deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-q3hc-j9x5-mp9m
Package: Magick.NET-Q16-HDRI-AnyCPU (NUGET)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-415: Double Free
Vulnerable versions: <= 14.9.1
Patched in: unpatched

Summary: Withdrawn Advisory: ImageMagick has a use-after-free/double-free risk in Options::fontFamily when clearing family

Details:
## Withdrawn Advisory
This advisory has been withdrawn because it does not affect the ImageMagick project's NuGet packages.

### Original Description
We believe that we have discovered a potential security vulnerability in ImageMagick’s Magick++ layer that manifests when `Options::fontFamily` is invoked with an empty string.

**Vulnerability Details**
- Clearing a font family calls `RelinquishMagickMemory` on `_drawInfo->font`, freeing the font string but leaving `_drawInfo->font` pointing to freed memory while `_drawInfo->family` is set to that (now-invalid) pointer. Any later cleanup or reuse of `_drawInfo->font` re-frees or dereferences dangling memory.
- `DestroyDrawInfo` and other setters (`Options::font`, `Image::font`) assume `_drawInfo->font` remains valid, so destruction or subsequent updates trigger crashes or heap corruption.

```cpp
if (family_.length() == 0)
  {
    _drawInfo->family=(char *) RelinquishMagickMemory(_drawInfo->font);
    DestroyString(RemoveImageOption(imageInfo(),"family"));
  }
```

- **CWE-416 (Use After Free):** `_drawInfo->font` is left dangling yet still reachable through the Options object.
- **CWE-415 (Double Free):** DrawInfo teardown frees `_drawInfo->font` again, provoking allocator aborts.

**Affected Versions**
- Introduced by commit `6409f34d637a34a1c643632aa849371ec8b3b5a8` (“Added fontFamily to the Image class of Magick++”, 2015-08-01, blame line 313).
- Present in all releases that include that commit, at least ImageMagick 7.0.1-0 and later (likely late 6.9 builds with Magick++ font family support as well). Older releases without `fontFamily` are unaffected.

**Command Line Triggerability**
This vulnerability cannot be triggered from the command line interface. The bug is specific to the Magick++ C++ API, specifically the `Options::fontFamily()` method. The command-line utilities (such as `convert`, `magick`, etc.) do not expose this particular code path, as they operate through different internal mechanisms that do not directly call `Options::fontFamily()` with an empty string in a way that would trigger the use-after-free condition.

**Proposed Fix**
```diff
diff --git a/Magick++/lib/Options.cpp b/Magick++/lib/Options.cpp
@@ void Magick::Options::fontFamily(const std::string &family_)
-      _drawInfo->family=(char *) RelinquishMagickMemory(_drawInfo->font);
+      _drawInfo->family=(char *) RelinquishMagickMemory(_drawInfo->family);
```
This frees only the actual family string, leaving `_drawInfo->font` untouched. Optionally nulling `_drawInfo->font` when clearing `font()` itself maintains allocator hygiene.
GitHub Security Advisory: GHSA-q3hc-j9x5-mp9m
Package: Magick.NET-Q16-AnyCPU (NUGET)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-415: Double Free
Vulnerable versions: <= 14.9.1
Patched in: unpatched

Summary: Withdrawn Advisory: ImageMagick has a use-after-free/double-free risk in Options::fontFamily when clearing family

Details:
## Withdrawn Advisory
This advisory has been withdrawn because it does not affect the ImageMagick project's NuGet packages.

### Original Description
We believe that we have discovered a potential security vulnerability in ImageMagick’s Magick++ layer that manifests when `Options::fontFamily` is invoked with an empty string.

**Vulnerability Details**
- Clearing a font family calls `RelinquishMagickMemory` on `_drawInfo->font`, freeing the font string but leaving `_drawInfo->font` pointing to freed memory while `_drawInfo->family` is set to that (now-invalid) pointer. Any later cleanup or reuse of `_drawInfo->font` re-frees or dereferences dangling memory.
- `DestroyDrawInfo` and other setters (`Options::font`, `Image::font`) assume `_drawInfo->font` remains valid, so destruction or subsequent updates trigger crashes or heap corruption.

```cpp
if (family_.length() == 0)
  {
    _drawInfo->family=(char *) RelinquishMagickMemory(_drawInfo->font);
    DestroyString(RemoveImageOption(imageInfo(),"family"));
  }
```

- **CWE-416 (Use After Free):** `_drawInfo->font` is left dangling yet still reachable through the Options object.
- **CWE-415 (Double Free):** DrawInfo teardown frees `_drawInfo->font` again, provoking allocator aborts.

**Affected Versions**
- Introduced by commit `6409f34d637a34a1c643632aa849371ec8b3b5a8` (“Added fontFamily to the Image class of Magick++”, 2015-08-01, blame line 313).
- Present in all releases that include that commit, at least ImageMagick 7.0.1-0 and later (likely late 6.9 builds with Magick++ font family support as well). Older releases without `fontFamily` are unaffected.

**Command Line Triggerability**
This vulnerability cannot be triggered from the command line interface. The bug is specific to the Magick++ C++ API, specifically the `Options::fontFamily()` method. The command-line utilities (such as `convert`, `magick`, etc.) do not expose this particular code path, as they operate through different internal mechanisms that do not directly call `Options::fontFamily()` with an empty string in a way that would trigger the use-after-free condition.

**Proposed Fix**
```diff
diff --git a/Magick++/lib/Options.cpp b/Magick++/lib/Options.cpp
@@ void Magick::Options::fontFamily(const std::string &family_)
-      _drawInfo->family=(char *) RelinquishMagickMemory(_drawInfo->font);
+      _drawInfo->family=(char *) RelinquishMagickMemory(_drawInfo->family);
```
This frees only the actual family string, leaving `_drawInfo->font` untouched. Optionally nulling `_drawInfo->font` when clearing `font()` itself maintains allocator hygiene.
GitHub Security Advisory: GHSA-3m8r-w7xg-jqvw
Package: DNN.PLATFORM (NUGET)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: < 10.1.1
Patched in: 10.1.1

Summary: DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite

Details:
### Summary
The default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files.

### Description
An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads.
GitHub Security Advisory: GHSA-hmvq-8p83-cq52
Package: DotNetNuke.Core (NUGET)
Severity: MODERATE (CVSS 6.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 10.1.1
Patched in: 10.1.1

Summary: DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload

Details:
### Summary
Sanitization of the content of uploaded SVG files was not covering all possible XSS scenarios.

### Details
DNN validates the contents of SVG's to ensure they are valid and do not contain any malicious code. These checks were introduced as part of `CVE-2025-48378`.

However, the checks to ensure there are no script elements within the SVG files are not comprehensive and may allow some malicious SVG files to be uploaded.

As this vulnerability allows for the execution of arbitrary JavaScript code within the context of the user's browser, it can lead to a range of attacks, including data exfiltration, session hijacking, and defacement of the web application to name a few.
GitHub Security Advisory: GHSA-2374-6cvw-qmx6
Package: Dnn.Platform (NUGET)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: < 10.1.1
Patched in: 10.1.1

Summary: DNN CKEditor Provider allows unauthenticated upload out-of-the-box

Details:
### Summary
The out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations.

### Details
The new out-of-box experience blocks that endpoint to unauthenticated users. If there is a real need for the implementation to allow unauthenticated uploads, then the web.config can be edited by the implementer to remove that block and open the endpoint to the public.
GitHub Security Advisory: GHSA-3qcp-9v8c-6jp7
Package: Piranha (NUGET)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 12.0.0
Patched in: unpatched

Summary: Piranha CMS vulnerable to stored cross-site scripting (XSS)

Details:
A stored cross-site scripting (XSS) vulnerability in the /manager/pages component of Piranha CMS v12.0 allows attackers to execute arbitrary web scripts or HTML via creating a page and injecting a crafted payload into the Markdown blocks.
GitHub Security Advisory: GHSA-rmjr-87wv-gf87
Package: Mammoth (NUGET)
Severity: MODERATE (CVSS 9.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 1.11.0
Patched in: 1.11.0

Summary: Mammoth is vulnerable to Directory Traversal

Details:
Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after reading, the content is encoded as base64 and included in the HTML output as a data URI. An attacker can read arbitrary files on the system where the conversion is performed or cause an excessive resources consumption by crafting a docx file that links to special device files such as /dev/random or /dev/zero.
GitHub Security Advisory: GHSA-9rvm-p3qm-f4vv
Package: Smidge (NUGET)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 4.6.0
Patched in: 4.6.0

Summary: Smidge is vulnerable to Path Traversal

Details:
A security vulnerability has been detected in Shazwazza Smidge up to 4.5.1. The impacted element is an unknown function of the component Bundle Handler. The manipulation of the argument Version leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 4.6.0 is sufficient to resolve this issue. It is recommended to upgrade the affected component.
GitHub Security Advisory: GHSA-4mjw-xr5x-prpc
Package: Apache.NMS.AMQP (NUGET)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 2.4.0
Patched in: 2.4.0

Summary: Apache ActiveMQ NMS AMQP Client has a Deserialization of Untrusted Data vulnerability

Details:
A Deserialization of Untrusted Data vulnerability exists in the Apache ActiveMQ NMS AMQP Client.

This issue affects all versions of Apache ActiveMQ NMS AMQP up to and including 2.3.0, when establishing connections to untrusted AMQP servers. Malicious servers could exploit unbounded deserialization logic present in the client to craft responses that may lead to arbitrary code execution on the client side.

Although version 2.1.0 introduced a mechanism to restrict deserialization via allow/deny lists, the protection was found to be bypassable under certain conditions.

In line with Microsoft’s deprecation of binary serialization in .NET 9, the project is evaluating the removal of .NET binary serialization support from the NMS API entirely in future releases.

Mitigation and Recommendations:
Users are strongly encouraged to upgrade to version 2.4.0 or later, which resolves the issue. Additionally, projects depending on NMS-AMQP should migrate away from .NET binary serialization as part of a long-term hardening strategy.
GitHub Security Advisory: GHSA-987x-96fq-9384
Package: Microsoft.NetCore.App.Runtime.linux-arm (NUGET)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-326: Inadequate Encryption Strength
Vulnerable versions: >= 9.0.0, < 9.0.10
Patched in: 9.0.10

Summary: Duplicate Advisory: Microsoft Security Advisory CVE-2025-55248: .NET Information Disclosure Vulnerability

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-gwq6-fmvp-qp68. This link is maintained to preserve external references.

### Original Description
Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.
GitHub Security Advisory: GHSA-q8g5-rw97-f55h
Package: Microsoft.Build.Tasks.Core (NUGET)
Severity: HIGH (CVSS 7.3)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: = 17.15.0-preview-25277-114
Patched in: 18.0.0-preview-25476-107

Summary: Duplicate Advisory: Microsoft Security Advisory CVE-2025-55247 | .NET Denial of Service Vulnerability

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-w3q9-fxm7-j8fq. This link is maintained to preserve external references.

### Original Description
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
GitHub Security Advisory: GHSA-q7x5-x7rr-2859
Package: Microsoft.PowerShell.SDK (NUGET)
Severity: HIGH (CVSS 7.8)
Vulnerable versions: >= 7.2.0-preview.1, < 7.2.3
Patched in: 7.2.3

Summary: PowerShell Elevation of Privilege Vulnerability

Details:
PowerShell Elevation of Privilege Vulnerability.
GitHub Security Advisory: GHSA-q7x5-x7rr-2859
Package: Microsoft.PowerShell.SDK (NUGET)
Severity: HIGH (CVSS 7.8)
Vulnerable versions: >= 7.1.0-preview.1, < 7.1.7
Patched in: 7.1.7

Summary: PowerShell Elevation of Privilege Vulnerability

Details:
PowerShell Elevation of Privilege Vulnerability.
GitHub Security Advisory: GHSA-q7x5-x7rr-2859
Package: Microsoft.PowerShell.SDK (NUGET)
Severity: HIGH (CVSS 7.8)
Vulnerable versions: >= 7.0.0-preview.1, < 7.0.10
Patched in: 7.0.10

Summary: PowerShell Elevation of Privilege Vulnerability

Details:
PowerShell Elevation of Privilege Vulnerability.
GitHub Security Advisory: GHSA-q5r6-9qwq-g2wj
Package: Amazon.IonDotnet (NUGET)
Severity: HIGH (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1286: Improper Validation of Syntactic Correctness of Input
Vulnerable versions: < 1.3.2
Patched in: 1.3.2

Summary: Amazon.IonDotnet is vulnerable to Denial of Service attacks

Details:
### Summary
Amazon.IonDotnet is a library for the Dotnet language that is used to read and write Amazon Ion data. An issue exists where, under certain circumstances, the library could an infinite loop, resulting in denial of service. As of August 20, 2025, this library has been deprecated and will not receive further updates.

### Impact
An infinite loop issue in Amazon.IonDotnet library versions <v1.3.2 may allow a threat actor to cause a denial of service through a specially crafted text input. This invalid input triggered an error condition in the parser that was handled improperly, resulting in an infinite loop.

### Impacted versions:
<1.3.2

### Patches
This issue has been addressed in Amazon.IonDotnet version [1.3.2](https://www.nuget.org/packages/Amazon.IonDotnet/1.3.2). We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

### Workarounds
Only accept data from trusted sources, written using a supported Ion library.

### References
If you have any questions or comments about this advisory, we ask that you contact AWS Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.
GitHub Security Advisory: GHSA-jhpv-4q4f-43g5
Package: Akka.Cluster (NUGET)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-290: Authentication Bypass by Spoofing
Vulnerable versions: >= 1.2.0, < 1.5.52
Patched in: 1.5.52

Summary: Akka.Remote TLS did not properly implement certificate-based authentication

Details:
### Impact

This is a critical network security vulnerability for Akka.Remote **users who have SSL / TLS enabled** on their Akka.Remote connections and were expecting certificate-based authentication to be enforced on all peers attempting to join the network.

In all versions of Akka.Remote from v1.2.0 to v1.5.51, TLS could be enabled via our `akka.remote.dot-netty.tcp` transport and this would correctly enforce private key validation on the server-side of inbound connections. Akka.Remote, however, never asked the outbound-connecting client to present ITS certificate - therefore it's possible for untrusted parties to connect to a private key'd Akka.NET cluster and begin communicating with it **without any certificate**. 

The issue here is that for certificate-based authentication to work properly, ensuring that all members of the Akka.Remote network are secured with the same private key, Akka.Remote needed to implement mutual TLS. This was not the case before Akka.NET v1.5.52.

If you are running Akka.NET inside a private network you fully control or you were never using TLS in the first place, then this bug has no impact on you. However: if you are using TLS to secure your network YOU MUST upgrade to Akka.NET V1.5.52 or later.

### Patches

https://github.com/akkadotnet/akka.net/pull/7847 - forces "fail fast" semantics if TLS is enabled but the private key is missing or invalid. Previous versions would only check that once connection attempts occurred.
https://github.com/akkadotnet/akka.net/pull/7851 - **critical fix**: enforces mutual TLS (mTLS) by default, so both parties must be keyed using the same certificate. This fulfills the original security 

These updates have been shipped into Akka.NET v1.5.52: https://github.com/akkadotnet/akka.net/releases/tag/1.5.52

### Workarounds

If your application isn't exposed publicly, then CVE-2025-61778 has no practical impact on your application. That being said: upgrading to Akka.NET v1.5.52 or later is a good idea.

### References

Please view our latest network security documentation here: https://getakka.net/articles/remoting/security.html
GitHub Security Advisory: GHSA-jhpv-4q4f-43g5
Package: Akka.Remote (NUGET)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-290: Authentication Bypass by Spoofing
Vulnerable versions: >= 1.2.0, < 1.5.52
Patched in: 1.5.52

Summary: Akka.Remote TLS did not properly implement certificate-based authentication

Details:
### Impact

This is a critical network security vulnerability for Akka.Remote **users who have SSL / TLS enabled** on their Akka.Remote connections and were expecting certificate-based authentication to be enforced on all peers attempting to join the network.

In all versions of Akka.Remote from v1.2.0 to v1.5.51, TLS could be enabled via our `akka.remote.dot-netty.tcp` transport and this would correctly enforce private key validation on the server-side of inbound connections. Akka.Remote, however, never asked the outbound-connecting client to present ITS certificate - therefore it's possible for untrusted parties to connect to a private key'd Akka.NET cluster and begin communicating with it **without any certificate**. 

The issue here is that for certificate-based authentication to work properly, ensuring that all members of the Akka.Remote network are secured with the same private key, Akka.Remote needed to implement mutual TLS. This was not the case before Akka.NET v1.5.52.

If you are running Akka.NET inside a private network you fully control or you were never using TLS in the first place, then this bug has no impact on you. However: if you are using TLS to secure your network YOU MUST upgrade to Akka.NET V1.5.52 or later.

### Patches

https://github.com/akkadotnet/akka.net/pull/7847 - forces "fail fast" semantics if TLS is enabled but the private key is missing or invalid. Previous versions would only check that once connection attempts occurred.
https://github.com/akkadotnet/akka.net/pull/7851 - **critical fix**: enforces mutual TLS (mTLS) by default, so both parties must be keyed using the same certificate. This fulfills the original security 

These updates have been shipped into Akka.NET v1.5.52: https://github.com/akkadotnet/akka.net/releases/tag/1.5.52

### Workarounds

If your application isn't exposed publicly, then CVE-2025-61778 has no practical impact on your application. That being said: upgrading to Akka.NET v1.5.52 or later is a good idea.

### References

Please view our latest network security documentation here: https://getakka.net/articles/remoting/security.html
GitHub Security Advisory: GHSA-6cwx-42hw-w69c
Package: FormCMS (NUGET)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-284: Improper Access Control
Vulnerable versions: <= 0.5.4
Patched in: 0.5.5

Summary: FormCMS has an improper access control vulnerability in the /api/schemas/history/[schemaId] endpoint

Details:
An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/[schemaId] endpoint allows unauthenticated attackers to access historical schema data if a valid schemaId is known or guessed.
GitHub Security Advisory: GHSA-456v-f425-8mcv
Package: Piranha (NUGET)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 12.0
Patched in: unpatched

Summary: PiranhaCMS stored XSS

Details:
PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution of arbitrary JavaScript in another user s browser.
GitHub Security Advisory: GHSA-jc4g-c8ww-5738
Package: DotNetNuke.Core (NUGET)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 10.1.0
Patched in: 10.1.0

Summary: DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile

Details:
# Summary
A reflected cross-site scripting (XSS) vulnerability exists under certain conditions, using a specially crafter url to view a user profile

# Description
DNN’s URL/path handling and template rendering can allow specially crafted input to be reflected into a user profile that are returned to the browser. In these cases, the application does not sufficiently neutralize or encode characters that are meaningful in HTML, so an attacker can cause a victim’s browser to interpret attacker-controlled content as part of the page’s HTML.