Orthanc-Server Orthanc any version

Orthanc Server Missing Authentication for Critical Function

Heap Buffer Overflow in DICOM Image Decoder via VR UL Dimensions

Heap Buffer Overflow in DICOM Image Decoder (Palette Color Decode)

Out-of-Bounds Read in DicomImageDecoder (DecodeLookupTable)

Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in specific deployment scenarios allows the attacker to overwrite the configuration, which can be exploited to trigger Remote Code Execution (RCE).

Memory Exhaustion via Unbounded Content-Length

Out-of-Bounds Read in DicomStreamReader

Gzip Decompression Bomb via Content-Encoding Header

Memory Exhaustion via Forged ZIP Metadata

Heap Buffer Overflow in PAM Image Buffer Allocation

Out-of-Bounds Read in DicomImageDecoder (PMSCT_RLE1 Decompression)

Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability. The vulnerability was present in the server's error reporting.