ImageMagick: missing check for fputc function in multiple files

The functions ReadDCMImage in coders/dcm.c, ReadPWPImage in coders/pwp.c, ReadCALSImage in coders/cals.c, and ReadPICTImage in coders/pict.c in ImageMagick 7.0.8-4 do not check the return value of the fputc function, which allows remote attackers to cause a denial of service via a crafted image file.

ImageMagick: out-of-bounds write in InsertRow function in coders/cut.c

The function InsertRow in coders/cut.c in ImageMagick 7.0.7-37 allows remote attackers to cause a denial of service via a crafted image file due to an out-of-bounds write.

ImageMagick: memory leak in TIFFWritePhotoshopLayers function in coders/tiff.c

ImageMagick 7.0.8-6 has a memory leak vulnerability in the TIFFWritePhotoshopLayers function in coders/tiff.c.

ImageMagick: memory leak in ReadOneJNGImage function in coders/png.c

ImageMagick 7.0.8-5 has a memory leak vulnerability in the function ReadOneJNGImage in coders/png.c.

Typesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation.

Evolution CMS 1.4.x allows XSS via the manager/ search parameter.

Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI.

Nucleus CMS 3.70 allows HTML Injection via the index.php body parameter.

Blackcat CMS 1.3.2 allows XSS via the willkommen.php?lang=DE page title at backend/pages/modify.php.

Pluck v4.7.7 allows CSRF via admin.php?action=settings.

Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title.

Mezzanine CMS v4.3.1 allows XSS via the /admin/blog/blogcategory/add/?_to_field=id&_popup=1 title parameter at admin/blog/blogpost/add/.

Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter.

Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file.

panel/uploads/#elf_l1_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.

panel/login in Kirby v2.5.12 allows XSS via a blog name.

panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature.

index.php/Admin/Classes in Typesetter 5.1 allows XSS via the description of a new class name.

index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.

panel/pages/home/edit in Kirby v2.5.12 allows XSS via the title of a new page.