deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-vh8f-65qg-3m8j
Package: Microsoft.AspNetCore.App.Runtime.linux-arm (NUGET)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 8.0.0, <= 8.0.24
Patched in: 8.0.25

Summary: Duplicate Advisory: .NET Denial of Service Vulnerability

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-4vgm-c2wm-63mw. This link is maintained to preserve external references.

### Original Description
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
GitHub Security Advisory: GHSA-387c-qmrw-59qv
Package: Microsoft.NetCore.App.Runtime.linux-x64 (NUGET)
Severity: HIGH (CVSS 7.8)
CWE: CWE-276: Incorrect Default Permissions
Vulnerable versions: >= 10.0.0, <= 10.0.3
Patched in: 10.0.4

Summary: Duplicate Advisory: Microsoft Security Advisory CVE-2026-26131 – .NET Elevation of Privilege Vulnerability

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-crjq-wm6x-6qx7. This link is maintained to preserve external references.

### Original Description

Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally.
GitHub Security Advisory: GHSA-387c-qmrw-59qv
Package: Microsoft.NetCore.App.Runtime.linux-musl-x64 (NUGET)
Severity: HIGH (CVSS 7.8)
CWE: CWE-276: Incorrect Default Permissions
Vulnerable versions: >= 10.0.0, <= 10.0.3
Patched in: 10.0.4

Summary: Duplicate Advisory: Microsoft Security Advisory CVE-2026-26131 – .NET Elevation of Privilege Vulnerability

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-crjq-wm6x-6qx7. This link is maintained to preserve external references.

### Original Description

Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally.
GitHub Security Advisory: GHSA-387c-qmrw-59qv
Package: Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NUGET)
Severity: HIGH (CVSS 7.8)
CWE: CWE-276: Incorrect Default Permissions
Vulnerable versions: >= 10.0.0, <= 10.0.3
Patched in: 10.0.4

Summary: Duplicate Advisory: Microsoft Security Advisory CVE-2026-26131 – .NET Elevation of Privilege Vulnerability

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-crjq-wm6x-6qx7. This link is maintained to preserve external references.

### Original Description

Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally.
GitHub Security Advisory: GHSA-387c-qmrw-59qv
Package: Microsoft.NetCore.App.Runtime.linux-musl-arm (NUGET)
Severity: HIGH (CVSS 7.8)
CWE: CWE-276: Incorrect Default Permissions
Vulnerable versions: >= 10.0.0, <= 10.0.3
Patched in: 10.0.4

Summary: Duplicate Advisory: Microsoft Security Advisory CVE-2026-26131 – .NET Elevation of Privilege Vulnerability

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-crjq-wm6x-6qx7. This link is maintained to preserve external references.

### Original Description

Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally.
GitHub Security Advisory: GHSA-387c-qmrw-59qv
Package: Microsoft.NetCore.App.Runtime.linux-arm64 (NUGET)
Severity: HIGH (CVSS 7.8)
CWE: CWE-276: Incorrect Default Permissions
Vulnerable versions: >= 10.0.0, <= 10.0.3
Patched in: 10.0.4

Summary: Duplicate Advisory: Microsoft Security Advisory CVE-2026-26131 – .NET Elevation of Privilege Vulnerability

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-crjq-wm6x-6qx7. This link is maintained to preserve external references.

### Original Description

Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally.
GitHub Security Advisory: GHSA-387c-qmrw-59qv
Package: Microsoft.NetCore.App.Runtime.linux-arm (NUGET)
Severity: HIGH (CVSS 7.8)
CWE: CWE-276: Incorrect Default Permissions
Vulnerable versions: >= 10.0.0, <= 10.0.3
Patched in: 10.0.4

Summary: Duplicate Advisory: Microsoft Security Advisory CVE-2026-26131 – .NET Elevation of Privilege Vulnerability

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-crjq-wm6x-6qx7. This link is maintained to preserve external references.

### Original Description

Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally.
GitHub Security Advisory: GHSA-rhcg-3h8r-v6vp
Package: Umbraco.Cms (NUGET)
Severity: HIGH (CVSS 7.2)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: >= 17.0.0, < 17.2.2
Patched in: 17.2.2

Summary: Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks

Details:
### Description
A privilege escalation vulnerability has been identified in Umbraco CMS. Under certain conditions, authenticated backoffice users with permission to manage users, may be able to elevate their privileges due to insufficient authorization enforcement when modifying user group memberships.

The affected functionality does not properly validate whether a user has sufficient privileges to assign highly privileged roles.

### Impact
An authenticated backoffice user may be able to escalate their privileges to Administrator level.

Successful exploitation results in full administrative control of the affected Umbraco CMS instance, including unrestricted access to content, user management, and configuration settings.

The impact is significantly mitigated by the fact that this can only be exploited by a user that has already been given access to the "Users" section in the CMS.  For most Umbraco setups, such users are already also "Administrators".

### Patches
The issue is patched in 16.5.1 and 17.2.2.

### Workarounds
There is no workaround other than upgrading for setups where they want to have users with permission for the "Users" section without also being content with those users also being part of the "Administrators" user group.
GitHub Security Advisory: GHSA-rhcg-3h8r-v6vp
Package: Umbraco.Cms (NUGET)
Severity: HIGH (CVSS 7.2)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: >= 15.3.1, < 16.5.1
Patched in: 16.5.1

Summary: Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks

Details:
### Description
A privilege escalation vulnerability has been identified in Umbraco CMS. Under certain conditions, authenticated backoffice users with permission to manage users, may be able to elevate their privileges due to insufficient authorization enforcement when modifying user group memberships.

The affected functionality does not properly validate whether a user has sufficient privileges to assign highly privileged roles.

### Impact
An authenticated backoffice user may be able to escalate their privileges to Administrator level.

Successful exploitation results in full administrative control of the affected Umbraco CMS instance, including unrestricted access to content, user management, and configuration settings.

The impact is significantly mitigated by the fact that this can only be exploited by a user that has already been given access to the "Users" section in the CMS.  For most Umbraco setups, such users are already also "Administrators".

### Patches
The issue is patched in 16.5.1 and 17.2.2.

### Workarounds
There is no workaround other than upgrading for setups where they want to have users with permission for the "Users" section without also being content with those users also being part of the "Administrators" user group.
GitHub Security Advisory: GHSA-vrqc-59mw-qqg7
Package: Umbraco.Cms (NUGET)
Severity: MODERATE (CVSS 6.7)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 17.0.0, < 17.2.1
Patched in: 17.2.2

Summary: Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering

Details:
### Description
An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive `attributeNameCheck` configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (`umb-*`, `uui-*`, `ufm-*`) were not filtered.

### Impact
As property type descriptions support Markdown/HTML via the UFM rendering pipeline, injected event handlers are rendered in the backoffice interface, resulting in a stored XSS affecting other backoffice users.

### Patches
The issue is patched in 16.5.1 and 17.2.2.

### Workarounds
There is no workaround other than upgrading.

### References
https://docs.umbraco.com/umbraco-cms/reference/umbraco-flavored-markdown
GitHub Security Advisory: GHSA-vrqc-59mw-qqg7
Package: Umbraco.Cms (NUGET)
Severity: MODERATE (CVSS 6.7)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 16.2.0, < 16.5.1
Patched in: 16.5.1

Summary: Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering

Details:
### Description
An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive `attributeNameCheck` configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (`umb-*`, `uui-*`, `ufm-*`) were not filtered.

### Impact
As property type descriptions support Markdown/HTML via the UFM rendering pipeline, injected event handlers are rendered in the backoffice interface, resulting in a stored XSS affecting other backoffice users.

### Patches
The issue is patched in 16.5.1 and 17.2.2.

### Workarounds
There is no workaround other than upgrading.

### References
https://docs.umbraco.com/umbraco-cms/reference/umbraco-flavored-markdown
GitHub Security Advisory: GHSA-fpvf-fvp5-996r
Package: Umbraco.Cms (NUGET)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 17.0.0, < 17.2.2
Patched in: 17.2.2

Summary: Umbraco Backoffice API Allows Unauthorized Modification of Domain Data

Details:
### Description
A broken object-level authorization vulnerability exists in a backoffice API endpoint that allows authenticated users to assign domain-related data to content nodes without proper authorization checks.

The issue is caused by insufficient authorization enforcement on the affected API endpoint, whereby via an API call, domains can be set on content nodes that the editor does not have permission to access (either via user group privileges or start nodes).

### Impact
An attacker can modify domain configurations for content nodes they are not permitted to edit. This may result in malicious or unintended routing behaviour, service disruption, and potential disclosure of configuration-related information.

### Patches
The issue is patched in 16.5.1 and 17.2.2.

### Workarounds
There is no workaround other than upgrading.
GitHub Security Advisory: GHSA-fpvf-fvp5-996r
Package: Umbraco.Cms (NUGET)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 14.0.0, < 16.5.1
Patched in: 16.5.1

Summary: Umbraco Backoffice API Allows Unauthorized Modification of Domain Data

Details:
### Description
A broken object-level authorization vulnerability exists in a backoffice API endpoint that allows authenticated users to assign domain-related data to content nodes without proper authorization checks.

The issue is caused by insufficient authorization enforcement on the affected API endpoint, whereby via an API call, domains can be set on content nodes that the editor does not have permission to access (either via user group privileges or start nodes).

### Impact
An attacker can modify domain configurations for content nodes they are not permitted to edit. This may result in malicious or unintended routing behaviour, service disruption, and potential disclosure of configuration-related information.

### Patches
The issue is patched in 16.5.1 and 17.2.2.

### Workarounds
There is no workaround other than upgrading.
GitHub Security Advisory: GHSA-56jp-jfqg-f8f4
Package: Magick.NET-Q8-x86 (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-122: Heap-based Buffer Overflow
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

Details:
An overflow on  32-bit systems can cause a crash in the SFW decoder when processing extremely large images.
GitHub Security Advisory: GHSA-56jp-jfqg-f8f4
Package: Magick.NET-Q8-x64 (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-122: Heap-based Buffer Overflow
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

Details:
An overflow on  32-bit systems can cause a crash in the SFW decoder when processing extremely large images.
GitHub Security Advisory: GHSA-56jp-jfqg-f8f4
Package: Magick.NET-Q8-arm64 (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-122: Heap-based Buffer Overflow
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

Details:
An overflow on  32-bit systems can cause a crash in the SFW decoder when processing extremely large images.
GitHub Security Advisory: GHSA-56jp-jfqg-f8f4
Package: Magick.NET-Q8-OpenMP-x64 (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-122: Heap-based Buffer Overflow
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

Details:
An overflow on  32-bit systems can cause a crash in the SFW decoder when processing extremely large images.
GitHub Security Advisory: GHSA-56jp-jfqg-f8f4
Package: Magick.NET-Q8-OpenMP-arm64 (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-122: Heap-based Buffer Overflow
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

Details:
An overflow on  32-bit systems can cause a crash in the SFW decoder when processing extremely large images.
GitHub Security Advisory: GHSA-56jp-jfqg-f8f4
Package: Magick.NET-Q8-AnyCPU (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-122: Heap-based Buffer Overflow
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

Details:
An overflow on  32-bit systems can cause a crash in the SFW decoder when processing extremely large images.
GitHub Security Advisory: GHSA-56jp-jfqg-f8f4
Package: Magick.NET-Q16-x86 (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-122: Heap-based Buffer Overflow
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

Details:
An overflow on  32-bit systems can cause a crash in the SFW decoder when processing extremely large images.
GitHub Security Advisory: GHSA-56jp-jfqg-f8f4
Package: Magick.NET-Q16-x64 (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-122: Heap-based Buffer Overflow
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

Details:
An overflow on  32-bit systems can cause a crash in the SFW decoder when processing extremely large images.
GitHub Security Advisory: GHSA-56jp-jfqg-f8f4
Package: Magick.NET-Q16-arm64 (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-122: Heap-based Buffer Overflow
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

Details:
An overflow on  32-bit systems can cause a crash in the SFW decoder when processing extremely large images.
GitHub Security Advisory: GHSA-56jp-jfqg-f8f4
Package: Magick.NET-Q16-OpenMP-x86 (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-122: Heap-based Buffer Overflow
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

Details:
An overflow on  32-bit systems can cause a crash in the SFW decoder when processing extremely large images.
GitHub Security Advisory: GHSA-56jp-jfqg-f8f4
Package: Magick.NET-Q16-OpenMP-x64 (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-122: Heap-based Buffer Overflow
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

Details:
An overflow on  32-bit systems can cause a crash in the SFW decoder when processing extremely large images.
GitHub Security Advisory: GHSA-56jp-jfqg-f8f4
Package: Magick.NET-Q16-OpenMP-arm64 (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-122: Heap-based Buffer Overflow
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

Details:
An overflow on  32-bit systems can cause a crash in the SFW decoder when processing extremely large images.
GitHub Security Advisory: GHSA-56jp-jfqg-f8f4
Package: Magick.NET-Q16-HDRI-x86 (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-122: Heap-based Buffer Overflow
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

Details:
An overflow on  32-bit systems can cause a crash in the SFW decoder when processing extremely large images.
GitHub Security Advisory: GHSA-56jp-jfqg-f8f4
Package: Magick.NET-Q16-HDRI-x64 (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-122: Heap-based Buffer Overflow
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

Details:
An overflow on  32-bit systems can cause a crash in the SFW decoder when processing extremely large images.
GitHub Security Advisory: GHSA-56jp-jfqg-f8f4
Package: Magick.NET-Q16-HDRI-arm64 (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-122: Heap-based Buffer Overflow
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

Details:
An overflow on  32-bit systems can cause a crash in the SFW decoder when processing extremely large images.
GitHub Security Advisory: GHSA-56jp-jfqg-f8f4
Package: Magick.NET-Q16-HDRI-OpenMP-x64 (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-122: Heap-based Buffer Overflow
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

Details:
An overflow on  32-bit systems can cause a crash in the SFW decoder when processing extremely large images.
GitHub Security Advisory: GHSA-56jp-jfqg-f8f4
Package: Magick.NET-Q16-HDRI-OpenMP-arm64 (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-122: Heap-based Buffer Overflow
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

Details:
An overflow on  32-bit systems can cause a crash in the SFW decoder when processing extremely large images.
GitHub Security Advisory: GHSA-56jp-jfqg-f8f4
Package: Magick.NET-Q16-HDRI-AnyCPU (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-122: Heap-based Buffer Overflow
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

Details:
An overflow on  32-bit systems can cause a crash in the SFW decoder when processing extremely large images.
GitHub Security Advisory: GHSA-56jp-jfqg-f8f4
Package: Magick.NET-Q16-AnyCPU (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-122: Heap-based Buffer Overflow
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

Details:
An overflow on  32-bit systems can cause a crash in the SFW decoder when processing extremely large images.
GitHub Security Advisory: GHSA-qmw5-2p58-xvrc
Package: Magick.NET-Q8-x86 (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to Heap Overflow when writing extremely large image profile in the PNG encoder

Details:
An extremely large image profile could result in a heap overflow when encoding a PNG image.
GitHub Security Advisory: GHSA-qmw5-2p58-xvrc
Package: Magick.NET-Q8-x64 (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to Heap Overflow when writing extremely large image profile in the PNG encoder

Details:
An extremely large image profile could result in a heap overflow when encoding a PNG image.
GitHub Security Advisory: GHSA-qmw5-2p58-xvrc
Package: Magick.NET-Q8-arm64 (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to Heap Overflow when writing extremely large image profile in the PNG encoder

Details:
An extremely large image profile could result in a heap overflow when encoding a PNG image.
GitHub Security Advisory: GHSA-qmw5-2p58-xvrc
Package: Magick.NET-Q8-OpenMP-x64 (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to Heap Overflow when writing extremely large image profile in the PNG encoder

Details:
An extremely large image profile could result in a heap overflow when encoding a PNG image.
GitHub Security Advisory: GHSA-qmw5-2p58-xvrc
Package: Magick.NET-Q8-OpenMP-arm64 (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to Heap Overflow when writing extremely large image profile in the PNG encoder

Details:
An extremely large image profile could result in a heap overflow when encoding a PNG image.
GitHub Security Advisory: GHSA-qmw5-2p58-xvrc
Package: Magick.NET-Q8-AnyCPU (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to Heap Overflow when writing extremely large image profile in the PNG encoder

Details:
An extremely large image profile could result in a heap overflow when encoding a PNG image.
GitHub Security Advisory: GHSA-qmw5-2p58-xvrc
Package: Magick.NET-Q16-x86 (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to Heap Overflow when writing extremely large image profile in the PNG encoder

Details:
An extremely large image profile could result in a heap overflow when encoding a PNG image.
GitHub Security Advisory: GHSA-qmw5-2p58-xvrc
Package: Magick.NET-Q16-x64 (NUGET)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: < 14.10.4
Patched in: 14.10.4

Summary: ImageMagick is vulnerable to Heap Overflow when writing extremely large image profile in the PNG encoder

Details:
An extremely large image profile could result in a heap overflow when encoding a PNG image.