Amemoyoi

**Name of the Vulnerable Software and Affected Versions** Apache NimBLE versions prior to 1.10.0 **Description** A reachable assertion issue exists in the ATT parser. A specially crafted ATT Read Multiple Variable Response (BLE ATT OP READ MULT VAR RSP) can trigger an assert, provided the Device Under Test (DUT) first sends an ATT Read Multiple Variable Request. **Recommendations** Upgrade to version 1.10.0.

**Name of the Vulnerable Software and Affected Versions** NamelessMC versions prior to 2.2.5 **Description** OAuth callback handling fails to validate the `state` parameter on the server side before exchanging the authorization code. This flaw enables an attacker to capture a valid OAuth callback URL for their own account and trick a victim's browser into navigating to it. Consequently, the victim's session is authenticated as the account linked to the attacker, a process known as OAuth login CSRF or session swapping. **Recommendations** Update to version 2.2.5.

**Name of the Vulnerable Software and Affected Versions** Caddy versions 2.4.0 through 2.11.2 **Description** An authorization-to-object mismatch exists in the remote admin functionality. The authorization layer uses string prefix matching, while the `/config` traversal layer parses array indices numerically using the `strconv.Atoi()` function. This discrepancy allows a remote admin client restricted to a specific path, such as `/config/apps/http/servers/srv/routes/0`, to access and modify a different array element by using a leading-zero index, such as `/config/apps/http/servers/srv/routes/01`. In this scenario, the authorization layer accepts the request because it matches the prefix, but the traversal layer resolves the index `01` to numeric index `1`, granting unauthorized access to a different configuration object. **Recommendations** Update to version 2.11.3. As a temporary workaround, restrict the use of the `/config` API paths containing numeric array indices for remote admin clients until the update is applied.

**Name of the Vulnerable Software and Affected Versions** arduino-esp32 versions prior to 3.3.8 **Description** A remotely reachable memory corruption issue exists in the NBNS packet handling path. When NetBIOS is enabled via the `NBNS.begin()` function, the device listens on UDP port 137 and processes untrusted NBNS requests from the local network. The request parser trusts the attacker-controlled `name len` field without enforcing a bound consistent with the fixed-size destination buffers used later in the flow. **Recommendations** Update to version 3.3.8. As a temporary workaround, avoid calling the `NBNS.begin()` function to disable NetBIOS functionality.

**Name of the Vulnerable Software and Affected Versions** LinkAce versions prior to 2.5.3 **Description** LinkAce is a self-hosted archive for website links. Versions prior to 2.5.3 allow disclosure of a private note attached to a non-private link to another authenticated user through the web interface. The API correctly enforces note visibility, but the web link detail page does not apply equivalent filtering. An authenticated user permitted to view another user’s `internal` or `public` link can read that user’s `private` notes attached to the link. **Recommendations** Update to version 2.5.3 or later.

**Name of the Vulnerable Software and Affected Versions** LinkAce versions prior to 2.5.3 **Description** LinkAce is a self-hosted archive for collecting website links. Versions before 2.5.3 prevent direct requests to private IP literals, but continue to make server-side requests to internal resources when referenced via an internal hostname. This allows an authenticated user to initiate server-side requests to internal services accessible by the LinkAce server, but not directly accessible from outside the network. The issue involves server-side request forgery, where an attacker can leverage the server to access internal resources. **Recommendations** Update to version 2.5.3 or later.

**Name of the Vulnerable Software and Affected Versions** LIBPNG versions 1.6.36 through 1.6.55 **Description** An out-of-bounds read and write exists in the ARM/AArch64 Neon-optimized palette expansion path. When expanding 8-bit paletted rows to RGB or RGBA, the Neon loop processes a final partial chunk without verifying if sufficient input pixels remain. Because the implementation operates backward from the end of the row, the final iteration dereferences pointers before the start of the row buffer, leading to an out-of-bounds read, and writes expanded pixel data to those same underflowed positions, causing an out-of-bounds write. This issue is reachable through the normal decoding of attacker-controlled PNG input if Neon is enabled. **Recommendations** Update to version 1.6.56.