SUSE CVE-2022-28366

Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction PI input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 also...

ai.preferred:venom (>=4.0.1, <=4.2.7), at.ganzleicht.vaadin:vaadin-client-compiler (>=9.1.1, <=9.1.3) +2126 more potentially affected by CVE-2023-26119 via net.sourceforge.htmlunit:htmlunit (>=1.14, <=2.70.0)

net.sourceforge.htmlunit:htmlunit MAVEN version =1.14, =4.0.1, =9.1.1, =1.0.0, =1.0.0, =1.0.0, =0.0.2, =1, =2.0, =0.9.6, =0.9.6, =0.1.1, =0.5.0, =0.11.1, =0.30.0 and more Source cves: CVE-2023-26119 Source advisory: SNYK:JAVA-NETSOURCEFORGEHTMLUNIT-3252500...

Remote Code Execution (RCE)

Overview net.sourceforge.htmlunit:htmlunit is a GUI-Less browser for Java programs Affected versions of this package are vulnerable to Remote Code Execution RCE via XSTL, when browsing the attacker’s webpage. Note: Users are advised to upgrade to org.htmlunit:htmlunit component v3.0.0 as it...

htmlunit:HtmlParserFuzzer: Security exception in com.gargoylesoftware.htmlunit.css.ComputedCssStyleDeclaration.getStyleAttribute

Detailed Report: https://oss-fuzz.com/testcase?key=6524750832992256 Project: htmlunit Fuzzing Engine: libFuzzer Fuzz Target: HtmlParserFuzzer Job Type: libfuzzerasanhtmlunit Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

htmlunit:HtmlParserFuzzer: Security exception in com.gargoylesoftware.htmlunit.html.DomNode$DescendantElementsIterator.getNextEle

Detailed Report: https://oss-fuzz.com/testcase?key=6013790934401024 Project: htmlunit Fuzzing Engine: libFuzzer Fuzz Target: HtmlParserFuzzer Job Type: libfuzzerasanhtmlunit Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

com.canoo:webtest (>=586, <=1393), com.flexiblewebsolutions.xdriveunit:xdriveunit (0.3) +79 more potentially affected by CVE-2017-12621 via commons-jelly:commons-jelly (>=1.0-beta-4, <=1.0)

commons-jelly:commons-jelly MAVEN version =1.0-beta-4, =586, =0.1, =1.0, =20050708.205531, =1.2, =1.0-m5, =1.0.1, =1.3, =1.9 - jepi:jepi 1.0 - marmalade:marmalade-compat-jelly 1.0-alpha-3 - maven-plugins:maven-sourceforge-plugin 1.3 and more Source cves: CVE-2017-12621 Source advisory:...

ai.preferred:venom (>=4.1.3, <=4.2.7), at.ganzleicht.vaadin:vaadin-client-compiler (9.1.3) +1071 more potentially affected by CVE-2022-29546 via net.sourceforge.htmlunit:neko-htmlunit (>=2.21, <=2.60.0)

net.sourceforge.htmlunit:neko-htmlunit MAVEN version =2.21, =4.1.3, =1.0.0, =1.0.0, =1.0.0, =1, =2.0, =0.9.6, =0.9.6, =0.0.10, =0.14, =5.4.0, =5.4.0, =6.1.3 and more Source cves: CVE-2022-29546 Source advisory: OSV:GHSA-6JMM-MP6W-4RRG...

ai.preferred:venom (>=4.1.3, <=4.2.7), at.ganzleicht.vaadin:vaadin-client-compiler (9.1.3) +1071 more potentially affected by CVE-2022-29546 via net.sourceforge.htmlunit:neko-htmlunit (>=2.21, <=2.60.0)

net.sourceforge.htmlunit:neko-htmlunit MAVEN version =2.21, =4.1.3, =1.0.0, =1.0.0, =1.0.0, =1, =2.0, =0.9.6, =0.9.6, =0.0.10, =0.14, =5.4.0, =5.4.0, =6.1.3 and more Source cves: CVE-2022-29546 Source advisory: GHSA-6JMM-MP6W-4RRG...

Denial Of Service (DoS)

neko-htmlunit is vulnerable to denial of service. An attacker can crash the application through the out of memory exception in the scanPI function of HTMLScanner.java by providing a specifically crafted processing instruction...

CVE-2022-29546

HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction PI data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product...

CVE-2022-29546

HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction PI data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product...

Design/Logic Flaw

HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction PI data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product...

CVE-2022-29546

HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction PI data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product...

ai.preferred:venom (>=4.1.3, <=4.2.7), at.ganzleicht.vaadin:vaadin-client-compiler (9.1.3) +1071 more potentially affected by CVE-2022-29546 via net.sourceforge.htmlunit:neko-htmlunit (>=2.21, <=2.60.0)

net.sourceforge.htmlunit:neko-htmlunit MAVEN version =2.21, =4.1.3, =1.0.0, =1.0.0, =1.0.0, =1, =2.0, =0.9.6, =0.9.6, =0.0.10, =0.14, =5.4.0, =5.4.0, =6.1.3 and more Source cves: CVE-2022-29546 Source advisory: MEND:CVE-2022-29546...

CVE-2022-29546

HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction PI data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product...

CVE-2022-29546

HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction PI data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product...

CVE-2022-29546

CVE-2022-29546 : HtmlUnit NekoHtml Parser before 2.61.0 has a denial-of-service vulnerability via crafted Processing Instructions that triggers heap memory consumption. The issue is triggered during PI data parsing and is described as similar to CVE-2022-28366 but affecting a much newer version. ...

CVE-2022-29546: Undefined Security Weakness

HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction PI data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product...

PT-2022-7028 · Atlassian +2 · Jira +5

Name of the Vulnerable Software and Affected Versions: HtmlUnit NekoHtml Parser versions prior to 2.61.0 Oracle WebLogic Server affected versions not specified Oracle Fusion Middleware affected versions not specified Jira Service Management affected versions not specified Jira Work Management...

HtmlUnit security vulnerability

HtmlUnit is an open source java page analysis tool that reads a page and can be used effectively to analyze the content on the page using HtmlUnit. HtmlUnit NekoHtml Parser2.61.0 A security vulnerability previously existed in which a crafted input related to Processing Instruction PI data parsing...