deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-g4vj-cjjj-v7hg
Package: NuGet.Packaging (NUGET)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 7.0.0, <= 7.0.2
Patched in: 7.0.3

Summary: Defense in Depth update for NuGet Client

Details:
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)
GitHub Security Advisory: GHSA-g4vj-cjjj-v7hg
Package: NuGet.Packaging (NUGET)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 6.14.0, <= 6.14.2
Patched in: 6.14.3

Summary: Defense in Depth update for NuGet Client

Details:
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)
GitHub Security Advisory: GHSA-g4vj-cjjj-v7hg
Package: NuGet.Packaging (NUGET)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 6.12.0, <= 6.12.4
Patched in: 6.12.5

Summary: Defense in Depth update for NuGet Client

Details:
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)
GitHub Security Advisory: GHSA-g4vj-cjjj-v7hg
Package: NuGet.Packaging (NUGET)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 6.11.0, <= 6.11.1
Patched in: 6.11.2

Summary: Defense in Depth update for NuGet Client

Details:
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)
GitHub Security Advisory: GHSA-g4vj-cjjj-v7hg
Package: NuGet.Packaging (NUGET)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 6.8.0, <= 6.8.1
Patched in: 6.8.2

Summary: Defense in Depth update for NuGet Client

Details:
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)
GitHub Security Advisory: GHSA-g4vj-cjjj-v7hg
Package: NuGet.Packaging (NUGET)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 5.11.0, <= 5.11.6
Patched in: 5.11.7

Summary: Defense in Depth update for NuGet Client

Details:
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)
GitHub Security Advisory: GHSA-g4vj-cjjj-v7hg
Package: NuGet.Packaging (NUGET)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 4.9.0, <= 4.9.6
Patched in: 4.9.7

Summary: Defense in Depth update for NuGet Client

Details:
### Impact
This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

### Patches

#### NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version|
|--|--|
|>= 4.9.0, <= 4.9.6|4.9.7|
|>= 5.11.0, <= 5.11.6|5.11.7|
|>= 6.8.0, <= 6.8.1|6.8.2|
|>= 6.11.0, <= 6.11.1|6.11.2|
|>= 6.12.0, <= 6.12.4|6.12.5|
|>= 6.14.0, <= 6.14.2|6.14.3|
|>= 7.0.0, <= 7.0.2|7.0.3|
|7.3.0|7.3.1|

#### .NET SDK

* .NET 8.0.126 SDK
* .NET 8.0.420 SDK
* .NET 9.0.116 SDK
* .NET 9.0.313 SDK
* .NET 10.0.106 SDK
* .NET 10.0.202 SDK

### Workarounds
N/A

### References
https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

### Credit
[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)
GitHub Security Advisory: GHSA-2hx3-vp6r-mg3f
Package: kiota (NUGET)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 1.31.1
Patched in: 1.31.1

Summary: Kiota: Code Generation Literal Injection

Details:
# CVE Advisory (CVE-2026-41134): Code Generation Literal Injection in Kiota

## Summary

Kiota versions **prior to 1.31.1** are affected by a code-generation literal injection vulnerability in multiple writer sinks (for example: serialization/deserialization keys, path/query parameter mappings, URL template metadata, enum/property metadata, and default value emission).

When malicious values from an OpenAPI description are emitted into generated source without context-appropriate escaping, an attacker can break out of string literals and inject additional code into generated clients.

## Impact and Preconditions

This issue is only practically exploitable when:

1. the OpenAPI description used for generation is from an **untrusted source**, or
2. a normally trusted OpenAPI description has been **compromised/tampered with**.

If you only generate from trusted, integrity-protected API descriptions, risk is significantly reduced.

## Affected Versions

- **Affected:** all versions **< 1.31.1**
- **Fixed:** **1.31.1** and later

## Illustrative Exploit Example

### Example OpenAPI fragment (malicious default value)

```yaml
openapi: 3.0.1
info:
  title: Exploit Demo
  version: 1.0.0
components:
  schemas:
    User:
      type: object
      properties:
        displayName:
          type: string
          default: "\"; throw new System.Exception(\"injected\"); //"
```

### Example generated C# snippet before fix (illustrative)

```csharp
public User() {
    DisplayName = ""; throw new System.Exception("injected"); //";
}
```

The injected payload escapes the intended string context and introduces attacker-controlled statements in generated code.

> Note: this exploit is not limited to default values, but may also impact properties names (serialization), path or query parameters, enum representations and other locations.

## Remediation

1. Upgrade Kiota to **1.31.1 or later**.
2. Regenerate/refresh existing generated clients as a precaution:

```bash
kiota update
```

Refreshing generated clients ensures previously generated vulnerable code is replaced with hardened output.

## Acknowledgement

We would like to thank the researcher Thanatos Tian（Polyu) for finding this issue and for his contribution to this open source project.
GitHub Security Advisory: GHSA-fcpv-w245-r2q7
Package: DotNetNuke.Core (NUGET)
Severity: LOW (CVSS 0.0)
Vulnerable versions: >= 6.0.0, < 10.2.2
Patched in: 10.2.2

Summary: DotNetNuke.Core security code analysis rules triggered

Details:
The codebase raises code analysis warnings related to security, including CA3075, CA5366, CA5371, CA5368, CA5369, CA5372, CA5379, CA5350, and CA5351.

Most of these deal with disabling DTD processing in XML documents, but also includes cryptographic algorithm choices.
GitHub Security Advisory: GHSA-5xg3-585r-9jh5
Package: Magick.NET-Q8-x86 (NUGET)
Severity: MODERATE (CVSS 6.2)
CWE: CWE-193: Off-by-one Error
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has an off-by-one error in MSL decoder could result in crash

Details:
An off by one error in de MSL decoder could result in a crash when a malicous msl file is read.
GitHub Security Advisory: GHSA-5xg3-585r-9jh5
Package: Magick.NET-Q8-x64 (NUGET)
Severity: MODERATE (CVSS 6.2)
CWE: CWE-193: Off-by-one Error
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has an off-by-one error in MSL decoder could result in crash

Details:
An off by one error in de MSL decoder could result in a crash when a malicous msl file is read.
GitHub Security Advisory: GHSA-5xg3-585r-9jh5
Package: Magick.NET-Q8-arm64 (NUGET)
Severity: MODERATE (CVSS 6.2)
CWE: CWE-193: Off-by-one Error
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has an off-by-one error in MSL decoder could result in crash

Details:
An off by one error in de MSL decoder could result in a crash when a malicous msl file is read.
GitHub Security Advisory: GHSA-5xg3-585r-9jh5
Package: Magick.NET-Q8-OpenMP-x64 (NUGET)
Severity: MODERATE (CVSS 6.2)
CWE: CWE-193: Off-by-one Error
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has an off-by-one error in MSL decoder could result in crash

Details:
An off by one error in de MSL decoder could result in a crash when a malicous msl file is read.
GitHub Security Advisory: GHSA-5xg3-585r-9jh5
Package: Magick.NET-Q8-OpenMP-arm64 (NUGET)
Severity: MODERATE (CVSS 6.2)
CWE: CWE-193: Off-by-one Error
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has an off-by-one error in MSL decoder could result in crash

Details:
An off by one error in de MSL decoder could result in a crash when a malicous msl file is read.
GitHub Security Advisory: GHSA-5xg3-585r-9jh5
Package: Magick.NET-Q8-AnyCPU (NUGET)
Severity: MODERATE (CVSS 6.2)
CWE: CWE-193: Off-by-one Error
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has an off-by-one error in MSL decoder could result in crash

Details:
An off by one error in de MSL decoder could result in a crash when a malicous msl file is read.
GitHub Security Advisory: GHSA-5xg3-585r-9jh5
Package: Magick.NET-Q16-x86 (NUGET)
Severity: MODERATE (CVSS 6.2)
CWE: CWE-193: Off-by-one Error
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has an off-by-one error in MSL decoder could result in crash

Details:
An off by one error in de MSL decoder could result in a crash when a malicous msl file is read.
GitHub Security Advisory: GHSA-5xg3-585r-9jh5
Package: Magick.NET-Q16-x64 (NUGET)
Severity: MODERATE (CVSS 6.2)
CWE: CWE-193: Off-by-one Error
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has an off-by-one error in MSL decoder could result in crash

Details:
An off by one error in de MSL decoder could result in a crash when a malicous msl file is read.
GitHub Security Advisory: GHSA-5xg3-585r-9jh5
Package: Magick.NET-Q16-arm64 (NUGET)
Severity: MODERATE (CVSS 6.2)
CWE: CWE-193: Off-by-one Error
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has an off-by-one error in MSL decoder could result in crash

Details:
An off by one error in de MSL decoder could result in a crash when a malicous msl file is read.
GitHub Security Advisory: GHSA-5xg3-585r-9jh5
Package: Magick.NET-Q16-OpenMP-x64 (NUGET)
Severity: MODERATE (CVSS 6.2)
CWE: CWE-193: Off-by-one Error
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has an off-by-one error in MSL decoder could result in crash

Details:
An off by one error in de MSL decoder could result in a crash when a malicous msl file is read.
GitHub Security Advisory: GHSA-5xg3-585r-9jh5
Package: Magick.NET-Q16-OpenMP-arm64 (NUGET)
Severity: MODERATE (CVSS 6.2)
CWE: CWE-193: Off-by-one Error
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has an off-by-one error in MSL decoder could result in crash

Details:
An off by one error in de MSL decoder could result in a crash when a malicous msl file is read.
GitHub Security Advisory: GHSA-5xg3-585r-9jh5
Package: Magick.NET-Q16-HDRI-x86 (NUGET)
Severity: MODERATE (CVSS 6.2)
CWE: CWE-193: Off-by-one Error
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has an off-by-one error in MSL decoder could result in crash

Details:
An off by one error in de MSL decoder could result in a crash when a malicous msl file is read.
GitHub Security Advisory: GHSA-5xg3-585r-9jh5
Package: Magick.NET-Q16-HDRI-x64 (NUGET)
Severity: MODERATE (CVSS 6.2)
CWE: CWE-193: Off-by-one Error
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has an off-by-one error in MSL decoder could result in crash

Details:
An off by one error in de MSL decoder could result in a crash when a malicous msl file is read.
GitHub Security Advisory: GHSA-5xg3-585r-9jh5
Package: Magick.NET-Q16-HDRI-arm64 (NUGET)
Severity: MODERATE (CVSS 6.2)
CWE: CWE-193: Off-by-one Error
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has an off-by-one error in MSL decoder could result in crash

Details:
An off by one error in de MSL decoder could result in a crash when a malicous msl file is read.
GitHub Security Advisory: GHSA-5xg3-585r-9jh5
Package: Magick.NET-Q16-HDRI-OpenMP-arm64 (NUGET)
Severity: MODERATE (CVSS 6.2)
CWE: CWE-193: Off-by-one Error
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has an off-by-one error in MSL decoder could result in crash

Details:
An off by one error in de MSL decoder could result in a crash when a malicous msl file is read.
GitHub Security Advisory: GHSA-5xg3-585r-9jh5
Package: Magick.NET-Q16-HDRI-AnyCPU (NUGET)
Severity: MODERATE (CVSS 6.2)
CWE: CWE-193: Off-by-one Error
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has an off-by-one error in MSL decoder could result in crash

Details:
An off by one error in de MSL decoder could result in a crash when a malicous msl file is read.
GitHub Security Advisory: GHSA-5xg3-585r-9jh5
Package: Magick.NET-Q16-AnyCPU (NUGET)
Severity: MODERATE (CVSS 6.2)
CWE: CWE-193: Off-by-one Error
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has an off-by-one error in MSL decoder could result in crash

Details:
An off by one error in de MSL decoder could result in a crash when a malicous msl file is read.
GitHub Security Advisory: GHSA-r83h-crwp-3vm7
Package: Magick.NET-Q8-x86 (NUGET)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-416: Use After Free, CWE-693: Protection Mechanism Failure
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has a heap-use-after-free via XMP profile could result in a crash when printing the values.

Details:
An heap use after free when reading an invalid XMP profile could result in a crash due to an heap use after free when printing the values.
GitHub Security Advisory: GHSA-r83h-crwp-3vm7
Package: Magick.NET-Q8-x64 (NUGET)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-416: Use After Free, CWE-693: Protection Mechanism Failure
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has a heap-use-after-free via XMP profile could result in a crash when printing the values.

Details:
An heap use after free when reading an invalid XMP profile could result in a crash due to an heap use after free when printing the values.
GitHub Security Advisory: GHSA-r83h-crwp-3vm7
Package: Magick.NET-Q8-arm64 (NUGET)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-416: Use After Free, CWE-693: Protection Mechanism Failure
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has a heap-use-after-free via XMP profile could result in a crash when printing the values.

Details:
An heap use after free when reading an invalid XMP profile could result in a crash due to an heap use after free when printing the values.
GitHub Security Advisory: GHSA-r83h-crwp-3vm7
Package: Magick.NET-Q8-OpenMP-arm64 (NUGET)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-416: Use After Free, CWE-693: Protection Mechanism Failure
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has a heap-use-after-free via XMP profile could result in a crash when printing the values.

Details:
An heap use after free when reading an invalid XMP profile could result in a crash due to an heap use after free when printing the values.
GitHub Security Advisory: GHSA-r83h-crwp-3vm7
Package: Magick.NET-Q8-AnyCPU (NUGET)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-416: Use After Free, CWE-693: Protection Mechanism Failure
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has a heap-use-after-free via XMP profile could result in a crash when printing the values.

Details:
An heap use after free when reading an invalid XMP profile could result in a crash due to an heap use after free when printing the values.
GitHub Security Advisory: GHSA-r83h-crwp-3vm7
Package: Magick.NET-Q16-x86 (NUGET)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-416: Use After Free, CWE-693: Protection Mechanism Failure
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has a heap-use-after-free via XMP profile could result in a crash when printing the values.

Details:
An heap use after free when reading an invalid XMP profile could result in a crash due to an heap use after free when printing the values.
GitHub Security Advisory: GHSA-r83h-crwp-3vm7
Package: Magick.NET-Q16-x64 (NUGET)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-416: Use After Free, CWE-693: Protection Mechanism Failure
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has a heap-use-after-free via XMP profile could result in a crash when printing the values.

Details:
An heap use after free when reading an invalid XMP profile could result in a crash due to an heap use after free when printing the values.
GitHub Security Advisory: GHSA-r83h-crwp-3vm7
Package: Magick.NET-Q16-arm64 (NUGET)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-416: Use After Free, CWE-693: Protection Mechanism Failure
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has a heap-use-after-free via XMP profile could result in a crash when printing the values.

Details:
An heap use after free when reading an invalid XMP profile could result in a crash due to an heap use after free when printing the values.
GitHub Security Advisory: GHSA-r83h-crwp-3vm7
Package: Magick.NET-Q16-OpenMP-x64 (NUGET)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-416: Use After Free, CWE-693: Protection Mechanism Failure
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has a heap-use-after-free via XMP profile could result in a crash when printing the values.

Details:
An heap use after free when reading an invalid XMP profile could result in a crash due to an heap use after free when printing the values.
GitHub Security Advisory: GHSA-r83h-crwp-3vm7
Package: Magick.NET-Q16-OpenMP-arm64 (NUGET)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-416: Use After Free, CWE-693: Protection Mechanism Failure
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has a heap-use-after-free via XMP profile could result in a crash when printing the values.

Details:
An heap use after free when reading an invalid XMP profile could result in a crash due to an heap use after free when printing the values.
GitHub Security Advisory: GHSA-r83h-crwp-3vm7
Package: Magick.NET-Q16-HDRI-x86 (NUGET)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-416: Use After Free, CWE-693: Protection Mechanism Failure
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has a heap-use-after-free via XMP profile could result in a crash when printing the values.

Details:
An heap use after free when reading an invalid XMP profile could result in a crash due to an heap use after free when printing the values.
GitHub Security Advisory: GHSA-r83h-crwp-3vm7
Package: Magick.NET-Q16-HDRI-x64 (NUGET)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-416: Use After Free, CWE-693: Protection Mechanism Failure
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has a heap-use-after-free via XMP profile could result in a crash when printing the values.

Details:
An heap use after free when reading an invalid XMP profile could result in a crash due to an heap use after free when printing the values.
GitHub Security Advisory: GHSA-r83h-crwp-3vm7
Package: Magick.NET-Q16-HDRI-arm64 (NUGET)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-416: Use After Free, CWE-693: Protection Mechanism Failure
Vulnerable versions: < 14.12.0
Patched in: 14.12.0

Summary: ImageMagick has a heap-use-after-free via XMP profile could result in a crash when printing the values.

Details:
An heap use after free when reading an invalid XMP profile could result in a crash due to an heap use after free when printing the values.