Ecosystem
NuGet
1,172 known vulnerabilities.
Most affected packages
69 results · Clear filters · Feed
-
Low 3.1
Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests
Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.response_semantics.oauth_card_path from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without valid…
-
Low 3.3
ImageMagick before 7.1.2-27 Memory Leak via Invalid CLI Options
ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger memory exhaustion by repeatedly supplying malformed command-line arguments to consume system resourc…
-
Low 3.3
AWS CDK CodeBuild S3 Log Encryption Boolean Inversion
## Summary The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. We identified an issue in which explicitly setting `encrypted: true` …
-
Low 2.5
ImageMagick before 7.1.2-26 Memory Leak via TIFF Encoder
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an invalid tiff:tile-geometry is specified. Supplying malformed tile geometry parameters causes allocated memory not to be released, which can lead to increased memory c…
-
Low 3.7
ImageMagick before 7.1.2-26 Memory Leak in ICON decoder
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file that triggers an allocation failure leaks memory, which may lead to a denial of service.
-
Low 2.9
ImageMagick before 7.1.2-26 Memory Leak in MIFF Encoder
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs when a memory allocation fails during MIFF image processing, which can lead to denial of service.
-
Low 3.7
ImageMagick before 7.1.2-26 Memory Leak in YUV Decoder
ImageMagick before 7.1.2-26 and 6.9.x before 6.9.13-51 contains a memory leak in the YUV decoder that occurs when opening of the blob fails. Repeated triggering can lead to resource exhaustion (denial of service).
-
Low 2.9
ImageMagick before 7.1.2-26 Memory Leak in TIFF Encoder
ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the TIFF encoder when memory allocation fails. Attackers can trigger allocation failures during TIFF image processing to cause memory exhaustion and denial of service.
-
Low 2.9
ImageMagick before 7.1.2-26 Memory Leak in Hough Lines
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the hough lines operation: when a specific operation fails, a small memory leak occurs.
-
Low 2.9
ImageMagick before 7.1.2-26 Memory Leak in JNG encoder
ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the JNG encoder when a blob cannot be opened. Attackers can trigger the memory leak by providing malformed JNG files that fail blob operations, causing resource exhaustion.
-
Low 2.9
ImageMagick before 7.1.2-26 Memory Leak in Log Colorspace
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in color transformation to the log colorspace: when the operation fails, a small amount of memory is not released.
-
Low 2.9
ImageMagick before 7.1.2-26 Information Disclosure via identify
ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability: when a profile is displayed with the identify command and the profile value is not printable, a single byte at the end of the profile can be printed (read past the pro…
-
Low 2.9
ImageMagick before 7.1.2-26 Memory Leak in TIFF Encoder
ImageMagick before 7.1.2-26 (and 6.x before 6.9.13-51) contains a memory leak in the TIFF encoder that occurs when a temporary file cannot be created, resulting in a small memory leak.
-
Low 3.7
ImageMagick before 7.1.2-26 Use-After-Free via freetype
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails: the method does not exit and continues to use memory that was already freed. This can be triggered during image processing and ma…
-
Low 3.3
ImageMagick before 7.1.2-26 Policy Bypass via script operation
ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This allows reading files from paths that are otherwise disallowed by the configured security poli…
-
Low 1.8
ImageMagick before 7.1.2-26 Heap Buffer Over-Write via X11
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a heap-based buffer over-write vulnerability that occurs when running an X11 import with a crafted window title, which can result in heap memory corruption and denial of service.
-
Low 3.3
ImageMagick - Memory Leak in ASHLAR Coder Action Failure
ImageMagick through 7.1.2-18 contains a memory leak vulnerability in the ASHLAR coder when an action fails. Attackers can trigger failed actions to exhaust memory resources and cause denial of service.
-
Low 2.9
ImageMagick before 7.1.2-26 Memory Leak via VIFF Encoder
ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.
-
Low 3.7
ImageMagick before 7.1.2-26 Use-After-Free in FormatMagickCaption
ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling de…
-
Low 3.3
ImageMagick before 7.1.2-26 Policy Bypass via APNG encoder
ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding…
-
Low 3.7
ImageMagick before 7.1.2-26 Heap Use-After-Free via XMP
ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crash…
-
Low 3.3
ImageMagick before 7.1.2-26 Memory Allocation Policy Bypass
ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the confi…
-
Low 3.3
ImageMagick - Heap Buffer Overflow Read via Unrecognized Magnify Method
ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive informat…
-
Low 3.7
ImageMagick - Use-After-Free Write in PDB Decoder
ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails. Attackers can trigger this vulnerability by processing malicious PDB files to cause crashes or write a single zero b…
-
Low 3.3
ImageMagick - Memory Leak in META Reader APP1JPEG Error Path
ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource ex…
-
Low 3.7
CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, the CoreWCF WS-Security 1.0 receive pipeline validates ds:SignedInfo SignatureMethod against the configured SecurityAlgorithmSuite but does…
-
Low 3.3
ImageMagick - Heap-buffer-overflow Read in GetPixelIndex via OpenPixelCache Metadata Desynchronization
ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex caused by OpenPixelCache updating image channel metadata before pixel cache memory allocation. Attackers can trigger memory and disk allocation failures to cause a…
-
Low 3.3
ImageMagick - Heap Buffer Overflow in FTXT Encoder via format Parameter
ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the FTXT encoder due to missing boundary checks when parsing ftxt:format. Remote attackers can trigger an out of bounds read by crafting malicious FTXT image files to cause denial of…
-
Low 3.7
ImageMagick - Information Disclosure via AES-CTR Nonce Reuse in PasskeyEncipherImage
ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in the cipher implementation to recover plaintext information from encrypted images.
-
Low 3.7
ImageMagick - Memory Leak in PNG Encoder via MNG Image Writing
ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG encoder when writing MNG images. Attackers can trigger the encoder failure condition to exhaust memory resources and cause denial of service.
-
Low 1.9
ImageMagick - Memory Leak in LoadOpenCLDeviceBenchmark() via Malformed XML
ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place …
-
Low 3.3
ImageMagick - Heap Buffer Overflow via Off-by-One in Morphology Processing
ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing out-of-bounds heap buffer reads. Attackers can trigger heap buffer overflow by providing incorrect morphology parameters causing single pixel memory access violations.
-
Low 3.3
ImageMagick - Division by Zero in Binomial Kernel Processing
ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel processing that allows attackers to cause denial of service. An attacker can supply a large binomial kernel value causing integer overflow, resulting in division by zero …
-
Low 3.3
ImageMagick - Out-of-bounds Access in ConnectedComponentsImage via connected-components Artifact
ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with invalid indices. Attackers can trigger access violations by specifying malformed connected-components …
-
Low 3.7
ImageMagick - Memory Leak in Raw Pixel Data Coders
ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and…
-
Low 3.7
ImageMagick - Heap Use-After-Free in Meta Coder
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when memory allocation fails, a single byte is written to a stale pointer. Remote attackers can trigger it by processing specially crafted image files, causing a denia…
-
Low 3.7
ImageMagick - Heap Out-of-Bounds Read in PCD Decoder
ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potentia…
-
Low 3.7
ImageMagick - Heap Out-of-Bounds Read in PSB RLE Decoding
ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB (PSD v2) RLE decoding path (ReadPSDChannelRLE in coders/psd.c) that causes a heap out-of-bounds read on 32-bit builds. Processing a crafted PSB file can lead to inf…
-
Low 1.9
Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Encryption 4.0.0 through 4.1.0, configuring `encrypt:rsa:algorithm=OAEP` does not enable OAEP encryption. Du…
-
Low 3.8
Zio has SubFileSystem Path Confinement Bypass via Unresolved `..` Segment
# Summary `SubFileSystem` fails to confine operations to its declared sub path when the input path is `/../` (or equivalents `/../`, `/..\\`). This path passes all validation but resolves to the root of the parent filesystem, allowing directory level operatio…