CVE-2025-27111 Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection

Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences such as newline characters into the header, resulting in log injection. This vulnerability is fixed...

PT-2025-9682

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.12 Rack versions prior to 3.0.13 Rack versions prior to 3.1.11 Description The issue concerns the Rack::Sendfile middleware, which logs unsanitised header values from the X-Sendfile-Type header. An attacker can explo...

Rack 安全漏洞

Rack is a modular Ruby web server interface open-sourced by Rack. A security vulnerability exists in Rack versions prior to 2.2.12, prior to 3.0.13, and prior to 3.1.11, which stems from a log injection issue...

Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection

Summary Rack::Sendfile can be exploited by crafting input that includes newline characters to manipulate log entries. Details The Rack::Sendfile middleware logs unsanitized header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences such as newline...

CVE-2025-23405

Unauthenticated log effects metrics gathering incident response efforts and potentially exposes risk of injection attacks ex log injection...

CVE-2025-23405 Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Improper Output Neutralization For Logs

Unauthenticated log effects metrics gathering incident response efforts and potentially exposes risk of injection attacks ex log injection...

PT-2025-9116 · Dario Health · Dario Application Database/Internet-Based Server Infrastructure +1

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue affects metrics gathering and incident response efforts, potentially exposing the risk of injection attacks, such as log injection. Recommendations: At the moment, there is no...

Log Injection

Rack is vulnerable to Log Injection. The vulnerability is due to improper handling of user input in Rack::CommonLogger, which allows attackers to inject newline characters into log entries by crafting a username with CRLF and whitespace characters, potentially manipulating the log format or...

SUSE CVE-2025-25184

Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious conten...

Improper Output Neutralization for Logs

Overview rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between the so-called middleware into a singl...

Possible Log Injection in Rack::CommonLogger

Summary Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs. Details When a user provides the authorization credentials via Rack::Auth::Basic, if success,...

GHSA-7G2V-JJ9Q-G3RG Possible Log Injection in Rack::CommonLogger

Summary Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs. Details When a user provides the authorization credentials via Rack::Auth::Basic, if success,...

DEBIAN-CVE-2025-25184

Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious conten...

CVE-2025-25184

CVE-2025-25184 affects Rack (Ruby) where CRLF injection in usernames can be logged by Rack::CommonLogger when credentials are supplied via Rack::Auth::Basic. The issue enables log entry manipulation by including CRLF and whitespace in the username, potentially breaking log formats or injecting fr...

CVE-2025-25184 Possible Log Injection in Rack::CommonLogger

Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious conten...

CVE-2025-25184 Possible Log Injection in Rack::CommonLogger

Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious conten...

Possible Log Injection in Rack::CommonLogger

Summary Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs. Details When a user provides the authorization credentials via Rack::Auth::Basic, if success,...

IBM Maximo Application Suite Input Validation Error Vulnerability

IBM Maximo Application Suite is a single platform for intelligent asset management, monitoring, maintenance, computer vision, security and reliability from International Business Machines IBM. IBM Maximo Application Suite has an input validation error vulnerability that stems from not neutralizin...

BIT-SUPERSET-2021-42250 Possible log injection

Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious content into logs...

USN-7250-1: Netdata vulnerabilities

It was discovered that Netdata incorrectly handled parsing JSON input, which could lead to a JSON injection. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. CVE-2018-18836 It was discovered that Netdata incorrectly handled parsing HT...