CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

Parent: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

196 vulnerabilities with CWE-93
CVE-2024-50405 MEDIUM
QNAP OS <5.2.3.3006 - CRLF Injection
CVSS 5.5
CVE-2024-48868 HIGH
QNAP QTS and QuTS hero - CRLF Injection
CVSS 7.5
CVE-2024-48867 HIGH
QNAP QTS and QuTS hero - CRLF Injection
CVSS 7.5
CVE-2024-51501 CRITICAL
Refit < 7.2.22 - CRLF Injection via HTTP Header Manipulation
CVE-2024-7472 MEDIUM
lunary-ai/lunary <1.2.26 - Command Injection
CVSS 6.5
CVE-2024-45597 MEDIUM
Pluto http.request Headers - Arbitrary Request Dispatch
CVSS 5.3
CVE-2024-45302 MEDIUM
RestSharp 107.0.0-111.2.0 - CRLF Injection via AddHeader and AddDefaultHeader Methods
CVSS 6.1
CVE-2024-40324 MEDIUM
E-Staff <5.1 - HTTP Response Splitting
CVSS 5.4
CVE-2024-36459 HIGH
Symantec SiteMinder >=R12.52 SP1 CR11 <R12.52 SP1 CR11 and <R12.8 - Cross-Site Scripting via CRLF Injection
CVE-2024-5193 MEDIUM
Ritlabs TinyWeb Server <1.99 - CRLF Injection
CVSS 5.3
CVE-2024-32986 CRITICAL
PWAsForFirefox < 2.12.0 - Arbitrary Code Execution via XDG Desktop Entry Injection
CVSS 9.6
CVE-2024-1226 HIGH
Rejetto HTTP File Server 2.2a - HTTP Response Splitting
CVSS 7.5
CVE-2024-20337 HIGH
Cisco Secure Client - CRLF Injection
CVSS 8.2
CVE-2023-38551 HIGH
Ivanti Connect Secure 9.1R18.6-22.7R2 - Authenticated Cross-Site Scripting via CRLF Injection
CVSS 8.2
CVE-2023-49082 MEDIUM
aiohttp < 3.9.0 - HTTP Request Smuggling via CRLF Injection
CVSS 5.3
CVE-2023-4768 MEDIUM
ManageEngine Desktop Central <9.1.0 - CRLF Injection
CVSS 6.1
CVE-2023-4767 MEDIUM
ManageEngine Desktop Central <9.1.0 - CRLF Injection
CVSS 6.1
CVE-2023-26148 MEDIUM
ithewei libhv - CRLF Injection via Request Header Manipulation
CVSS 5.4
CVE-2023-26138 MEDIUM
drogonframework/drogon - CRLF Injection
CVSS 5.4
CVE-2023-34472 MEDIUM
AMI MegaRAC SPx BMC - HTTP Header Injection via CRLF Sequences
CVSS 5.7
CVE-2023-26130 HIGH
yhirose/cpp-httplib < 0.12.4 - CRLF Injection
CVSS 7.5
CVE-2023-23936 MEDIUM
Undici <5.19.1 - CRLF Injection
CVSS 6.5
CVE-2023-0040 HIGH
Async HTTP Client <1.13.2 - CRLF Injection
CVSS 7.5
CVE-2022-50682 MEDIUM
Kentico Xperience < 13.0.79 - CRLF Injection via Routing Engine
CVSS 6.5
CVE-2022-35948 MEDIUM
undici < 5.8.1 - CRLF Injection via Content-Type Header
CVSS 5.3
Details
Vulnerabilities 196
Links
MITRE CWE Entry Search this CWE With Exploits