The vulnerability of the QuTS operating systems and QTS network devices from Qnap, related to the failure to eliminate CRLF sequences, allows attackers to execute arbitrary code.

The vulnerability of the QuTS operating systems and QTS network devices involves a lack of measures to neutralize CRLF sequences. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

AZL-55644 CVE-2024-53263 affecting package git-lfs for versions less than 3.5.1-4

Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential1 command without checking for embedded line-ending control characters, and then sends any credentials it receives back fr...

Fortinet FortiOS和Fortinet FortiProxy 注入漏洞

Fortinet FortiOS and Fortinet FortiProxy are both products of Fortinet, Inc.Fortinet FortiOS is a dedicated security operating system on the FortiGate network security platform. The system provides users with a variety of security features such as firewall, antivirus, IPSec/SSLVPN, Web content...

CLSA-2024-1734704732 Fix CVE(s): CVE-2024-11234

SECURITY UPDATE: improper sanitization of URIs leading to HTTP request smuggling - debian/patches/CVE-2024-11234.patch: Fix HTTP wrapper full URI path to disallow CR or LF characters - CVE-2024-11234...

CLSA-2024-1734006823 php: Fix of CVE-2024-11234

CVE-2024-11234: Fix possibility of HTTP request smuggling in configured proxy URI by prohibiting CRLF injection...

The vulnerability of the CurlAsyncHTTPClient component in the asynchronous networking library Tornado allows a hacker to execute arbitrary code.

The vulnerability of the CurlAsyncHTTPClient component in the Tornado asynchronous networking library is related to the lack of measures taken to neutralize CRLF sequences. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending specially crafted HTTP requests ...

PYSEC-2024-313

OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Prior to version 6.1.9, the regex validation used to prevent Introspection queries can be bypassed by removing the extra whitespace, carriage return, and line feed...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection due to header-related attributes: Header, HeaderCollection and Authorize, through the HttpHeaders.TryAddWithoutValidation method. An attacker can manipulate HTTP headers or perform HTTP request smuggling. Notes: 1 This is...

The vulnerability of the undici.request method in the HTTP/1.1 client of the Undici software platform for Node.js allows attackers to inject arbitrary HTTP headers.

The vulnerability of the undici.request method in the Node.js software platform relates to the failure to handle CRLF sequences in HTTP headers. Exploiting this vulnerability allows a remote attacker to inject arbitrary HTTP headers...

The vulnerability of Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure, related to the failure to handle CRLF sequences properly, allows a violator to execute arbitrary code.

The vulnerability of Ivanti Connect Secure previously known as Pulse Connect Secure and Ivanti Policy Secure lies in the lack of measures to neutralize CRLF sequences. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary commands with root privileges by...

PT-2024-21020 · Dovecot · Dovecot

Name of the Vulnerable Software and Affected Versions: Dovecot affected versions not specified Description: The issue arises because Dovecot accepts the dot LF DOT LF symbol as the end of the DATA command, whereas the RFC requires it to be CR LF DOT CR LF. This discrepancy causes Dovecot to split...

PT-2024-28806 · E-Staff · E-Staff

Name of the Vulnerable Software and Affected Versions: E-Staff version 5.1 Description: A CRLF injection issue allows attackers to insert Carriage Return CR and Line Feed LF characters into input fields, leading to HTTP response splitting and header manipulation. Recommendations: For E-Staff...

The vulnerability in the implementation of the application software interface of the Cisco AsyncOS operating system of the Cisco Secure Email Gateway (formerly known as Cisco Email Security Appliance) allows a attacker to carry out XSS attacks.

The vulnerability of the application programming interface of the Cisco AsyncOS operating system in the Cisco Secure Email Gateway formerly Cisco Email Security Appliance security system is related to the failure to handle CRLF sequences in HTTP headers. Exploiting this vulnerability allows a...

Denial Of Service (DoS)

ZenML is vulnerable to a Denial Of Service DoS. The vulnerability is due to improper handling of line feed \n characters in component names, allowing an attacker to cause uncontrolled resource consumption by adding a component through an API endpoint api/v1/workspaces/default/components...

Improper line feed handling in zenml

A denial of service DoS vulnerability exists in zenml-io/zenml version 0.56.3 due to improper handling of line feed \n characters in component names. When a low-privileged user adds a component through the API endpoint api/v1/workspaces/default/components with a name containing a \n character, it...

PT-2024-31195

Name of the Vulnerable Software and Affected Versions zenml-io/zenml version 0.56.3 Description A denial of service issue exists due to improper handling of line feed characters in component names. When a low-privileged user adds a component through the API endpoint...

The vulnerability of Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure, related to the failure to handle CRLF sequences properly, allows a violator to execute arbitrary code.

The vulnerability of Ivanti Connect Secure previously known as Pulse Connect Secure and Ivanti Policy Secure lies in the lack of measures to neutralize CRLF sequences. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using specially crafted data containing the CRLF...

The vulnerability of the Cisco Secure Client (formerly Cisco AnyConnect Secure Mobility Client) endpoint security mechanism lies in the lack of measures to neutralize CRLF sequences, allowing attackers to execute arbitrary code in the browser.

The vulnerability of the Cisco Secure Client formerly Cisco AnyConnect Secure Mobility Client security mechanism is related to the failure to handle CRLF sequences properly. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the browser, provided that the user...

CLSA-2024-1709563071 Fix CVE(s): CVE-2023-51766

SECURITY UPDATE: SMTP smuggling because of . support - debian/patches/CVE-2023-51766.patch: reject "dot, LF" as ending data phase. Testcase for "smtp smuggling". - CVE-2023-51766...

CLSA-2024-1709562273 Fix CVE(s): CVE-2023-51766

SECURITY UPDATE: SMTP smuggling because of . support - debian/patches/CVE-2023-51766.patch: reject "dot, LF" as ending data phase. Testcase for "smtp smuggling". - CVE-2023-51766...