EUVD-2020-0412

Malware in sbrugna...

EUVD-2022-1649

Malicious code in bioql PyPI...

EUVD-2023-3079

Malicious code in bioql PyPI...

EUVD-2023-1944

Malicious code in bioql PyPI...

EUVD-2022-1739

Malicious code in bioql PyPI...

EUVD-2023-1621

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2020-5529

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute...

Linux Distros Unpatched Vulnerability : CVE-2023-49093

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution RCE via XSTL, when browsing the attacker's webpage. This...

Linux Distros Unpatched Vulnerability : CVE-2023-2798

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks DoS. If HtmlUnit is running on user supplied web pages, an...

CVE-2023-26119

Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution RCE via XSTL, when browsing the attacker’s webpage...

CVE-2022-29546

HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction PI data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product...

CVE-2022-28366

Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction PI input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 also...

com.github.seykron:htmlunit-runner-freemarker (1.0), org.springframework:spring-mock (2.0) +1 more potentially affected by CVE-2024-38819 via org.springframework:spring-webmvc (2.0)

org.springframework:spring-webmvc MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.seykron:htmlunit-runner-freemarker 1.0 - org.springframework:spring-mock 2.0 -...

Security Bulletin: IBM Security Verify Governance - Identity Manager has multiple vulnerabilities

Summary Multiple security vulnerabilities have been addressed in updates to IBM Security Verify Governance - Identity Manager software component and IBM Security Verify Governance - Identity Manager virtual appliance component. Vulnerability Details CVEID:CVE-2024-22262 DESCRIPTION: VMware Tanzu...

Malicious input can provoke XSS when preserving comments

Impact There is a potential for a mutation XSS mXSS vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the preserveComments directive must be enabled in your policy file. As a result, certain crafty inputs can result in elements in...

HtmlUnit Code Execution

The vulnerability of HtmlUnit, a browser without a graphical interface, is related to incorrect code generation. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

Atlassian Jira Service Management Data Center and Server 4.20.x < 4.20.28 / 5.4.x < 5.4.12 / 5.5.x < 5.11.3 / 5.12.0 (JSDSERVER-14873)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-14873 advisory. - HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input...

CVE-2023-49093

A flaw was found in HTMLUnit. Fetching external resources may be possible for XSLT processors with the Feature for Secure Processing disabled FSP, allowing code injection and arbitrary code execution. HTMLUnit is vulnerable to this type of attack by default...

Arbitrary Code Execution

HtmlUnit is vulnerable to Arbitrary Code Execution. The vulnerability exists in the transform function in XSLProcessor.java due to lack of enabling the FEATURESECUREPROCESSING configuration in the MSXML XSLProcessor which allows an attacker to inject and execute arbitrary code when visiting an...

HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL

Summary HtmlUnit 3.8.0 are vulnerable to Remote Code Execution RCE via XSTL, when browsing the attacker’s webpage Details Vulnerability code location: org.htmlunit.activex.javascript.msxml.XSLProcessortransformorg.htmlunit.activex.javascript.msxml.XMLDOMNode The reason for the vulnerability is th...