Andrejtomci

**Nome do Software Vulnerável e Versões Afetadas** Vim versões anteriores a 9.2.0565 **Description** A função `update snapshot()` em src/terminal.c copia a tela do terminal visível para o buffer de rolagem durante um snapshot. O processo envolve a iteração pelo array `chars[]` de cada célula da tela sem um limite superior, dependendo exclusivamente de um terminador NUL para parar. Quando uma célula preenche todos os slots `VTERM MAX CHARS PER CELL` (6)—consistindo em um caractere base e cinco marcas de combinação—a libvterm integrada retorna o array sem um NUL terminador. Isso faz com que o loop leia além do array fixo de seis elementos e anexe valores fora dos limites a um buffer reservado para apenas seis caracteres. Um programa que renderiza saída dentro de uma janela :terminal pode disparar esse comportamento usando uma sequência curta de bytes, resultando em um travamento. **Recommendations** Atualize para a versão 9.2.0565.

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, a reflected DOM-based XSS vulnerability in taillog.js allows an unauthenticated attacker to inject arbitrary HTML into the Pi-hole admin interface by crafting a malicious URL. The file query parameter is interpolated into an innerHTML assignment without escaping. Because the Content-Security-Policy is missing the form-action directive, injected <form> elements can exfiltrate credentials to an external origin. This vulnerability is fixed in 6.5.

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, client hostnames and IP addresses from the FTL database are rendered into the DOM without escaping in network.js (Network page) and charts.js/index.js (Dashboard chart tooltips). While upstream validation in dnsmasq and FTL blocks HTML characters via normal DHCP/DNS paths, the web UI performs no output escaping — an inconsistency with other fields in the same file that are properly escaped. This vulnerability is fixed in 6.5.

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configuration values from the /api/config endpoint are placed directly into HTML value="" attributes without escaping in settings-advanced.js, enabling HTML attribute injection. A double quote in any config value breaks out of the attribute context. JavaScript execution is blocked by the server's CSP (script-src 'self'), but injected attributes can alter element styling for UI redressing. The primary attack vector is importing a malicious teleporter backup, which bypasses per-field server-side validation. This vulnerability is fixed in 6.5.

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, the formatInfo() function in queries.js renders data.upstream, data.client.ip, and data.ede.text into HTML without escaping when a user expands a query row in the Query Log, enabling stored HTML injection. JavaScript execution is blocked by the server's CSP (script-src 'self'). The same fields are properly escaped in the table view (rowCallback), confirming the omission was an oversight. This vulnerability is fixed in 6.5.

**Name of the Vulnerable Software and Affected Versions** calibre versions prior to 9.5.0 **Description** calibre is an e-book manager used for viewing, converting, editing, and cataloging e-books. A path traversal flaw exists in the RocketBook (.rb) input plugin (src/calibre/ebooks/rb/reader.py). This allows an attacker to write arbitrary files to any path writable by the calibre process when a user opens or converts a specially crafted .rb file. The issue stems from a failure to apply a previous fix for a similar flaw found in the PDB readers. **Recommendations** Update to version 9.5.0 or later.