deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-wg3g-gvx5-2pmv
Package: Magick.NET-Q16-AnyCPU (NUGET)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 14.10.3
Patched in: 14.10.3

Summary: ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS

Details:
Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS.
GitHub Security Advisory: GHSA-96pc-27rx-pr36
Package: Magick.NET-Q8-x86 (NUGET)
Severity: HIGH (CVSS 7.5)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 14.10.3
Patched in: 14.10.3

Summary: ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

Details:
### Description
A heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image.

### Expected Impact
Information disclosure leading to potential exposure of sensitive data from server memory.
GitHub Security Advisory: GHSA-96pc-27rx-pr36
Package: Magick.NET-Q8-arm64 (NUGET)
Severity: HIGH (CVSS 7.5)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 14.10.3
Patched in: 14.10.3

Summary: ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

Details:
### Description
A heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image.

### Expected Impact
Information disclosure leading to potential exposure of sensitive data from server memory.
GitHub Security Advisory: GHSA-96pc-27rx-pr36
Package: Magick.NET-Q8-OpenMP-x64 (NUGET)
Severity: HIGH (CVSS 7.5)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 14.10.3
Patched in: 14.10.3

Summary: ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

Details:
### Description
A heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image.

### Expected Impact
Information disclosure leading to potential exposure of sensitive data from server memory.
GitHub Security Advisory: GHSA-96pc-27rx-pr36
Package: Magick.NET-Q8-OpenMP-arm64 (NUGET)
Severity: HIGH (CVSS 7.5)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 14.10.3
Patched in: 14.10.3

Summary: ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

Details:
### Description
A heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image.

### Expected Impact
Information disclosure leading to potential exposure of sensitive data from server memory.
GitHub Security Advisory: GHSA-96pc-27rx-pr36
Package: Magick.NET-Q8-AnyCPU (NUGET)
Severity: HIGH (CVSS 7.5)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 14.10.3
Patched in: 14.10.3

Summary: ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

Details:
### Description
A heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image.

### Expected Impact
Information disclosure leading to potential exposure of sensitive data from server memory.
GitHub Security Advisory: GHSA-96pc-27rx-pr36
Package: Magick.NET-Q16-x86 (NUGET)
Severity: HIGH (CVSS 7.5)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 14.10.3
Patched in: 14.10.3

Summary: ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

Details:
### Description
A heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image.

### Expected Impact
Information disclosure leading to potential exposure of sensitive data from server memory.
GitHub Security Advisory: GHSA-96pc-27rx-pr36
Package: Magick.NET-Q16-x64 (NUGET)
Severity: HIGH (CVSS 7.5)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 14.10.3
Patched in: 14.10.3

Summary: ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

Details:
### Description
A heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image.

### Expected Impact
Information disclosure leading to potential exposure of sensitive data from server memory.
GitHub Security Advisory: GHSA-96pc-27rx-pr36
Package: Magick.NET-Q16-arm64 (NUGET)
Severity: HIGH (CVSS 7.5)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 14.10.3
Patched in: 14.10.3

Summary: ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

Details:
### Description
A heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image.

### Expected Impact
Information disclosure leading to potential exposure of sensitive data from server memory.
GitHub Security Advisory: GHSA-96pc-27rx-pr36
Package: Magick.NET-Q16-OpenMP-x64 (NUGET)
Severity: HIGH (CVSS 7.5)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 14.10.3
Patched in: 14.10.3

Summary: ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

Details:
### Description
A heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image.

### Expected Impact
Information disclosure leading to potential exposure of sensitive data from server memory.
GitHub Security Advisory: GHSA-96pc-27rx-pr36
Package: Magick.NET-Q16-OpenMP-arm64 (NUGET)
Severity: HIGH (CVSS 7.5)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 14.10.3
Patched in: 14.10.3

Summary: ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

Details:
### Description
A heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image.

### Expected Impact
Information disclosure leading to potential exposure of sensitive data from server memory.
GitHub Security Advisory: GHSA-96pc-27rx-pr36
Package: Magick.NET-Q16-HDRI-x86 (NUGET)
Severity: HIGH (CVSS 7.5)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 14.10.3
Patched in: 14.10.3

Summary: ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

Details:
### Description
A heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image.

### Expected Impact
Information disclosure leading to potential exposure of sensitive data from server memory.
GitHub Security Advisory: GHSA-96pc-27rx-pr36
Package: Magick.NET-Q16-HDRI-x64 (NUGET)
Severity: HIGH (CVSS 7.5)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 14.10.3
Patched in: 14.10.3

Summary: ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

Details:
### Description
A heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image.

### Expected Impact
Information disclosure leading to potential exposure of sensitive data from server memory.
GitHub Security Advisory: GHSA-96pc-27rx-pr36
Package: Magick.NET-Q16-HDRI-arm64 (NUGET)
Severity: HIGH (CVSS 7.5)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 14.10.3
Patched in: 14.10.3

Summary: ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

Details:
### Description
A heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image.

### Expected Impact
Information disclosure leading to potential exposure of sensitive data from server memory.
GitHub Security Advisory: GHSA-96pc-27rx-pr36
Package: Magick.NET-Q16-HDRI-OpenMP-x64 (NUGET)
Severity: HIGH (CVSS 7.5)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 14.10.3
Patched in: 14.10.3

Summary: ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

Details:
### Description
A heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image.

### Expected Impact
Information disclosure leading to potential exposure of sensitive data from server memory.
GitHub Security Advisory: GHSA-96pc-27rx-pr36
Package: Magick.NET-Q16-HDRI-OpenMP-arm64 (NUGET)
Severity: HIGH (CVSS 7.5)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 14.10.3
Patched in: 14.10.3

Summary: ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

Details:
### Description
A heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image.

### Expected Impact
Information disclosure leading to potential exposure of sensitive data from server memory.
GitHub Security Advisory: GHSA-96pc-27rx-pr36
Package: Magick.NET-Q16-HDRI-AnyCPU (NUGET)
Severity: HIGH (CVSS 7.5)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 14.10.3
Patched in: 14.10.3

Summary: ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

Details:
### Description
A heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image.

### Expected Impact
Information disclosure leading to potential exposure of sensitive data from server memory.
GitHub Security Advisory: GHSA-96pc-27rx-pr36
Package: Magick.NET-Q16-AnyCPU (NUGET)
Severity: HIGH (CVSS 7.5)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 14.10.3
Patched in: 14.10.3

Summary: ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

Details:
### Description
A heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image.

### Expected Impact
Information disclosure leading to potential exposure of sensitive data from server memory.
GitHub Security Advisory: GHSA-2ww3-72rp-wpp4
Package: Microsoft.SemanticKernel.Core (NUGET)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 1.71.0
Patched in: 1.71.0

Summary: Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK

Details:
### Impact
_What kind of vulnerability is it? Who is impacted?_
An Arbitrary File Write vulnerability has been identified in Microsoft's Semantic Kernel .NET SDK, specifically within the `SessionsPythonPlugin`.
Developers who have built applications which include Microsoft's Semantic Kernel .NET SDK and are using the `SessionsPythonPlugin`

### Patches
_Has the problem been patched? What versions should users upgrade to?_
The problem has been fixed in [Microsoft.SemanticKernel.Plugins.Core version 1.71.0](https://www.nuget.org/packages/Microsoft.SemanticKernel.Plugins.Core/1.71.0). Users should upgrade to version 1.71.0 or higher.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
Users can create a [Function Invocation Filter](https://learn.microsoft.com/en-us/semantic-kernel/concepts/enterprise-readiness/filters?pivots=programming-language-csharp#function-invocation-filter) which checks the arguments being passed to any calls to `DownloadFileAsync ` or `UploadFileAsync` and ensures the provided `localFilePath` is allow listed.

### References
_Are there any links users can visit to find out more?_
- [Sample showing safe use of the CodeInterpreterPlugin](https://github.com/microsoft/semantic-kernel/blob/main/dotnet/samples/Demos/CodeInterpreterPlugin/Program.cs#L61-L64)
- [PR to Add file upload security controls to SessionsPythonPlugin](https://github.com/microsoft/semantic-kernel/pull/13478/changes#diff-88d3cacba2bfa84eef8f2aa171b34f9940338cbb784a3ffc49f5fe3af1b8943d)
GitHub Security Advisory: GHSA-j92c-7v7g-gj3f
Package: HtmlSanitizer (NUGET)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-116: Improper Encoding or Escaping of Output
Vulnerable versions: >= 9.1.878-beta, < 9.1.893-beta
Patched in: 9.1.893-beta

Summary: HtmlSanitizer has a bypass via template tag

Details:
### Impact

If the `template` tag is allowed, its contents are not sanitized. The `template` tag is a special tag that does not usually render its contents, unless the `shadowrootmode` attribute is set to `open` or `closed`. 

The lack of sanitization of the template tag brings up two bypasses:

1. it is still possible to forcibly render the contents of a `<template>` tag through mutation XSS. The DOM parsers in browsers such as Chromium have a node depth limit of 512 and tags which are beyond that depth are flattened. This in turn allows elements within `<template>` (which are not sanitized) to be effectively 'popped out'. An example would look like this: `<div>[...]<template><script>alert('xss')</script>` where `[...]` denotes at least another 509 opening `<div>` tags.
2. If in addition to the template tag, the `shadowrootmode` attribute is allowed through `sanitizer.AllowedAttributes.Add("shadowrootmode");`, the simple payload of `<div><template shadowrootmode="open"><script>alert('xss')</script>` would bypass the sanitizer. This is because such usage of `<template>` attaches a shadow root to its parent: `<div>`, and its contents will be rendered. 

Note that the default configuration is not affected because the `template` tag is disallowed by default.

### Patches

The problem has been patched in versions [9.0.892](https://www.nuget.org/packages/HtmlSanitizer/9.0.892) and [9.1.893-beta](https://www.nuget.org/packages/HtmlSanitizer/9.1.893-beta).

### Workarounds

Disallow the `template` tag. It is disallowed by default.

### Resources

https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template
GitHub Security Advisory: GHSA-j92c-7v7g-gj3f
Package: HtmlSanitizer (NUGET)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-116: Improper Encoding or Escaping of Output
Vulnerable versions: < 9.0.892
Patched in: 9.0.892

Summary: HtmlSanitizer has a bypass via template tag

Details:
### Impact

If the `template` tag is allowed, its contents are not sanitized. The `template` tag is a special tag that does not usually render its contents, unless the `shadowrootmode` attribute is set to `open` or `closed`. 

The lack of sanitization of the template tag brings up two bypasses:

1. it is still possible to forcibly render the contents of a `<template>` tag through mutation XSS. The DOM parsers in browsers such as Chromium have a node depth limit of 512 and tags which are beyond that depth are flattened. This in turn allows elements within `<template>` (which are not sanitized) to be effectively 'popped out'. An example would look like this: `<div>[...]<template><script>alert('xss')</script>` where `[...]` denotes at least another 509 opening `<div>` tags.
2. If in addition to the template tag, the `shadowrootmode` attribute is allowed through `sanitizer.AllowedAttributes.Add("shadowrootmode");`, the simple payload of `<div><template shadowrootmode="open"><script>alert('xss')</script>` would bypass the sanitizer. This is because such usage of `<template>` attaches a shadow root to its parent: `<div>`, and its contents will be rendered. 

Note that the default configuration is not affected because the `template` tag is disallowed by default.

### Patches

The problem has been patched in versions [9.0.892](https://www.nuget.org/packages/HtmlSanitizer/9.0.892) and [9.1.893-beta](https://www.nuget.org/packages/HtmlSanitizer/9.1.893-beta).

### Workarounds

Disallow the `template` tag. It is disallowed by default.

### Resources

https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template
GitHub Security Advisory: GHSA-hm5p-82g6-m3xh
Package: Umbraco.Forms (NUGET)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 17.0.0, < 17.1.1
Patched in: 17.1.1

Summary: Umbraco.Forms has Path Traversal and File Enumeration Vulnerabilities in Linux/Mac

Details:
### Impact
It's possible for an authenticated backoffice-user to enumerate and traverse paths/files on the systems filesystem and read their contents, on Mac/Linux Umbraco installations using Forms. As Umbraco Cloud runs in a Windows environment, Cloud users aren't affected. 

### Patches
This issue affects versions 16 and 17 of Umbraco Forms and is patched in 16.4.1 and 17.1.1

### Workarounds
If upgrading is not immediately possible, users can mitigate this vulnerability by:
* Configuring a WAF or reverse proxy to block requests containing path traversal sequences (`../`, `..\`) in the `fileName` parameter of the export endpoint
* Restricting network access to the Umbraco backoffice to trusted IP ranges
* Blocking the `/umbraco/forms/api/v1/export` endpoint entirely if the export feature is not required

However, upgrading to the patched version is strongly recommended.

### References
Credit to Kevin Joensen from Baldur Security for finding this vulnerability
GitHub Security Advisory: GHSA-hm5p-82g6-m3xh
Package: Umbraco.Forms (NUGET)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 16.0.0, < 16.4.1
Patched in: 16.4.1

Summary: Umbraco.Forms has Path Traversal and File Enumeration Vulnerabilities in Linux/Mac

Details:
### Impact
It's possible for an authenticated backoffice-user to enumerate and traverse paths/files on the systems filesystem and read their contents, on Mac/Linux Umbraco installations using Forms. As Umbraco Cloud runs in a Windows environment, Cloud users aren't affected. 

### Patches
This issue affects versions 16 and 17 of Umbraco Forms and is patched in 16.4.1 and 17.1.1

### Workarounds
If upgrading is not immediately possible, users can mitigate this vulnerability by:
* Configuring a WAF or reverse proxy to block requests containing path traversal sequences (`../`, `..\`) in the `fileName` parameter of the export endpoint
* Restricting network access to the Umbraco backoffice to trusted IP ranges
* Blocking the `/umbraco/forms/api/v1/export` endpoint entirely if the export feature is not required

However, upgrading to the patched version is strongly recommended.

### References
Credit to Kevin Joensen from Baldur Security for finding this vulnerability
GitHub Security Advisory: GHSA-w9pf-h6m6-v89h
Package: DotNetNuke.Core (NUGET)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 10.0.0, < 10.2.0
Patched in: 10.2.0

Summary: DotNetNuke.Core Vulnerable to Stored XSS via Module Title

Details:
Module title supports richtext which could include scripts that would execute in certain scenarios.
GitHub Security Advisory: GHSA-w9pf-h6m6-v89h
Package: DotNetNuke.Core (NUGET)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 9.13.10
Patched in: 9.13.10

Summary: DotNetNuke.Core Vulnerable to Stored XSS via Module Title

Details:
Module title supports richtext which could include scripts that would execute in certain scenarios.
GitHub Security Advisory: GHSA-vm5q-8qww-h238
Package: DotNetNuke.Core (NUGET)
Severity: HIGH (CVSS 7.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 10.0.0, < 10.2.0
Patched in: 10.2.0

Summary: DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal

Details:
A module friendly name could include scripts that will run during some module operations in the Persona Bar.
GitHub Security Advisory: GHSA-vm5q-8qww-h238
Package: DotNetNuke.Core (NUGET)
Severity: HIGH (CVSS 7.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 9.0.0, <= 9.13.9
Patched in: unpatched

Summary: DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal

Details:
A module friendly name could include scripts that will run during some module operations in the Persona Bar.
GitHub Security Advisory: GHSA-2g5g-hcgh-q3rp
Package: DotNetNuke.Core (NUGET)
Severity: HIGH (CVSS 7.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 10.0.0, < 10.2.0
Patched in: 10.02.0

Summary: DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes

Details:
Extensions could write richtext in log notes which can include scripts that would run in the PersonaBar when displayed.
GitHub Security Advisory: GHSA-2g5g-hcgh-q3rp
Package: DotNetNuke.Core (NUGET)
Severity: HIGH (CVSS 7.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 9.0.0, <= 9.13.9
Patched in: unpatched

Summary: DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes

Details:
Extensions could write richtext in log notes which can include scripts that would run in the PersonaBar when displayed.