Total
280 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-4097 | 1 Phpservermonitor | 1 Php Server Monitor | 2026-06-17 | 5.8 MEDIUM | 5.4 MEDIUM |
| phpservermon is vulnerable to Improper Neutralization of CRLF Sequences | |||||
| CVE-2021-39172 | 1 Catchethq | 1 Catchet | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can exploit a new line injection in the configuration edition feature (e.g. mail settings) and gain arbitrary code execution on the server. This issue was addressed in version 2.5.1 by improving `UpdateConfigCommandHandler` and preventing the use of new lines characters in new configuration values. As a workaround, only allow trusted source IP addresses to access to the administration dashboard. | |||||
| CVE-2021-31164 | 1 Apache | 1 Unomi | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Apache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements. | |||||
| CVE-2020-3246 | 1 Cisco | 1 Umbrella | 2026-06-17 | 4.3 MEDIUM | 4.3 MEDIUM |
| A vulnerability in the web server of Cisco Umbrella could allow an unauthenticated, remote attacker to perform a carriage return line feed (CRLF) injection attack against a user of an affected service. The vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user to access a crafted URL. A successful exploit could allow the attacker to inject arbitrary HTTP headers into valid HTTP responses sent to the browser of the user. | |||||
| CVE-2020-15111 | 1 Gofiber | 1 Fiber | 2026-06-17 | 5.8 MEDIUM | 4.2 MEDIUM |
| In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link to the victim. With this filename, the attacker can change the name of the downloaded file, redirect to another site, change the authorization header, etc. A possible workaround is to serialize the input before passing it to ctx.Attachment(). | |||||
| CVE-2020-11078 | 3 Debian, Fedoraproject, Httplib2 Project | 3 Debian Linux, Fedora, Httplib2 | 2026-06-17 | 4.3 MEDIUM | 6.8 MEDIUM |
| In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0. | |||||
| CVE-2019-9741 | 4 Debian, Fedoraproject, Golang and 1 more | 5 Debian Linux, Fedora, Go and 2 more | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command. | |||||
| CVE-2019-7313 | 1 Buildbot | 1 Buildbot | 2026-06-17 | 5.8 MEDIUM | 6.1 MEDIUM |
| www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. This affects other web sites in the same domain. | |||||
| CVE-2019-15616 | 1 Nextcloud | 1 Nextcloud Server | 2026-06-17 | 4.0 MEDIUM | 4.3 MEDIUM |
| Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long. | |||||
| CVE-2019-11236 | 1 Python | 1 Urllib3 | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. | |||||
| CVE-2019-10678 | 1 Domoticz | 1 Domoticz | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options. | |||||
| CVE-2019-10272 | 1 Weaver | 1 E-cology | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in Weaver e-cology 9.0. There is a CRLF Injection vulnerability via the /workflow/request/ViewRequestForwardSPA.jsp isintervenor parameter, as demonstrated by the %0aSet-cookie: substring. | |||||
| CVE-2018-6148 | 1 Google | 1 Chrome | 2026-06-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| Incorrect implementation in Content Security Policy in Google Chrome prior to 67.0.3396.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. | |||||
| CVE-2018-19585 | 1 Gitlab | 1 Gitlab | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirroring when using the Git protocol. | |||||
| CVE-2018-12537 | 1 Eclipse | 1 Vert.x | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response. | |||||
| CVE-2018-12477 | 1 Opensuse | 1 Leap | 2026-06-17 | 6.4 MEDIUM | 3.5 LOW |
| A Improper Neutralization of CRLF Sequences vulnerability in Open Build Service allows remote attackers to cause deletion of directories by tricking obs-service-refresh_patches to delete them. Affected releases are openSUSE Open Build Service: versions prior to d6244245dda5367767efc989446fe4b5e4609cce. | |||||
| CVE-2018-1000164 | 2 Debian, Gunicorn | 2 Debian Linux, Gunicorn | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been fixed in 19.5.0. | |||||
| CVE-2017-8791 | 1 Accellion | 1 File Transfer Appliance | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is a home/seos/courier/login.html auth_params CRLF attack vector. | |||||
| CVE-2017-8788 | 1 Accellion | 1 File Transfer Appliance | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is a CRLF vulnerability in settings_global_text_edit.php allowing ?display=x%0Dnewline attacks. | |||||
| CVE-2017-7528 | 1 Redhat | 2 Ansible Tower, Cloudforms Management Engine | 2026-06-17 | 3.3 LOW | 5.2 MEDIUM |
| Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For header allows internal servers to deploy other systems (using callback). | |||||