLF Injection vulnerability in Ivanti Connect Secure (9.x, 22.x) allows an authenticated high-privileged user to inject malicious code on a victim’s browser… |
CVE-2024-5193 | Medium | 5.3 | 2024-05-22 | A security vulnerability has been detected in Ritlabs TinyWeb Server 1.94. This vulnerability affects unknown code of the component Request Handler. The manipu… |
CVE-2024-32986 | Critical | 9.6 | 2024-05-03 | PWAsForFirefox is a tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox. Due to improper sanitization of web app properties (such as… |
CVE-2024-1226 | High | 7.5 | 2024-03-12 | The software does not neutralize or incorrectly neutralizes certain characters before the data is included in outgoing HTTP headers. The inclusion of invalidat… |
CVE-2024-20337 | High | 8.2 | 2024-03-06 | A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line fee… |
CVE-2023-49082 | Medium | 5.3 | 2023-11-29 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP reques… |
CVE-2023-4768 | Medium | 6.1 | 2023-11-03 | A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inje… |
CVE-2023-4767 | Medium | 6.1 | 2023-11-03 | A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inje… |
CVE-2023-26148 | Medium | 5.4 | 2023-09-29 | All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attacker can add the \r… |
CVE-2023-26138 | Medium | 5.4 | 2023-07-06 | All versions of the package drogonframework/drogon are vulnerable to CRLF Injection when untrusted user input is used to set request headers in the addHeader f… |
CVE-2023-34472 | Medium | 5.7 | 2023-07-05 | AMI SPx contains a vulnerability in the BMC where an Attacker may cause an improper neutralization of CRLF sequences in HTTP Headers. A successful exploit of t… |
CVE-2023-26130 | High | 7.5 | 2023-05-30 | Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in… |
CVE-2023-23936 | Medium | 6.5 | 2023-02-16 | Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from… |
CVE-2023-0040 | High | 7.5 | 2023-01-18 | Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the resul… |
CVE-2022-35948 | Medium | 5.3 | 2022-08-15 | undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized inp… |
CVE-2022-31150 | Medium | 5.3 | 2022-07-19 | undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5… |
CVE-2022-31014 | Medium | 5.4 | 2022-07-05 | Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on w… |
CVE-2022-0666 | High | 7.5 | 2022-02-18 | CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11. |
CVE-2021-4097 | Medium | 5.4 | 2021-12-12 | phpservermon is vulnerable to Improper Neutralization of CRLF Sequences |
CVE-2021-39172 | High | 8.8 | 2021-08-27 | Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can exploit a new lin… |
CVE-2021-31164 | High | 7.5 | 2021-05-04 | Apache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements. |
CVE-2020-3561 | Medium | 4.7 | 2020-10-21 | A vulnerability in the Clientless SSL VPN (WebVPN) of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could… |
CVE-2020-15111 | Medium | 4.2 | 2020-07-20 | In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable… |
CVE-2020-11078 | Medium | 6.8 | 2020-05-20 | In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send addi… |
CVE-2020-3246 | Medium | 4.3 | 2020-05-06 | A vulnerability in the web server of Cisco Umbrella could allow an unauthenticated, remote attacker to perform a carriage return line feed (CRLF) injection att… |
CVE-2019-15616 | Medium | 4.3 | 2020-02-04 | Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long. |
CVE-2017-18587 | Medium | 5.3 | 2019-08-26 | An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers. |
CVE-2016-10803 | High | 7.5 | 2019-08-07 | cPanel before 57.9999.105 allows newline injection via LOC records (CPANEL-6923). |
CVE-2018-6148 | Medium | 6.5 | 2019-06-27 | Incorrect implementation in Content Security Policy in Google Chrome prior to 67.0.3396.79 allowed a remote attacker to bypass navigation restrictions via a cr… |
CVE-2018-19585 | High | 7.5 | 2019-05-17 | GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirroring when using the Gi… |
CVE-2019-10272 | Medium | 6.1 | 2019-04-30 | An issue was discovered in Weaver e-cology 9.0. There is a CRLF Injection vulnerability via the /workflow/request/ViewRequestForwardSPA.jsp isintervenor parame… |
CVE-2019-11236 | Medium | 6.1 | 2019-04-15 | In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. |
CVE-2019-10678 | High | 7.5 | 2019-03-31 | Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options. |
CVE-2019-9947 | Medium | 6.1 | 2019-03-23 | An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a u… |
CVE-2019-9741 | Medium | 6.1 | 2019-03-13 | An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument t… |
CVE-2019-9740 | Medium | 6.1 | 2019-03-13 | An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a u… |
CVE-2019-7313 | Medium | 6.1 | 2019-02-03 | www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. This affects… |
CVE-2018-12477 | Low | 3.5 | 2018-10-09 | A Improper Neutralization of CRLF Sequences vulnerability in Open Build Service allows remote attackers to cause deletion of directories by tricking obs-servic… |
CVE-2017-7528 | Medium | 5.2 | 2018-08-22 | Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For header allows internal… |
CVE-2018-12537 | Medium | 5.3 | 2018-08-14 | In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters f… |
CVE-2016-4975 | Medium | 6.1 | 2018-08-14 | Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32… |
CVE-2018-1000164 | High | 7.5 | 2018-04-18 | gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/… |
CVE-2014-9563 | Medium | 4.9 | 2018-04-12 | CRLF injection vulnerability in the web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before… |
CVE-2017-15400 | High | 7.8 | 2018-02-07 | Insufficient restriction of IPP filters in CUPS in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker to execute a command with the same privileg… |
CVE-2014-2017 | Medium | 6.1 | 2018-01-18 | CRLF injection vulnerability in OXID eShop Professional Edition before 4.7.11 and 4.8.x before 4.8.4, Enterprise Edition before 5.0.11 and 5.1.x before 5.1.4… |
CVE-2017-14037 | Medium | 6.1 | 2017-08-30 | CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability. |
CVE-2014-9564 | Medium | 6.1 | 2017-08-25 | CRLF injection vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware before 3.4.1110 allows remote attackers to inje… |
CVE-2015-9097 | Medium | 6.1 | 2017-06-12 | The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM comman… |
CVE-2015-9096 | Medium | 6.1 | 2017-06-12 | Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences… |
CVE-2017-5868 | Medium | 6.1 | 2017-05-26 | CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently cond… |
CVE-2017-8791 | Medium | 6.1 | 2017-05-05 | An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is a home/seos/courier/login.html auth_params CRLF attack vector. |
CVE-2017-8788 | Medium | 6.1 | 2017-05-05 | An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is a CRLF vulnerability in settings_global_text_edit.php allowing ?display=x%0Dnewl… |
CVE-2017-2111 | Medium | 6.1 | 2017-04-28 | HTTP header injection vulnerability in TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2 firmware version 1.00, TS-WLCE firmware version 1.18 and earlier… |
CVE-2017-6508 | Medium | 6.1 | 2017-03-07 | CRLF injection vulnerability in the url_parse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF sequen… |
CVE-2016-6484 | Medium | 6.1 | 2017-01-23 | CRLF injection vulnerability in Infoblox Network Automation NetMRI before 7.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP respo… |
CVE-2016-9964 | Medium | 6.5 | 2016-12-16 | redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: nam… |
CVE-2016-4993 | Medium | 6.1 | 2016-09-26 | CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, all… |
CVE-2016-5331 | Medium | 6.1 | 2016-08-08 | CRLF injection vulnerability in VMware vCenter Server 6.0 before U2 and ESXi 6.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP resp… |
CVE-2016-3115 | Medium | 6.4 | 2016-03-22 | Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrict… |
CVE-2015-0770 | | 2015-06-07 | CRLF injection vulnerability in Cisco TelePresence TC 6.x before 6.3.4 and 7.x before 7.3.3 on Integrator C SX20 devices allows remote attackers to inject arbi… | |
CVE-2007-0892 | | 2007-02-12 | CRLF injection vulnerability in phpMyVisites before 2.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks vi… |