Htmlunit
Monthly
Cross-site scripting in HtmlUnit Neko (htmlunit-neko) before 5.4.0 lets an unauthenticated remote attacker smuggle executable markup out of HTML sanitizers and content filters that use the library to serialize parsed HTML. HTMLWriterFilter fails to entity-encode decoded TEXTAREA and TITLE text, so entity-encoded markup supplied inside those elements is decoded on parse and re-emitted as literal markup by printCharacters(); output rendered by a victim's browser executes in that browser, which is why the CVSS 3.1 score of 7.2 (High) carries a scope change (S:C) on the vector AV:N/AC:L/PR:N/UI:N. The flaw is only reachable in a parse-transform-serialize pipeline that both relies on HTMLWriterFilter for its output and renders that output in a browser, and no public exploit code was identified at time of analysis; the issue is fixed in 5.4.0.
HtmlUnit is a GUI-less browser for Java programs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks (DoS). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Cross-site scripting in HtmlUnit Neko (htmlunit-neko) before 5.4.0 lets an unauthenticated remote attacker smuggle executable markup out of HTML sanitizers and content filters that use the library to serialize parsed HTML. HTMLWriterFilter fails to entity-encode decoded TEXTAREA and TITLE text, so entity-encoded markup supplied inside those elements is decoded on parse and re-emitted as literal markup by printCharacters(); output rendered by a victim's browser executes in that browser, which is why the CVSS 3.1 score of 7.2 (High) carries a scope change (S:C) on the vector AV:N/AC:L/PR:N/UI:N. The flaw is only reachable in a parse-transform-serialize pipeline that both relies on HTMLWriterFilter for its output and renders that output in a browser, and no public exploit code was identified at time of analysis; the issue is fixed in 5.4.0.
HtmlUnit is a GUI-less browser for Java programs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks (DoS). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.