Htmlunitproject Htmlunit
By the Year
In 2024 there have been 0 vulnerabilities in Htmlunitproject Htmlunit . Last year Htmlunit had 2 security vulnerabilities published. Right now, Htmlunit is on track to have less security vulnerabilities in 2024 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 2 | 8.65 |
| 2022 | 2 | 7.50 |
| 2021 | 0 | 0.00 |
| 2020 | 1 | 8.10 |
| 2019 | 0 | 0.00 |
| 2018 | 0 | 0.00 |
It may take a day or so for new Htmlunit vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Htmlunitproject Htmlunit Security Vulnerabilities
Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks (DoS)
CVE-2023-2798
7.5 - High
- May 25, 2023
Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks (DoS). If HtmlUnit is running on user supplied web pages, an attacker may supply content that causes HtmlUnit to crash by a stack overflow. This effect may support a denial of service attack.This issue affects htmlunit before 2.70.0.
Memory Corruption
Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE)
CVE-2023-26119
9.8 - Critical
- April 03, 2023
Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attackers webpage.
HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability
CVE-2022-29546
7.5 - High
- April 25, 2022
HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product.
Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input
CVE-2022-28366
7.5 - High
- April 21, 2022
Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24839.
HtmlUnit prior to 2.37.0 contains code execution vulnerabilities
CVE-2020-5529
8.1 - High
- February 11, 2020
HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application.
Improper Initialization
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Htmlunit or by Htmlunitproject? Click the Watch button to subscribe.
